RSS Amplifier

Terraform Pilot · May 5, 2026

Terraform for Synology DSM NAS

0
Sign in to vote or save

Luca Berton · Terraform Pilot

  1. Home
  2. Articles
  3. Terraform for Synology DSM NAS: What Actually Works

DevOps

No official Terraform provider exists for Synology DSM. Here's the realistic pattern: configure S3/B2 backups, Hyper Backup, DNS, VPN, and the DSM API from Terraform — homelab best practices.

LLuca Berton1 min read

On this page

Synology DSM has no official Terraform provider in 2026. The realistic pattern: Terraform manages the cloud and network around the Synology — DNS, S3 / B2 backup buckets, ACME certificates, VPN — and Synology's own UI / DSM API handles share-level config. For full lifecycle, wrap the DSM API with null_resource calls or restapi provider.

Cloud Backup Bucket (S3)

#

resource "aws_s3_bucket" "syno_backup" {
  bucket = "syno-${var.hostname}-backup"
}
 
resource "aws_s3_bucket_versioning" "syno_backup" {
  bucket = aws_s3_bucket.syno_backup.id
  versioning_configuration { status = "Enabled" }
}
 
resource "aws_s3_bucket_lifecycle_configuration" "syno_backup" {
  bucket = aws_s3_bucket.syno_backup.id
  rule {
    id     = "tier-cold"
    status = "Enabled"
    transition {
      days          = 30
      storage_class = "GLACIER_IR"
    }
  }
}
 
resource "aws_iam_user" "syno_backup" {
  name = "syno-backup"
}
 
resource "aws_iam_access_key" "syno_backup" {
  user = aws_iam_user.syno_backup.name
}

Configure Synology Hyper Backup → S3 with the access key.

DSM API via restapi Provider

#

terraform {
  required_providers {
    restapi = { source = "Mastercard/restapi", version = "~> 1.19" }
  }
}
 
provider "restapi" {
  alias                = "dsm"
  uri                  = "https://${var.dsm_host}:5001"
  insecure             = false
  write_returns_object = true
  username             = var.dsm_user
  password             = var.dsm_password
}

DSM uses a session-token auth flow — wrap login in a Lambda or a null_resource helper if going deep.

Best Practices

#

  • Don't fight DSM — manage shares in DSM, manage cloud around it in Terraform.
  • Hyper Backup → S3 with versioning + Object Lock for ransomware resistance.
  • DSM 7.x admin behind 2FA — Terraform should never store the admin password.
  • DDNS via Terraform (Cloudflare / Route 53) — DSM's built-in DDNS is fine but not auditable.

#

#Terraform#Synology#DSM#NAS#Hyper Backup

Read the original on terraformpilot.com

Comments

Nothing yet. Say the first thing.

    Sign in to join the conversation.