For the Step-by-Step Lockdown Step 5 (Mac + ugreen nas dxp4800 ) I dont have UniFi so I tried doing the AdGuard Home option but I'm not super tech savy and highkey have no clue what I am doing? I tried running through the documentation with chatgpt and they tried to gaslight me into just skipping this step but I dont want it to screw me over later on so I thought I'd ask here. Is there some specific way I need to set AdGuard up? I managed to get it working on my computer but... should I have installed it in ugreen via terminal? Also I was looking all over the website and saw this little post (https://tomsparkbox.com/guides/ugreen-nas-privacy) So we shouldve had Pi-hole installed instead? or does this mean maybe this step is already covered internally now (maybe not covered when the documentation was being made?) (hopefully lol) Sorry for being all over the place and thank you for the amazing software, seeing myself get stuck here makes me feel even more confident that the full manual set up wouldve killed me haha. Hope to hear from you guys soon!
20 replies
tomspark wrote:
You're fine on both. AdGuard and Pi-hole do the same job; pick whichever's working — for now AdGuard on your computer is doing exactly what Step 5 is asking. Installing Pi-hole on the NAS via SparkBox is an option for later, not a requirement for the lockdown step. That privacy-guide screenshot is older than the current Step 5 doc; I'll get them aligned. On the SSH 10-minute auto-shutoff: setting it to Never is fine on a trusted home network — slightly more convenient, slightly less safe. 10 minutes is defensible too. Whichever you pick, you didn't break anything. I'll add a note to that step so the next reader knows it's a real choice and not a wrong-vs-right thing.
tomspark wrote:
Yes — systemctl is Linux/systemd only. macOS uses launchd. That stop-dnsmasq step is a Linux-specific prerequisite that doesn't apply to Mac at all (macOS doesn't run dnsmasq by default, so there's nothing to stop). For AdGuard Home on Mac, the Homebrew path is the cleanest: brew install adguard-home sudo adguardhome -s install That registers it as a launchd service — same effect as the systemctl steps in the Linux guide. And since you said earlier you already got it working, you're past that hurdle already; you can skip the dnsmasq step entirely.
tomspark wrote:
Nice catch — the UGREEN SSH auto-disable is sneaky; if the session drops mid-curl you get a half-baked install. install.sh is idempotent though, so re-running was exactly the right move. I'll add a "set SSH to 30m or Never before starting the curl" line to the lockdown step so the next person doesn't get bit. Glad you're in.
tomspark wrote:
Both have answers. 1. File's on the NAS at /opt/sparkbox/state/initial-credentials.txt. SSH in and: sudo cat /opt/sparkbox/state/initial-credentials.txt Save the values to your password manager, then sudo rm /opt/sparkbox/state/initial-credentials.txt. 2. Edit VPN button is broken on a chunk of installs (known P1, fix coming). Workaround: SSH in, sudo nano /opt/sparkbox/.env, set VPNPROVIDER, VPNTYPE=wireguard, WIREGUARDPRIVATEKEY, WIREGUARDADDRESSES, SERVERCOUNTRIES — whatever your provider gives you. Save, then sudo sparkbox restart media. Yell with the provider name if you want the exact field formats.
tomspark wrote:
Yep, that's another flavor of the same bug — panel renders but mispositions over the home page. Skip the UI for now and use the SSH/.env route from my last reply; once VPNPROVIDER + WIREGUARD are in /opt/sparkbox/.env and you run sudo sparkbox restart media, the dashboard doesn't matter for getting the media stack online. UI fix is on the v1.7 list.
tomspark wrote:
Ah, docs are out of date on that one. The single initial-credentials.txt got replaced by per-module files — each module writes its own admin password to /opt/sparkbox/state/<module-admin-password.txt. What you're seeing is correct. Easiest way to see them all at once: sudo cat /opt/sparkbox/state/-admin-password.txt Save each to your password manager (the file name tells you which service), then: sudo rm /opt/sparkbox/state/-admin-password.txt I'll fix the checklist.
noliver2761 wrote:
Also documentation says: 6. Enable SSH Control Panel Terminal -- Check "Enable SSH Service", leave port on 22, click Apply, then restart the NAS. i feel like the 10m default should be changed to never too? If the documentation can be clarified thatd be super helpful! https://tomsparkbox.com/docsinstall:~:text=is%20more%20reliable.-,6.%20Enable%20SSH,-Control%20Panel%20%3E%20Terminal
noliver2761 wrote:
Thank you!
tomspark wrote:
Anytime — yell back when you hit the next thing.
