Free & open source · a plugin for Unraid 7
A team of characters, each looking after one part of your server — snapshots, the nightly backup, restores, logs, security, tidying up. They tell you what they noticed and, where it makes sense, let you act on it — before anything changes, they show you what will happen and ask.
Runs on your own server · two servers back each other up · reads your UniFi gateway’s log · GPL-3.0-or-later · five languages
What usually gets in the way of looking after a server — and how it goes with the office.
Usually: A plugin here, a script there, each with a page of its own
With the office: Everything in one office in Unraid’s menu bar — it does the admin chores for you, and the staff work hand in hand
Usually: Backups nobody ever tried to bring back
With the office: A restore drill proves on throwaway copies that they come back
Usually: A restore worked out under pressure, from scratch
With the office: Mr. Restori shows first exactly what will happen — and never deletes what he replaces
Usually: A second server stands idle
With the office: Two offices become partner offices: every night what changed goes to the other server, encrypted on the way, through a door that lets in only the partner’s key — the sender can never delete anything there
Usually: Tidying up means guessing what is still in use
With the office: Ms. Dustdevil knows what lies where, finds what nobody uses and puts it in a storeroom first — nothing is thrown away at once; missing Docker icons she fills in on the side
Usually: Changes on the server go unnoticed
With the office: The Night Watchman learns what is normal and tells you only what is different
Usually: The router’s logs nobody reads
With the office: The Night Watchman reads your UniFi gateway’s log too: new devices, logins to the router and its VPN, firewall changes, intrusion detections — and tells you what is different from normal
Usually: Logs you scroll through alone
With the office: Ms. Protocolli counts and groups what sounds like an error or a warning
Usually: Every check wakes the sleeping disks
With the office: Sleeping disks stay asleep unless you ask
A fresh office has only the Team Lead. He asks around who would suit your server — no Emby, no Jack Emby; no ZFS or btrfs, no snapshots — and you hire whom you need (Mr. Restori comes together with Mr. Backupsy), or let them go again later; their data and settings stay until you decide what goes.
Leads the team — whom to hire, what the office needs from your server, and what’s left for you to do
Suggests whom to hire, collects what every desk needs and lists what is missing — still to do, recommended, good to know — each with a link into Unraid. Pairs your office with a partner office and hands a gone server’s copies to a new one.
Knows every corner of the server and sees dust in all of them — tidies up, but never throws anything away at once
Where is what: shares, containers, VMs, disks, plugins, and advice on keeping things in order. Tidying up: templates, appdata folders and VM leftovers nobody uses — into a storeroom you can put back from. Gives containers without a picture a logo.
Looks after the nightly backup — a bit scatterbrained and anxious, so he checks everything three times
Runs the office’s backup engine: consistent snapshots, database dumps, a package per app and VM, Kopia offsite, partner offices. Set up in the browser — he reads the server and proposes, you decide.
Italian by birth — keeps an eye on every snapshot: ZFS, btrfs and VMs. Con amore.
Create, delete with an estimate of the space freed, rename, hold, unmount. Schedules with a simple retention that only ever clears away her own snapshots — and they run even when the office isn’t open.
Brings back what is gone — careful as a restorer in white gloves
Per app and VM: what can come back from where, with dates. Brings back databases, folders, whole shares, templates and VM configurations himself, puts aside what he replaces and can undo every restore — and practises it in his drill. «Piano, piano.»
Reads every log out loud — sadly she understands none of it
The office’s logs, Unraid’s, every User Script’s, every container’s and the router’s: live like tail -f, filtered, copied or downloaded. Her tour counts what sounds like an error and how full /var/log is. Read only.
The office’s security: how it stands, and what is different from normal
Tips on what he would set differently, and a watch book: new logins, changed containers and plugins, the flash, cron lines, unusual data flow, snapshots gone — and what your UniFi gateway says about the server. Every five minutes, also with the office closed. Read only.
Intern and film fan — fetches coffee, entertains everyone and gets ready what you’ll watch next
Looks after helmi1987’s EmbyCache — what you are about to watch goes to the fast pool so the array disks can sleep — and «Consolidate folders», which brings each film folder together on one disk.
From outside — knows the externals the office relies on, and how to get them in
Fix Common Problems, Files Viewer, Kopia, Stream Viewer, and monitoring with Node Exporter, Prometheus and Grafana if you like: what they are good for and how to install them — or he does it, with a preview first. He also shows how your router’s log reaches Unraid.
