Skip to content

Instantly share code, notes, and snippets.

@geotrev

geotrev/ugreen-nas-https.md

Last active December 25, 2025 23:18
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save geotrev/3970780f91a2d1245556ccbfadf039d5 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save geotrev/3970780f91a2d1245556ccbfadf039d5 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
ugreen-nas-https.md

NAS + HTTPS Setup

Intended for UGREEN NASync NAS machines. This precise workflow was used on my own setup.

This guide is good for:

  • Select Linux distros (Arch-based in particular)
  • macOS

While reading this guide, keep in mind that mentions of example.com are placeholder; make sure to add your specific domain when copying commands.

Architecture Overview

  • DNS: Cloudflare (DNS-only)
  • Domain registrar: any
  • Certificate authority: Let’s Encrypt
  • ACME client: acme.sh (docker container)
  • Validation method: DNS-01 (wildcard)
  • Scope: LAN-only (no port forwarding, no wan)

Why This Design

  • DNS-01 allows certificate issuance without exposing the NAS to the internet
  • Cloudflare API tokens do not require IP whitelisting
  • Wildcard cert (*.example.com) supports future services
  • UGOS UI remains stable and vendor-supported (e.g., remote access)

Domain Registrar

Any will do!

Cloudflare DNS

First of all, why Cloudflare? For starters, as of this date, you get a few things:

  1. You can block crawlers (including AI!) from their dashboard.
  2. Registrars (e.g. Namecheap) can require an IP whitelist to use their APIs (which you could otherwise use use in place of Cloudflare).
  3. It's free. 🎉

TL;DR using Cloudflare as a DNS is very useful. If you get these benefits already from your registrar or you just don't like Cloudflare, then omitting Cloudflare is perfectly reasonable. Just make sure to use the right DNS API with ACME (implemented later) or your Let's Encrypt certificate won't populate.

After you add your domain to your Cloudflare dashboard, they give you some nameservers. Add them to your domain, taking care to port any records you may need from your regsitrar. Cloudflare claims there should be little, if any, downtime, so keep in mind you could experience a hiccup.

Verify DNS

If you connected to Cloudflare, check that the DNS is working:

$ dig +short NS example.com

Setup for Cloudflare on ACME

Create and store an API token.

IMPORTANT: Limit access only to your specific domain

Then get and store your zone / account IDs.

Add DNS Record

NOTE: You can defer this step until right before you generate your Let's Encrypt certificate, to be safer.

First, get your NAS' IP address (it looks like 192.168.x.x; you use it to access UGOS). Create a new Cloudflare DNS record pointing to the IP, preferably on a subdomain such as nas or something unique.

Example:

  • Type: A
  • Name: nas
  • Content: 192.168.x.x
  • Proxy: disabled (important!)
  • TTL: auto

UGOS Files

Enable your shared folder if you haven't already. You'll be prompted if you haven't when you open the Files app for the first time.

Create ACME Container

Locate and download this docker image: neilpang/acme.sh

Create a new container for it, with these settings:

  • Container name: example-acme
  • Memory limit: 2000-4000 MB (you don't need much)
  • Auto restart: [x]
  • Environment (variables):
    • CF_Token: <API_TOKEN>
    • CF_Zone_ID: <ZONE_ID>
    • CF_Account_ID: <ACCOUNT_ID>
  • Volumes:
    • NAS directory/file: <shared_folder>/docker/acme.sh
    • Container directory/file: /acme.sh
    • Container permissions: Read/Write
  • Network mode: bridge
  • Commands: daemon

NOTE: If you didn't use Cloudflare, make sure to use your registrar's corresponding API tokens.

Confirm and start the container.

Output Directory

Add a certs output folder within the container directory (on NAS). Both your certificate and key will end up here later for easier access.

/docker/acme.sh/
├── certs/
└── ...

Issue Certificate

Do yourself a lil favor and set up an ssh key to make it easier going forward. You can also skip this if you're fine with pasting your NAS user password every time you want to SSH.

SSH into the NAS:

$ ssh username@192.168.X.X -p PORT_HERE

Then...

$ sudo -i
$ docker exec -it example-acme sh
$ acme.sh --set-default-ca --server letsencrypt
$ acme.sh --issue --dns dns_cf -d '*.example.com' --keylength ec-256
$ acme.sh --install-cert -d '*.example.com' --key-file /acme.sh/certs/example.key --fullchain-file /acme.sh/certs/example.crt --reloadcmd "echo cert updated $(date -u)"

NOTE: If you didn't use Cloudflare, replace dns_cf with your corresponding DNS API!