noliver2761 wrote:
sorry im back so soon haha, this is on my computer and not the ugreen nas terminal, correct?
tomspark wrote:
Yes — your computer, not the NAS terminal. AdGuard Home blocks whatever DNS your machine is using, so it lives on whichever device's traffic you're trying to filter. If your screenshot is showing a specific command or step you want me to walk through, just paste the text from it — saves a back-and-forth.
noliver2761 wrote:
oh im sorry, can you not see the screen shots well? ill just send the text going forward! i ran this command in my computers terminal ➜ ~ sudo systemctl stop dnsmasq [🐍 system] sudo systemctl disable dnsmasq Password: and ended up getting command not found sudo: systemctl: command not found sudo: systemctl: command not found is it because im on a mac or something?
noliver2761 wrote:
Ok cool! Thanks for the info. So sorry for all the questions (expensive hardware, really dont wanna mess this up) As per this note: Before installing SparkBox on a UGREEN NAS, complete the privacy lockdown steps in the NAS Guide. This disables telemetry, blocks phone-home connections, and secures your device. I finished the lockdown steps, SSH connection and curl command Now im here -- First-Run: Claim the Server When the installer finishes, it prints a one-time bootstrap token (16 hex characters). The dashboard at http://YOURSERVERIP:8443 shows a "Claim your SparkBox" form — paste the token and pick an admin password. The token is then burned and can't be reused. -- However I cannot access http://YOURSERVERIP:8443 I just get This site can’t be reached ----- refused to connect. Try: Checking the connection Checking the proxy and the firewall ERRCONNECTIONREFUSED
tomspark wrote:
No need to apologize — ERRCONNECTIONREFUSED at :8443 means the dashboard container didn't come up or you're hitting the wrong host. Three quick checks: 1. Is the container running? On the NAS via SSH: sudo docker ps | grep dashboard Should show sb-dashboard Up + healthy. If the line is missing, paste: sudo docker logs sb-dashboard --tail 30 That tells me what crashed. 2. URL: use your NAS's LAN IP (not localhost or 127.0.0.1 from your Mac). To find it on the NAS: ip addr show | grep 'inet ' Then browser → http://<NAS-IP:8443. 3. Confirm your Mac is on the same network as the NAS. Paste the docker ps output and we'll pin it from there.
noliver2761 wrote:
I see what happened! When i turned on ssh it only lasted 10 minutes and then shut off in the middle so installation didnt get completed properly! i rerun the curl after setting to 30m and it worked! thank you again
noliver2761 wrote:
Thank you!! Ok I think these are my last two questions: Im running through the Post-Install Checklist. And for Save your auto-generated credentials, then delete initial-credentials.txt ↑ Cant seem to find where this is saved If using Media: add your VPN credentials, configure Prowlarr indexers (see Prowlarr) ↑ edit vpn button doesnt seem to work? (located here: Settings Network VPN Edit VPN Settings)
noliver2761 wrote:
Ahh its probably bugging out right now, when I went to the home page the VPN settings page opened ontop of that new screen but its skewed pretty badly. heres a screen recording: https://imgur.com/a/fg2WP1C
noliver2761 wrote:
Thank you! I just checked and there doesnt seem to be a /opt/sparkbox/state/initial-credentials.txt Just the individualfiles Aptx@Luffy:/opt/sparkbox/state$ ls authelia-admin-password.txt license-skipped sessions chat-sessions linkding-admin-password.txt setup-apply.log duplicati-admin-password.txt manifest-cache.json setup-complete filebrowser-admin-password.txt modules.conf telemetry-install-id.txt gotify-admin-password.txt pihole-admin-password.txt vaultwarden-admin-password.txt install-meta.conf portainer-admin-password.txt wizard.json knowledge qbittorrent-admin-password.txt
noliver2761 wrote:
Perfect! Thank you! Also the guides info for nordLynx is out of date! you can just generate an access token https://support.nordvpn.com/hc/en-us/articles/45535038276753-How-to-generate-a-NordVPN-login-token-to-connect-to-a-VPN-server-on-a-router and then run curl -s -u token:YOURTOKENHERE https://api.nordvpn.com/v1/users/services/credentials and itll spit out the necessary info!
tomspark wrote:
Appreciate the heads-up — token-flow is way nicer than the old NordVPN manual-config dance. I'll test the flow and refresh the NordLynx section of the guide. Heads up: Surfshark's the default recommendation now (swapped a couple days ago) but Nord still works fine if you're already configured.