windows_hardening VS OpenMediaVault

You can try this tool, or some other similar tool. It hardens Windows 10 using the latest guidelines from several organisations. Of course you need to be careful doing this, it can very easily ruin your Windows installation.

Endpoint-based prevention: Harden endpoints, including browser settings (https://www.cisa.gov/uscert/publications/securing-your-web-browser; https://stigviewer.com/stig/google_chrome_browser/) and software firewall including ingress and egress rules (https://www.stigviewer.com/stig/microsoft_windows_firewall_with_advanced_security/2021-10-15/). If you're primarily worried about Windows endpoints, take a look at Hardening Kitty and the solid STIG-based Windows Firewall list (https://github.com/0x6d69636b/windows_hardening/blob/master/lists/finding_list_dod_windows_firewall_stig_v1r7.csv) for some relatively easy wins.

#1: "HardeningKitty was created to simplify the hardening of Windows. Now, HardeningKitty supports guidelines from Microsoft, CIS Benchmarks, DoD STIG and BSI SiSyPHuS Win10. And of course [their] own hardening list." | 20 comments #2: For those that work in IT Admin, what are the key Powershell Commands that every admin should know? #3: I wrote the mother-of-all onboarding scripts and now everyone blames me for everything...

The above documents mandate a lot of testing and analysis, together with potential design decisions you are not in a position to make; still - you should dedicate the time to do it "properly" from the beginning. Anyhow, in case you are a renegade daredevil - HardeningKitty to the rescue https://github.com/0x6d69636b/windows_hardening =]

#1: /u/betterthangoku has passed away #2: "HardeningKitty was created to simplify the hardening of Windows. Now, HardeningKitty supports guidelines from Microsoft, CIS Benchmarks, DoD STIG and BSI SiSyPHuS Win10. And of course [their] own hardening list." | 20 comments #3: For those that work in IT Admin, what are the key Powershell Commands that every admin should know?

You might want to consider the previously mentioned MergerFS and SnapRAID, or MDADM and LVM for your setup. OpenMediaVault [https://www.openmediavault.org/ is a solid choice in this regard. Additionally, if you're planning to run something like Proxmox, you could look into deploying Starwind CVM on top of it. Pretty much like in this guide: https://www.starwindsoftware.com/resource-library/starwind-virtual-san-vsan-configuration-guide-for-proxmox-vsan-deployed-as-a-controller-virtual-machine-cvm/ .

You would better to install OMV instead. It's a ready to use fileserver solution with web interface.

So I'm working on a similar setup with an ancient desktop my in-laws were getting rid of. I installed OpenMediaVault directly to the hard drive (it's so old that I assume it wouldn't work too well as a hypervisor), with a 4TB external HDD attached. OMV supports Docker by means of a plug-in and I'm running a Jellyfin container with no issues at all. I'm still manually downloading everything to the HDD but *arr containers are my next step, as well as setting up a gluetun container to route all that through a VPN.

That is possible (it's automated to a certain extent). It also depends on the NAS OS. Unraid, for example, can work with drives of different sizes while using the largest one for parity. TrueNAS uses ZFS so you won't be able to just add a drive to your RAIDZ and expand it. There's also openmediavault: https://www.openmediavault.org/ that uses Linux Software RAID and you can add a new drive there but you can't combine drives of different sizes. And there's also Starwinds NAS that supports both Linux Software RAID and ZFS: https://www.starwindsoftware.com/san-and-nas. Plus, I would avoid SMR drives in RAID: https://nascompares.com/answer/list-of-wd-cmr-and-smr-hard-drives-hdd/

I'd put it like that: if you have a spare PC, then it's definitely worth trying. I would also look into openmediavault (minimal RAM needs): https://www.openmediavault.org/ and Starwinds NAS (supports both ZFS and Linux software RAID): https://www.starwindsoftware.com/san-and-nas