The --reloadcmd flag is important here: this way your container continues to check for certificate renewals (usually daily), only updating if you're within 30 days of expiration.

Verify Certificate

Still from within your container, confirm file output:

$ ls -la /acme.sh/certs/

Confirm reload cron is running:

$ acme.sh --list | grep example

Confirm issuer:

$ openssl x509 -in /acme.sh/certs/example.crt -noout -issuer -subject -dates

Confirm TLS handshake (using HTTPS port):

$ curl -vk https://nas.example.com:9443

NOTE: 9443 should be the default. You can confirm under Control Panel (app) -> Device Connection -> Portal Settings.

Copy Certificate/Key

Feel free to leave the container environment and go back to local.

Try copying over your generated certificate/key files:

$ scp username@nas.example.com:/docker/acme.sh/certs/example.{key,crt} ~/Downloads

Your NAS' filesystem permissions may reject this command... if that happens, go back into the container and run this:

$ chmod 755 /docker/acme.sh/certs
$ chmod 644 /docker/acme.sh/certs/*.crt
$ chmod 600 /docker/acme.sh/certs/*.key

NOTE: Why these specific permission values? Keeps private key private while retaining scp readability to both the certificate and key.

Finally, moment of truth: upload the certificate and key under Control Panel -> Security -> Certificates.

  • Private key -> *.key
  • Certificate -> *.crt
  • Intermediate certificate -> leave empty

Good To Know

Verify ACME Cron

Once your ACME instance is up and running, you'll want to confirm it's operating as expected. You can do this easily by viewing the container logs at Docker -> example-acme -> Log

Within 24 hours, you should see something like this:

[Wed Dec 24 18:03:00 UTC 2025] ===Starting cron===
[Wed Dec 24 18:03:02 UTC 2025] Already up to date!
[Wed Dec 24 18:03:02 UTC 2025] Upgrade successful!
[Wed Dec 24 18:03:02 UTC 2025] Automatically upgraded to: x.x.x
[Wed Dec 24 18:03:02 UTC 2025] Renewing: '*.example.com'
[Wed Dec 24 18:03:02 UTC 2025] Renewing using Le_API=https://acme-v02.api.letsencrypt.org/directory
[Wed Dec 24 18:03:02 UTC 2025] Skipping. Next renewal time is: 2026-02-18T22:29:56Z
[Wed Dec 24 18:03:02 UTC 2025] Add '--force' to force renewal.
[Wed Dec 24 18:03:02 UTC 2025] Skipped *.example.com_ecc
[Wed Dec 24 18:03:02 UTC 2025] ===End cron===

Note that it says Skipping. after attempting to renew. This is expected until an actual renewal occurs, at which point you can safely update your key/certificate in UGOS.

Recovery / Rebuild Checklist

If:

  • Rebuilding your acme.sh docker container
  • Remounting /docker/acme.sh -> /acme.sh
  • Changing Cloudflare token

Then, in your acme.sh container...

$ acme.sh --list
$ acme.sh --renew -d '*.example.com'

Common renewal failure causes:

  • Expired / revoked Cloudflare api token
  • CF_Token missing zone DNS Edit permission
  • Docker container stopped running (is auto restart enabled?)
  • NAS clock drift (NTP disabled)

Things You Shouldn't Do

  • Don't forward any default ports (80 / 443)
  • Don't enable UGOS remote access
  • Don't proxy nas.* records through Cloudflare

SSH

This process assumes you've enabled a personal folder in UGOS.

$ ssh-keygen -t ed25519

Create a config or add to an existing one (~/.ssh/config):

Host nas.example.com
    HostName nas.example.com
    User username
    IdentityFile ~/.ssh/id_ed25519

Output and copy your public key:

$ cat ~/.ssh/id_ed25519.pub

SSH into the NAS, then...

$ mkdir ~/.ssh
$ touch ~/.ssh/authorized_keys
$ echo "PUBLIC_KEY" > ~/.ssh/authorized_keys

Then try an ssh into the NAS again. If it fails or you get a password prompt, you may need to do this from inside the NAS:

$ chmod 700 ~
$ chmod 700 ~/.ssh
$ chmod 600 ~/.ssh/authorized_keys

Checking Certificate Renewal

You can always set up an email/notification for this, but I keep a calendar event every 60 days or so to check & renew instead.

First, enable an SSH tunnel from UGOS.

Copy, create locally, and add your details to this script. When it's time to check, run it for quick confirmation. It assumes you've set up SSH keys but should work without too.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment