ZZettarack
ZXPStorage server · in testing

Every pool on one screen.

One safe place for your files and backups: many drives working as one, snapshots that undo mistakes, copies to a second box, and a regular test that proves you can get your data back.

A lightning fast TUI, with an enhanced window manager. Every pool, drive, dataset and snapshot is a card you fly through, with a key for every verb, and the pool itself keeps every setting.

And storage only. No apps, containers or VMs run beside your data, and nothing is between you and the pool: the console is the box's own screen, the text console, and the zxp command.

Get zxp
The pools wall on a zxp: four pools as cards, the largest a raidz2 of eight with a log and a cache at 30% of 116 TiB and writing 986 MiB/s, another two mirrors, ghost one drive, rpool the system, and a card for a new pool
capture · the pools wall, four pools, one zxp
01 · the poolThe pool is the configuration

Snapshot policies, shares and replication rules are properties on the datasets they govern. Import the pool on another box and they come with it; zfs get shows every one.

02 · proofRestores proven, not assumed

A drill writes a canary, carries it to the archive, and reads it back from a read-only clone there. A health check that cannot run counts as failed, never as passed.

03 · upgradesYou can't brick it with an upgrade

Each release is a signed image, booted as a new environment beside the old one. If it doesn't come up healthy, the machine goes back by itself, and your pools never move.

Ridgeline, zxp's lock scene: ridges and still water under a red dusk, a low sun and stars
the lock, Ridgeline
stop 1 · flythe pools

Fly through your pools

Tap Super and every pool is a card: its layout, a light for each drive, how full it is and what it is doing. Super+Tab lays them out as a wall, imported pools lit and the ones it could import dim, the system's own among them. Enter goes into a pool, Space opens its menu: scrub, trim, clear, export, or import.

Superfly-throughTabthe wallEntergo inSpaceits menuCtrl+Spacetag severalEscback
The largest pool in front in the fly-through, writing: its last second, 3699 writes and 1.7 GiB a second, a write's wait, the ARC's hits, the log device, the writes the throttle paced, transaction groups taking 4.6 seconds on average to sync, and 30% of 116 TiB used
capture · the largest pool in front, its last second

In front, a pool is its last second: reads and writes, the waits, the ARC's hits, what reached the log device, whether writes were held back, how long transaction groups took to sync, and verdicts, the worst first.

Inside a pool in the fly-through: its datasets as cards, each with what it uses and what is free, three holding folders of their own, and a card for its ten drives writing 1.5 GiB/s
inside the big pool: its datasets and its drives
stop 2 · the metaldrives

Every drive, by its serial

Each drive is named by its serial, with its model, size and place in the pool, its temperature and its hours, lit by its state and its SMART verdict. Its menu takes it offline, brings it back, or detaches it from a mirror. Long SMART tests run on a schedule per pool, a drive's test age read from its own power-on hours, and a sleeping drive is not woken to be read.

One drive in front, 2PH9A6AT: a WD 14.6 TiB in raidz2-0 at 44 degrees and 26820 hours, writing 177 MiB/s at 232 IOPS, and the next drive beside it
capture · one drive in front, writing

A disk that holds any part of a pool is never offered to a new one, imported or not. A new pool is made from a design in zpool's own words, and its verdict comes first: what it yields, how many disks it survives, and the warnings an experienced operator would give.

Every disk in the box as a card: sixteen disks, each with its model, size, kind, device and which pool uses it
sixteen disks, and the pool each one is in
stop 3 · keepdatasets and snapshots

Snapshots that keep themselves

Every dataset is a card, and in front it shows every setting and where each one came from. A snapshot policy is one property, hourly=24,daily=7 say, kept by everything under it; pruning touches only the snapshots the policy made, never a held or a cloned one, and rollback is refused while newer snapshots stand.

A dataset in front: its space, used, available and referenced; its compression, record size, sync, checksum and the rest with where each is set; its snapshots, replication and encryption; its mount
capture · a dataset in front, every setting and where it is set
The text console's snapshots of a pool: sixteen, with their dataset, when each was made, what it uses and what it refers to
snapshots
stop 4 · proofreplication and the drill

A backup is a restore you tested

Replication sends what changed since the newest snapshot both sides hold, matched by its GUID, not its name, and a bookmark keeps the chain alive after the snapshot is pruned. A cut transfer resumes. An encrypted dataset goes raw, its key staying home, and the plan says so before a byte moves. Copies land read-only, unmounted, and marked as replicas.

Then the drill proves it: a canary is written at the source, snapshotted, carried to the archive, and read back from a read-only clone of the archive's copy. The clone goes, the result is an event, and either the chain works today or you know the step where it does not.