Mr. Backupsy runs the backup every night; Mr. Restori proves that it comes back. Between them, every app and VM knows where its copies are.
What a run is doing right now and when it will be done, how the last nights went. Stop the array and a run stops cleanly at once — the next one continues.
ZFS and btrfs snapshots as the base of every night. Which containers stop for them is part of the setup; VMs are held for the moment of the snapshot.
Templates or compose files, database dumps, consistent copies of the databases of media servers that keep running; for a VM its XML, NVRAM and TPM state. Nextcloud goes into maintenance mode meanwhile.
Small and important first: the flash, the apps, then the shares and VMs. The Consultant sets up the repository if you like — with S3 Object Lock against ransomware where your bucket offers it.
Two servers with the office copy their nights to each other through a door: only the ZFS blocks changed since the last night, always encrypted on the way. The sender can never delete anything at the partner.
He reads the server and proposes, with reasons — you change what you like and apply. Whatever turns up later stays local and keeps running until you decide.
Monthly, at night after a backup that went well (or weekly, or when you press Practise now…), Mr. Restori proves on throwaway copies that what Mr. Backupsy keeps really comes back — and writes down per app and VM which level is proven, from which copy, and when.
No warranty for your backups either. The office does its best, but a backup can be faulty or incomplete. You stay responsible for your data: test a restore now and then, and keep more than one copy — for example 3-2-1: three copies, on two kinds of storage, one of them off site.
Two Unraid servers with the office — yours, the family’s — keep each other’s nights. The Team Lead pairs them, Mr. Backupsy sends, Mr. Restori brings it back — also onto a new server when the old one is gone.
At the Team Lead: Add a partner… on one server, Accept a partner… on the other — two blocks to copy and a safety code both pages must show. Nothing goes out before you compared it. Each side chooses whether it sends, keeps, or both.
Mr. Backupsy sends what you tick — shares and VMs that are a ZFS dataset of their own, and the backup place with the packages — after the first night only what changed, encrypted over SSH. The partner’s key opens a door, not a login: only from its address, only the office’s few things. It can’t run a command, browse the server or delete the history kept there. A transfer cut off goes on where it stopped.
Which of the partner’s units it keeps, on which pool, how long — the newest of the last days, weeks and months — a quota, a time window for receiving, and whether it may wake a sleeping pool. The copies land in datasets of their own, never mounted, never shared.
Every 15 minutes each office asks its partner how it is; silent for six hours, and the Team Lead tells you — on his list and in Unraid’s notifications. The Night Watchman watches the door: a line changed, the key coming from another address, refusals in a row.
Its partner still keeps the copies. The new server asks for them with Start from a partner’s copy…, the partner answers with Hand … copies to a new server… — again two blocks and a code, and a ticket that may only read those copies and ends by itself after seven days.
The first night is the long one. Everything you ticked goes over once — at a home upload of 20–50 Mbit/s a terabyte takes two to five days; from then on only the night’s changes travel. ZFS only. And whoever is root at the partner can read the copies: right for your own second server or the family — for a friend, Kopia (encrypted) is the better way.
Your UniFi gateway knows who logs in to it, which device is new and what its firewall blocks. It sends that to Unraid’s own syslog server; the Night Watchman reads it on every round and tells you what concerns this server — and only what is different from normal.
The gateway pushes, Unraid writes, he reads — no password, no API key, nothing to install, never a word to the router.
Each entry says what happened and what to do; the important ones also go to Unraid’s notifications.
Beside the watch book he says how secure the server stands: UPnP opening router ports by itself, the WebGUI reachable from the internet, a router clock that is off.
A watch book, not a SIEM. Your router’s log names every device; he keeps what concerns this server — another device appears only as a new one or one taking the server’s place, the rest are counts. Dashboards and weeks of the router’s log are for the neighbours the Consultant names (FireSight, Loki + Alloy, a real SIEM such as Graylog or Wazuh) — and with Also to the syslog each new entry goes on to your SIEM as one line.
The office lives inside Unraid’s web UI and looks like it.
Finds a desk, a section, a setting, a guide — and what the desks know right now: a share, an app, a VM, an entry of the watch book. In all five languages at once, forgiving a typo.
English, German, Italian, French and Spanish — your browser’s. Where it tells you what to click in Unraid, it names Unraid’s menus as Unraid shows them.
Black, white, azure or gray — the office takes Unraid’s. At the reception, Auto · Dark · Light keeps it light or dark for your browser, and A · A · A makes its text larger.
The pages fit a phone’s width — a look at last night’s backup works from the sofa, too.
