> /home/jd
ES / EN

Installing Memos on Proxmox with Synology Backups

A step-by-step guide to running Memos in a Proxmox LXC with Synology NAS backups and secure remote access through Tailscale.

Memos lab architecture: Proxmox, SMB storage on Synology, and remote access through Tailscale

Objective: This guide documents the installation of Memos on a Proxmox server. In this lab, the LXC can be rebuilt because its data is stored on a Synology NAS over SMB. Actual protection depends on an active Hyper Backup job and periodically tested restores. Tailscale provides remote access without exposing the service directly to the internet.

Lab-specific decision: Memos uses SQLite by default. SQLite warns that network-filesystem synchronization and locking vary by implementation and may cause performance problems or corruption. The nobrl option disables byte-range locking; it avoids certain CIFS locking errors, but does not make SMB universally safe for a live SQLite database. For a more robust deployment, keep the database on local storage and create consistent backups on the NAS, or use a supported client-server database. This guide documents the topology tested in this lab; it is not a general production recommendation.

Phase 1: Prepare the Environment (Synology and Proxmox)

The first step is to prepare both the NAS that will hold the data and the Proxmox LXC that will run the application.

1.1 Prepare the Synology NAS (SMB Share)

Create a dedicated Synology shared folder for the Memos container data.

Shared-folder permissions in Synology DSM

Steps:

  1. Sign in to the Synology DSM web interface.
  2. Go to Control Panel > Shared Folder.
  3. Create a shared folder—for example, memos-data.
  4. Optional but recommended: go to Control Panel > User & Group and create a dedicated user such as memos_user with a strong, unique password.
  5. Return to the permissions for memos-data and grant Read/Write access to memos_user, or to the account selected for this deployment.

1.2 Create the Proxmox LXC

An LXC shares the Proxmox host kernel, so it generally uses fewer resources than a full virtual machine.

Proxmox container summary Proxmox container options

Steps:

  1. Sign in to the Proxmox web interface.
  2. Select Create CT in the upper-right corner.
  3. General tab:
    • Set a hostname, such as memos-server.
    • Choose a password for the root account.
    • Important: Clear Unprivileged container. This lab uses a privileged container to simplify SMB mounting and nested Docker.
  4. Template tab: Select an available base template such as ubuntu-24.04-standard or debian-12-standard.
  5. Disks tab: Allocate 8 GB. Docker and the operating system use the local disk; the application data is stored on Synology in this topology.
  6. CPU tab: Assign one or two cores.
  7. Memory tab: Allocate 1024 MB (1 GB).
  8. Network tab:
    • Bridge: vmbr0.
    • IPv4: Select Static and set 192.168.8.99/24.
    • Gateway (IPv4): 192.168.8.1.
  9. Enable SMB and Docker support: Before starting the container, open Options > Features and enable:
    • SMB/CIFS, for the Synology share.
    • nesting, which Docker requires inside this LXC.
  10. Finish creating the container and start it.

No internet connection in an Ubuntu 24.04 container? If startup fails with Temporary failure resolving, bring up the interface manually from the container console:

Bash
ip link set eth0 up
ip addr add 192.168.8.99/24 dev eth0
ip route add default via 192.168.8.1
echo "nameserver 1.1.1.1" > /etc/resolv.conf

Replace the example addresses with the values used by your network.

Progress log: Phase 1 completed. The static IP 192.168.8.99 was configured in Proxmox and the LXC was created.

Phase 2: Configure Storage in the Container (SMB Mount)

The LXC is now available at 192.168.8.99. Next, mount the Synology shared folder so Memos can access it.

Steps:

  1. In Proxmox, select the container and open Console.

  2. Sign in as root with the password chosen during setup.

    Receiving Temporary failure resolving? The container may not have a DNS server configured. Edit /etc/resolv.conf, add nameserver 1.1.1.1, then save and exit. Alternatively, set 1.1.1.1 under Proxmox > Container > DNS > DNS servers and restart the container.

  3. Update the packages and install cifs-utils:

    Bash
    apt update && apt upgrade -y
apt install cifs-utils -y

  4. Create the local mount point:

    Bash
    mkdir -p /mnt/synology/memos

  5. Store the Synology credentials in a separate file instead of placing them directly in /etc/fstab:

    Bash
    nano /root/.smbcredentials

    Add the following placeholders and replace them with the dedicated Synology credentials:

    Text
    username=your_memos_user
password=your_strong_password

    Save with Ctrl+O, press Enter, and exit with Ctrl+X.

