Jim had already built a 12 TB ZimaOS NAS from a Beelink Me Mini, four 4 TB NVMe drives in RAID 5, and the system's 64 GB eMMC. The remaining challenge was not one broken feature but a set of connected decisions: remote access under Starlink CGNAT, separate family permissions, download privacy, Jellyfin outside the home, and photo backup.
Zima team member Giorgio answered those areas individually and recommended keeping help in the public forum when possible. The thread also contains a clear safety boundary: do not hand administrator privileges or unsupervised remote-desktop control to an unknown helper.
The Setup and the Six Decisions Jim Needed to Make
- Connect securely from all personal devices
- Create a separate account for his wife with private and shared folders
- Decide how to route download traffic through a VPN
- Choose among Zima Client, Tailscale, or another overlay network
- Reach Jellyfin from outside the local network
- Choose a backup path for the family photo library
The network constraint was Starlink CGNAT, which normally prevents a household from relying on a directly reachable public IPv4 address. Jim also had a UniFi Dream Machine SE, so the access plan had to distinguish local routing from the remote connection layer.
The Official Reply Started with Zima Client
Giorgio recommended installing Zima Client on the user's devices and linked the Android Zima Client and iOS Zima Client. The reply described the client as the team's preferred connection method while acknowledging that Tailscale could also be used.
This recommendation is tied to the product state in September 2025. The reply also pointed to the ZimaOS 1.4.4 release for multi-user support and said that DuckDNS or the client could help with remote Jellyfin access.
Remote Access and Download Privacy Are Different Jobs
Jim asked whether Tailscale or NetBird should handle both remote access and a VPN that masks downloads from the ISP. The official response said multiple VPN choices were available and referenced a ZeroTier exit-node discussion, but it did not prescribe one combined configuration.
The distinction matters in this community case. An overlay connection can give a user a private path back to the NAS through CGNAT, while routing a downloader's outbound traffic through a commercial or self-managed exit is a separate policy decision. The thread does not confirm that Jim completed either configuration.
Multi-User Permissions Were Available in ZimaOS 1.4.4
For the request to give Jim's wife private folders plus shared folders and apps, Giorgio pointed to multi-user support added in ZimaOS 1.4.4. The reply does not document the exact permission matrix or show the completed family setup, so this remains a capability pointer rather than a step-by-step permissions tutorial.
The practical order implied by the questions is to create distinct identities first, decide which data is private or shared, and only then expose remote access. Sharing one administrator account would work against the separation Jim wanted.
Jellyfin Access Under CGNAT Needs a Chosen Path
The official answer suggested Zima Client and mentioned DuckDNS. Because the original connection used Starlink CGNAT, the thread does not establish that ordinary public port forwarding and dynamic DNS alone would be available to Jim. Tailscale was acknowledged as another option.
A much later subthread involved a different user, ISP, router, and Jellyfin installation. That user worked through DuckDNS, Nginx Proxy Manager, Docker networking, certificates, internal versus host ports, and a router conflict on port 443. It should not be presented as Jim's solution or as a CGNAT recipe.
Immich Was Suggested for Photo Backup
Giorgio described Immich as a good photo-backup option and also said Zima Client could back up photos. The thread does not compare retention, replication, restore testing, or whether the NAS itself had a second backup destination.
That leaves an important limit on the original answer: storing the photo library on the RAID array addresses availability inside the server, while the post's phrase “best way to back up” would still require a separate recovery plan. No such plan was completed in the replies.
Use Public Help Without Giving Away the Server
After a community member offered private one-to-one help by email, Giorgio encouraged continuing in the open forum so the guidance could be reviewed and benefit other readers. He also warned users to treat conversations with strangers as public and to protect personal information.
The strongest warning was not to grant administrator privileges or remote-desktop permissions to default users. If elevated access were genuinely necessary, the reply said it should happen under the supervision of a highly skilled and trusted technical person.
FAQ
Did the thread choose Tailscale, NetBird, or Zima Client for Jim?
The official reply preferred Zima Client and said Tailscale was also usable. It did not evaluate NetBird or record Jim's final choice.
Did DuckDNS alone solve remote access through Starlink CGNAT?
No such result was reported. DuckDNS was mentioned, but the original user's CGNAT condition and final Jellyfin configuration were not resolved in the thread.
Should a remote helper receive administrator access?
The team explicitly warned against giving unknown helpers administrator or unsupervised remote-desktop privileges. Public troubleshooting and tightly supervised access were the safer boundaries stated in the discussion.