Click a picture to see it large — browse with the arrow keys.
The reception
The Team Lead: what is left to do
Ms. Snapshotini: every snapshot
Mr. Backupsy: the nightly backup
Set up in the browser
Mr. Restori: what can come back
The Night Watchman: his rounds
Ms. Dustdevil: where is what
Ms. Dustdevil: tidying up
Ms. Protocolli: every log
The Consultant: the externals
The search
The office is an Unraid plugin: a page in Unraid’s menu bar, in Unraid’s look, behind Unraid’s login — and a small service of the plugin that does the work on the host.
Shows what the desks know and asks before anything changes. Every change carries Unraid’s CSRF token.
The page drops a request into a mailbox folder and rings the agent’s doorbell — a pipe in RAM — so the agent looks at once.
Accepts only the actions the desks define, checks each against a fresh look at the system, runs commands without a shell.
It starts with the array and stops within seconds when the array stops — it never holds it up. While the array is stopped, the Night Watchman keeps watch from RAM and the flash.
In Unraid: Plugins → Install Plugin, paste the address below and press Install.
Sekretariat in Unraid’s menu bar — under ⋯ → Entry in Unraid you can give it another name or place.
The Team Lead welcomes you and suggests whom to hire. For backups: Mr. Backupsy → Set up…, then Schedule….
https://github.com/dropnook/UnraidSecretaryOffice/releases/latest/download/unraid-secretary-office.plg
Unraid 7.3.2 or a newer 7.x. Older versions are refused at install. Unraid 8 is not supported for now — support follows once it is released and tested. Snapshots need ZFS or btrfs; partner offices need ZFS. Updates come like any plugin’s, under Plugins; your data stays.
The office is free and complete — nothing is locked, now or later. If it is useful to you, a tip is welcome; a share goes to helmi1987, who wrote Jack Emby’s tools.
Yes — free and open source under the GPL-3.0-or-later, and complete: nothing is locked, now or later. A tip is welcome; the supporter key you get for it unlocks nothing, it just says thank you.
No — nothing is locked, so there is nothing to unlock. The thank-you grows with the tip: a coffee (any amount), a round (from 20), cake (from 50) or a pay rise and the donations (from 100; in USD, EUR or CHF), shown as a small picture on the Team Lead’s thank-you plate, which only you see.
Unraid 7.3.2 or a newer 7.x; older versions are refused at install. Unraid 8 is not supported for now; support follows once it is released and tested. Snapshots need ZFS or btrfs (shares on XFS are backed up without one); partner offices need ZFS.
No. The office runs on your server, behind Unraid’s login, with no account anywhere. Backups leave the server only where you set them up: Kopia to your own storage, or a partner office you paired.
No. A fresh office has only the Team Lead. He suggests who would suit your server, you hire whom you need — and you can let them go again later; their data and settings stay until you decide what goes.
No, not unless you ask — for example when you want the size of an array share measured. A pool whose disks sleep at night can even be left asleep by the nightly backup, if you choose so in the setup.
The office does its best — and the restore drill proves regularly that what it keeps comes back. But a backup can still be faulty or incomplete, and there is no warranty. Test a restore now and then and keep more than one copy, for example 3-2-1.
Kopia, in a container. The Consultant tells you whether it is there and can install it and set up the repository — on S3-compatible storage or in a folder, say a mounted network drive; create a new repository or connect an existing one — always with a preview first. Or a second Unraid server with the office as a partner office.
From inside the office, without any account: ⋯ → Report a problem or a wish… on any page. Before anything is sent you see every part — your words, the versions, the desk’s last error and log lines, already cleaned of names, paths and addresses — and untick what should stay. It goes to the makers’ private inbox; you get a number. Or open an issue on GitHub.
English, German, Italian, French and Spanish — your browser’s language, or another one picked under ⋯ → Language. Where it tells you what to click in Unraid, it names Unraid’s menus as Unraid shows them, in the language Unraid runs in.
Yes. The office takes Unraid’s theme — black, white, azure or gray. The switch Auto · Dark · Light at the reception can force a dark or light look on the office’s own area for your browser; A · A · A beside it makes the text larger.
Under Plugins → Remove the code goes; the schedules are put aside on the flash and come back when you install it again, and partnerships with other offices end. Your data in appdata, the share UnraidSecretaryOffice, the setting on the flash and whatever the desks set up on the server — snapshots, Ms. Dustdevil’s storeroom — stay; delete them yourself if you no longer want them.