DB-유

Hosting a Static Website on Synology

· synology, web station, nginx, https

I was paying for a tiny hosting plan just to serve a Hugo-built project page, while a Synology sat on 24/7 a metre away. Silly. Web Station on DSM 6 serves static files from a shared folder through nginx, does name-based virtual hosts, and Control Panel's Let's Encrypt integration gives you HTTPS.

What you need: DSM 6.1 or 6.2 with Web Station (no PHP package for static content), a domain or subdomain pointing at your public IP (a DDNS name like site.example.synology.me, or a CNAME to it), and ports 80 and 443 forwarded to the NAS. Port 80 is needed for Let's Encrypt validation and the redirect to HTTPS.

Web Station and the back end

Package Center → Web Station → Install. Installation creates the web shared folder at /volume1/web. Open Web Station → General Settings:

  • HTTP back-end server: Nginx. Apache is only there for .htaccess compatibility with PHP applications.
  • PHP: leave unset.

Web Station's default site serves /volume1/web on ports 80 and 443 of the NAS. I do not use the default site for anything public; it responds to any hostname, including the bare IP, and I prefer explicit virtual hosts.

Folder and virtual host

Create a subfolder for the site and put an index file in it:

sudo mkdir -p /volume1/web/site.example.com
echo '<h1>It works</h1>' | sudo tee /volume1/web/site.example.com/index.html
sudo chown -R http:http /volume1/web/site.example.com

The http user is what nginx runs as on DSM; files owned by your admin account are still readable because of the default permissions, but keeping ownership consistent avoids surprises when a deploy script creates new files.

Web Station → Virtual Host → Create:

  • Name-based, Hostname: site.example.com.
  • Port: tick both HTTP 80 and HTTPS 443.
  • Document root: web/site.example.com.
  • HTTP back-end server: Nginx. PHP: none.
  • HSTS and HTTP/2 can be enabled here on DSM 6.2; enable HTTP/2, leave HSTS until you are sure about HTTPS.

Certificate and HTTPS redirect

Control Panel → Security → Certificate → Add → Add a new certificate → Get a certificate from Let's Encrypt. Domain name site.example.com, your email, optional additional Subject Alternative Names. With port 80 forwarded, issuance takes a few seconds.

Then Certificate → Configure: in the table of services, find the row for your virtual host site.example.com and set it to the new certificate. DSM renews Let's Encrypt certificates automatically as long as port 80 remains reachable.

To redirect HTTP to HTTPS, Control Panel → Network → DSM Settings → "Automatically redirect HTTP connections to HTTPS" affects only DSM's ports (5000/5001), not Web Station. For the virtual host, on DSM 6.2 the option is in the virtual host itself: Edit → tick "HSTS", which also causes the redirect. On DSM 6.1 place a small file in the document root's nginx include directory. Web Station creates /usr/local/etc/nginx/sites-enabled/ entries per virtual host; you can add a user.conf beside them:

# /usr/local/etc/nginx/conf.d/site.example.com.user.conf
if ($scheme = http) {
    return 301 https://$host$request_uri;
}

Reload with sudo synoservice --reload nginx. Files under /usr/local/etc/nginx/conf.d/ are preserved across DSM updates in my experience, but keep a copy in /volume1/scripts regardless.

Deploying with rsync

I build on my workstation and push; it's faster and safer than editing on the NAS. With SSH enabled and key authentication set up for your admin account:

hugo --minify
rsync -avz --delete --chown=http:http -e "ssh -p 2222" public/ admin@nas01:/volume1/web/site.example.com/

--delete removes pages you deleted locally; --chown needs rsync 3.1 on both ends, which DSM 6.2 has. Without it, run sudo chown -R http:http on the NAS afterwards, or leave the files owned by admin, which works for reading.

Checking it

curl -I http://site.example.com
curl -I https://site.example.com

The first should return 301 or 302 to the HTTPS URL, the second HTTP/2 200 (or HTTP/1.1 200 on DSM 6.1) with a server: nginx header. Open the site in a browser and check the certificate is issued by Let's Encrypt for the right name. Test from outside the LAN as well; NAT loopback on some routers makes the inside test misleading.

Gotchas

  • Browsing the hostname shows the DSM login page or the Web Station default page instead of your site: the virtual host's hostname does not match exactly, or DNS still points elsewhere. curl -H "Host: site.example.com" http://<nas-ip> isolates DNS from the virtual host configuration.
  • Let's Encrypt fails with "Failed to connect to Let's Encrypt. Please make sure the domain name is valid": port 80 is not forwarded or the DSM firewall blocks it. The validation request must reach the NAS on 80, not 5000.
  • 403 Forbidden on the site root: no index.html in the document root, or the folder lacks read permission for http. Check with sudo -u http ls /volume1/web/site.example.com.
  • The certificate renews but the site keeps serving the old one: the virtual host is still mapped to the previous certificate in Certificate → Configure. Re-assign it there.

Web Station's limits only show up when you need server-side code. For HTML, CSS and JavaScript it's plenty.