NASty

A NAS appliance built on bcachefs.

Turn commodity hardware into a storage appliance serving NFS, SMB, iSCSI and NVMe-oF, managed from one web UI, updated atomically, and rolled back in one click when things go sideways.

Download the ISO View on GitHub
NASty dashboard showing services, containers, CPU, memory and storage

Storage

Everything bcachefs can do, one click away

Compression, checksumming, erasure coding, tiering, encryption and O(1) snapshots. Create filesystem or block subvolumes with their own quotas, compression and tiering, and see at a glance which shares, apps and backups use each one.

  • Instant snapshots, writable clones and whole-subvolume rollback
  • Lock and unlock encrypted filesystems, with optional TPM2 auto-unlock
  • Scrubs, device evacuation and reconcile with live progress
Subvolumes page listing media, photos, documents and block volumes

Sharing

Four protocols, one place

NFS and SMB for files, iSCSI and NVMe-oF for blocks, each with per-share access control. SMB shares can be discoverable macOS Time Machine destinations, and block targets can run over RDMA on RoCE and InfiniBand NICs.

  • Per-user and per-group SMB access
  • Dedicated iSCSI and NVMe-oF targets per volume
  • Password-, expiry- and download-limited guest links
Sharing page with SMB shares for media, documents, Time Machine and photos

Apps & VMs

Run your services next to your data

Deploy single Docker containers or whole Compose stacks, with private registries, HTTPS ingress, managed networks, startup order and live resource usage. QEMU/KVM virtual machines come with a browser console, disk snapshots and hardware passthrough.

  • Jellyfin, Immich, Home Assistant, or anything with an image
  • App data that moves with your storage
  • IOMMU, USB and SR-IOV passthrough for VMs
Apps page with Jellyfin, Uptime Kuma, IT-Tools and a Compose stack running

Backups

Encrypted, deduplicated, scheduled

Incremental backups to local disks, S3, SFTP, REST or Backblaze B2, each with its own schedule and retention. Restore a single file, a whole snapshot, or rebuild a fresh box from an existing repository.

  • Secrets encrypted at rest
  • One-click system recovery backups
  • Snapshot before every run
Backups page with nightly, hourly and system recovery profiles

Updates

Atomic updates, instant rollback

NASty is NixOS underneath. An update either applies completely or not at all, and every update is a new generation you can roll back to. Pick your flavor: Mild for tagged releases, Spicy for pre-releases, or Nasty for the latest commit.

  • Pre-built binaries for x86_64 and aarch64
  • Optional Secure Boot with guided enrollment
  • Your own NixOS settings in custom.nix, kept across upgrades
Update page with version, build steps and release switch

And a lot more

Monitoring & alerts

Custom dashboards with 30-day history, alert rules, and delivery by email, Telegram, ntfy, Signal or webhook. Optional Prometheus endpoint.

Disk health

ATA, NVMe and SAS/SCSI monitoring with per-disk details and topology.

Access control

Roles, scoped API tokens, OIDC single sign-on, passkeys, and an append-only audit log.

Safe networking

Network changes apply, then revert automatically unless you confirm, so a typo can't lock you out.

TLS & VPN

Let's Encrypt certificates and built-in Tailscale with one-click setup.

Firewall

Deny-by-default nftables with per-service source and interface rules.

File browser & terminal

Browse, upload and edit files, or open a shell with cheatsheets, right in the browser.

Open APIs

JSON-RPC over WebSocket and a documented REST API. Browse the API.

Kubernetes

Storage for your cluster

NASty provisions persistent volumes, snapshots and clones on demand over all four protocols.

nasty-csiCSI driver: provisioning, snapshots, clones, online expansion nasty-chartHelm chart for a one-command install kubectl-nastyInspect volumes, snapshots and health from the CLI nasty-haHome Assistant integration nasty-topLive per-device IO, latency and tuning in the terminal

Why bcachefs?

It's GPL and fits Linux natively, with no DKMS. A filesystem is just a filesystem, subvolumes are just directories, and a snapshot is a first-class subvolume with no dependency chains. Tiering, erasure coding and online repair come built in.

Why NixOS?

A storage appliance should be one atomic unit you can update, roll back and reproduce. No half-upgraded states, no package conflicts at 2am, and the whole system defined in code.

Get started in minutes

  1. Download the latest ISO from Releases.
  2. Boot it on your hardware, pick a disk and press Enter.
  3. Open https://<nasty-ip> in your browser.
  4. Sign in as admin / admin and set a new password.

NASty is young and moves fast, and so does bcachefs. It's tested hard: 170 Kubernetes end-to-end tests, hundreds of CSI unit and sanity tests, and VM tests on every change. It's a great fit for homelabs, development and learning. Keep a backup of anything irreplaceable.

FAQ

What hardware does it run on?

Any x86_64 or aarch64 machine that boots a UEFI ISO, from mini PCs to rack servers and ARM boards. Legacy BIOS works experimentally on x86_64. Pre-built binaries mean no compiling on small boxes.

How are snapshots different from ZFS?

In bcachefs a snapshot is a subvolume in its own right. Delete the parent and the snapshot survives: no promote, no detach, no dependency chains. A clone is just a writable snapshot.

Can I add my own NixOS configuration?

Yes. Put anything the web UI doesn't expose in /etc/nixos/custom.nix. NASty imports it and never overwrites it.

Can I run Jellyfin?

Yes, as an app, with no NixOS knowledge needed. See Jellyfin on NASty.

Does it send telemetry?

A random installation ID and daily aggregate counts, with no names, paths, hostnames or hardware IDs. Turn it off in Settings → Telemetry. Details.

Where does the name come from?

NAS + ty. A NAS that's a bit nasty.