# Synology Web Hosting Back to [[Obsidian/Self-Hosting with Quartz/Self-Hosting with Quartz|Self-Hosting with Quartz]]. These steps are for DSM 7.2. Menu names differ slightly in 7.0 and 7.1. ## 1. Prepare DSM 1. Go to **Control Panel > Update & Restore** and update DSM. Then update all packages in **Package Center**. 2. In **Package Center**, install: - **Web Station** - **Apache HTTP Server 2.4**. Quartz pages are served without the `.html` extension, and Apache handles that through an `.htaccess` file. Web Station's default Nginx back end can't read `.htaccess`. - **Container Manager**. This is for the Tunnel route. ## 2. A folder just for the site Web Station creates a shared folder called `web` (`/volume1/web`). 1. In **File Station**, create `web/quartz`. Avoid the reserved names `blog`, `photo`, `photosrc` and `webdefault`. 2. Store nothing private here. Synology warns that anything in `web` or a document root can be served. 3. Make sure the **`http` group can read** `web/quartz`. Web Station runs as that group. Source: https://kb.synology.com/en-global/DSM/help/WebStation/application_webserv_virtualhost?version=7 ## 3. Least-privilege deploy user 1. Go to **Control Panel > User & Group > Create** and make a user `quartz-deploy` with a strong password. 2. Don't add it to `administrators`. 3. **Shared folder permissions:** give `web` Read/Write and every other folder No access. To fence it in more tightly, make a separate shared folder such as `quartz-site` and use that as the document root. 4. **Applications:** allow **SMB** only. Deny DSM, File Station and the rest if you like. 5. **Control Panel > File Services > SMB:** keep SMB enabled with the minimum protocol at SMB2 or later. 6. On Enceladus, the deploy script reaches it at `\\<NAS-name>\web\quartz`. You type the `quartz-deploy` credentials into Windows' own prompt once, and Windows saves them in Credential Manager. ## 4. Web Station: static site and portal 1. Go to **Web Station > Web Service > Create > Static website**. - Name: `quartz` - Document root: `web/quartz` - HTTP back-end server: **Apache HTTP Server 2.4** 2. Go to **Web Station > Web Portal > Create > Web service portal**, select `quartz`, and choose the portal type: - **Tunnel route (recommended): Port-based**, HTTP only, on an unused port such as `8180`. The tunnel connects to `http://<NAS-LAN-IP>:8180`. The port stays on your LAN and isn't forwarded on the router. - **DDNS route: Name-based**, with hostname `notes.jmarshallpittman.org` on ports 80/443 and **HSTS** ticked. 3. Test it on your LAN by opening `http://<NAS-LAN-IP>:8180`. Once the first deploy has run, the Quartz home page should load. Sources: - Web Station web services: https://kb.synology.com/en-us/DSM/help/WebStation/application_webserv_webservice?version=7 - Apache and `.htaccess` in Web Station: https://kb.synology.com/en-global/DSM/tutorial/How_do_I_protect_my_folders_in_the_quot_web_quot_shared_folder_from_unprivileged_access ## 5a. Container Manager: cloudflared (Tunnel route) Go to **Container Manager > Project > Create**. Name it `cloudflared`, give it a path such as `/docker/cloudflared`, and paste: ```yaml services: cloudflared: image: cloudflare/cloudflared:latest container_name: cloudflared restart: unless-stopped network_mode: host command: tunnel --no-autoupdate run environment: - TUNNEL_TOKEN=${TUNNEL_TOKEN} ``` - Put the token in an `.env` file in the project folder as `TUNNEL_TOKEN=...`. Never paste it into a note or a chat. - `network_mode: host` lets the tunnel reach `localhost:8180` or the LAN IP. - See [[Obsidian/Self-Hosting with Quartz/Cloudflare Tunnel|Cloudflare Tunnel]] for the Cloudflare side. ## 5b. DDNS route (fallback, only if there's no CGNAT) 1. **Control Panel > External Access > DDNS > Add:** provider Synology, giving a hostname like `marshall.synology.me`. 2. **Control Panel > Security > Certificate > Add > Let's Encrypt:** domain `notes.jmarshallpittman.org`. Let's Encrypt validates over port 80. 3. **Router:** forward TCP **80 and 443 only** to the NAS. **Never** forward 5000/5001, which are the DSM login. 4. **Cloudflare DNS:** add `CNAME notes → marshall.synology.me` and set it to **DNS only** (grey cloud). 5. In **Certificate > Settings**, assign the certificate to the Web Station portal. ## Security checklist - Don't expose DSM: keep 5000/5001 off the router, and leave QuickConnect and the DSM external address off for this. - Turn on **auto-block** (Control Panel > Security > Protection) and 2-factor sign-in for admin accounts. - Use a separate web folder and the `quartz-deploy` user, with no admin rights. - Keep DSM, Web Station, Apache and the `cloudflared` image updated. Re-pull the image monthly. - The site is static, with no PHP and no database, so there's very little to attack.