  6. Restrict the file so that only root can read it:

    Bash
    chmod 600 /root/.smbcredentials

  7. Configure the share to mount when the container starts:

    Bash
    nano /etc/fstab

    Add the following line, replacing the NAS address and share name when necessary:

    Text
    //YOUR_SYNOLOGY_IP/memos-data /mnt/synology/memos cifs credentials=/root/.smbcredentials,iocharset=utf8,file_mode=0777,dir_mode=0777,vers=3.0,nobrl 0 0

    Important (nobrl): In this lab, nobrl (No Byte Range Lock) prevented database is locked errors over SMB. It disables that locking mechanism and carries the risk described at the beginning of this guide; do not copy it into a production deployment without evaluating data integrity and recovery.

  8. Mount the configured filesystems:

    Bash
    mount -a

    No output generally indicates that the mount succeeded.

  9. Confirm the mount and available space:

    Bash
    df -h

    The output should include the Synology volume mounted at /mnt/synology/memos.

Progress log: Phase 2 completed. The Synology folder was mounted inside the container at /mnt/synology/memos.

Phase 3: Install Docker and Deploy Memos

This phase installs Docker and runs Memos with its database and media files on the Synology path, following the lab-specific decision documented above.

Steps:

  1. Install Docker for this lab: The following convenience script downloads and configures Docker in the LXC. Docker positions it for testing and development; for a stable environment, use Docker’s official apt repository and manage versions explicitly.

    Bash
    curl -fsSL https://get.docker.com -o get-docker.sh && sh get-docker.sh

    Receiving sysctl net... permission denied when Docker starts in Proxmox? Before downgrading or pinning containerd.io, inspect the container logs and verify compatibility between the installed Proxmox version, the LXC template, and Docker. A pinned version can become obsolete and miss security updates. Any downgrade should be temporary, documented, and checked against current documentation.

  2. Create a directory for the Memos Compose configuration:

    Bash
    mkdir -p /opt/memos-docker
cd /opt/memos-docker

  3. Create the Docker Compose file:

    Bash
    nano docker-compose.yml

    Add the following configuration:

    Yaml
    services:
  memos:
    image: neosmemo/memos:stable
    container_name: memos
    restart: unless-stopped
    security_opt:
      - apparmor:unconfined
    ports:
      - "5230:5230"
    volumes:
      - /mnt/synology/memos:/var/opt/memos

    The volume maps Memos’ internal data directory to the mounted Synology share.

  4. Start Memos in the background:

    Bash
    docker compose up -d

  5. Check the container status:

    Bash
    docker ps

After a successful start, open http://192.168.8.99:5230 in a browser to reach the Memos welcome screen.

Progress log: Phase 3 completed. Memos is running on port 5230.

Phase 4: Configure Secure Remote Access with Tailscale

To access Memos from a phone outside the local network, install Tailscale in the container. The connection travels over the private Tailnet and does not require publishing port 5230 on the router.

Steps:

  1. Install Tailscale: Run the official installer from the container console:

    Bash
    curl -fsSL https://tailscale.com/install.sh | sh

    Receiving Failed to start tailscaled.service because /dev/net/tun is missing? Proxmox may block virtual devices even in a privileged LXC. Apply the configuration from the Proxmox host:

    1. In the main Proxmox interface, select the node—usually proxmox or pve—and open Shell.

    2. Run the following command once, replacing 103 with the actual container ID:

      Bash
      echo -e "lxc.cgroup2.devices.allow: c 10:200 rwm\nlxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file" >> /etc/pve/lxc/103.conf

    3. Restart the container from the host:

      Bash
      pct stop 103 && pct start 103

    Return to the Memos container console after the restart.

  2. Connect the node to your account:

    Bash
    tailscale up

    Open the authentication URL shown in the terminal and authorize the machine with the account used by your Tailnet.

  3. Get the Tailscale IP:

    Bash
    tailscale ip -4

    The address beginning with 100.x.x.x identifies the container within the Tailnet.

  4. Connect from a mobile device:

    • Install the Tailscale app and sign in.
    • Disable Wi-Fi to test the mobile-data path.
    • Open the Tailscale address in this format: http://100.x.x.x:5230.

    Common connection error (ERR_CONNECTION_REFUSED) Include port :5230 at the end of the address. Without it, the browser attempts to use port 80. This topology uses explicit http:// because Memos has no local TLS certificate; traffic between Tailnet nodes remains protected by Tailscale.

Memos is now available from the authorized devices in the Tailnet.

Final Demonstration

The following video shows Memos running through the private tunnel:

Progress log: Phase 4 completed. Remote access was enabled through the Tailnet without router port forwarding.

Enlarged view