nas-provision

nas-provision — set up a Synology NAS end to end

Takes a Synology NAS from unconfigured to a working DSM with a first administrator whose username the operator chooses and whose password dsmctl generates and owns. Verified live on a DS918+ running DSM 7.3.1.

Security model — READ FIRST (non-negotiable)

1. Username is operator-decided. --admin-user <name> is required; never invent it.
2. Password is dsmctl-generated, never seen by the model. dsmctl provision generates a strong password with crypto/rand, uses it in-process to create the admin, and stores it in the OS credential store. It is never printed, logged, returned, or placed in a plan.
3. Retrieval is human-only. The password comes back only through dsmctl auth reveal-password, which is gated by isatty AND a typed NAS-name confirmation read from stdin. A pipe fails the terminal check; a non-interactive caller (CI, an agent, the Claude Code Bash tool's pty) reads end-of-input at the prompt and is refused. The model cannot retrieve the password — do not try, and do not read the keyring directly. No MCP tool ever returns a password (deferred by design).
4. When you (the assistant) reach a point that needs the plaintext, tell the human to run dsmctl auth reveal-password --nas <name> in their own terminal.

Preconditions

• The NAS must be reachable over https on the DSM port (5001). Provision refuses a cleartext http target so the password is never sent in the clear.
• The NAS must be in its DSM first-run setup window (freshly installed / reset DSM, no administrator yet). If DSM is not installed, install it first (see "Installing DSM" below).
• A fresh NAS presents a self-signed certificate. For an explicitly isolated lab NAS, pass --insecure-skip-tls-verify; otherwise pin the certificate the way dsmctl auth login does.

The one command (happy path)

dsmctl provision <profile-name> \
    --admin-user <username> \
    --url https://<nas-ip>:5001 \
    --insecure-skip-tls-verify \
    --device-name <hostname> \
    --auto-update security