Another boxzxp peer-add vault 10.0.0.20Its host key is read, pinned and shown for you to compare; a changed key is refused from then on.
A copy therezxp replicate tank/data \ backup/data --to vaultThe whole dataset the first time, what changed every time after.
Proof it comes backzxp drill tank/data \ backup/data --to vaultThe canary read back from the archive, not a transfer's status.
stop 5 · trusthealth

Nothing passes by not running

Every check has three outcomes: ok, failed, or did not run, and did not run counts as failed. The pools, the keys, the scrub and trim schedules, SMART, the share daemons, the replication rules and the UPS each say what they found, what they expected, and the command that puts it right.

The Health window on a zxp: each check with ok, warn or skip and what it found, a key not loaded and a pool with no scrub schedule among them
capture · the health check, two warnings and why

What went wrong while nobody was looking is an event: a scrub that finished, a pool that degraded, a spare that stood in. Events are counted on the bar, listed in the Events window, and pushed to ntfy, Gotify, Discord or any JSON hook if you like.

The Events window: scrubs finished with no errors, a pool with no scrub schedule, a degraded test pool and its resilver, a spare that stood in, and where events are pushed
events
stop 6 · watchhistory

Every second the pools were busy

Every ten seconds zxpd keeps one second of each pool: latency histograms whole, ZFS's own latency per dataset, the I/O each process made, the calls that were slow, and the kernel's log. SMART numbers, disk errors, scans and space are kept beside them. Two days in full, six weeks in five-minute steps.

The Machine board: CPU, load, CPU temperature, memory, ARC hits, network and UPS as rings; every drive's temperature as bars; the big pool's disks' reads by latency; its disks' busy share and queue; the slowest disks against operations
capture · the machine at a glance, every drive's temperature
The History window, an hour: the ARC, the write throttle and the kernel, then the pool's throughput, operations, waits, transaction groups, space, datasets' and snapshots' space, latencies, disks' temperatures, bad sectors and errors
an hour of every pool
stop 7 · the keyboardzxp tui

Lightning fast, keyboard driven

The same storage in a terminal: pools, datasets, snapshots, disks, the overview, jobs and health, a tab each and a key for every verb, named in the line under them. On the box or over ssh.

The text console's pools: four pools with state, size, use, fragmentation, devices and their last scrub; the largest pool's layout, its log and cache, what is set on it and its last second beside them
capture · the text console's pools
The text console's disks: sixteen, three with something to say, CRC errors named as a cable or a port; the chosen one's SMART attributes beside them
disks, three with something to say
The text console's health: each check with its status, severity, what it found, what it expected and the remedy
health
stop 8 · undoexploded view

An upgrade you can undo

The system is three ZFS layers. An upgrade boots a new middle one; if it doesn't come up healthy, the machine goes back by itself, and going back by hand is one reboot. Your pools, your settings and your users never move, and nothing ever upgrades a pool's features. No package manager runs on the appliance: the whole system is swapped for a new one, and the old ones stay.

Signed image
read-only
Boot environment
new for each release
Your state
kept across them
zfs list on a zxp, 2026-10-21, shortened
# zfs list -o name,mountpoint -d 1 rpool rpool/IMAGES rpool/ROOT NAME MOUNTPOINT rpool/IMAGES/zxp-0.4.31 / # signed, read-only rpool/IMAGES/zxp-0.4.32 / rpool/ROOT/zxp-0.4.28 / # the ones before: a reboot back rpool/ROOT/zxp-0.4.30 / # running rpool/ROOT/zxp-0.4.31 / rpool/ROOT/zxp-0.4.32 / rpool/state /var/lib/zettarack # records, keys, settings rpool/home /home
stop 9 · comparedgame on

What a NAS does instead

Most storage appliances keep your settings in a database of their own, and have moved apps and VMs onto the box beside your data. zxp keeps the settings in the pool and keeps the box for storage. How that compares:

Zettarack zxpTrueNAS Community Edition 25.10
Where the settings liveOn the datasets, as ZFS properties: an imported pool brings its snapshot policies, shares and replication rules with it.In its own configuration database, carried across boot environments; changed through its web UI and API.
An upgrade that goes wrongA new boot environment from a signed, read-only image; an unhealthy one is left by itself.An image and a boot environment; going back is by hand.
Proving a restorezxp drill: a canary read back from a read-only clone of the archive.Not built in.
SMART long testsOn a schedule per pool, the test age read from each drive's own hours.The SMART test scheduler was removed in 25.10.
Who is driving a poolI/O by process, ZFS latency per dataset, slow calls named, six weeks kept.Per-disk I/O, latency and temperature.
Beside your dataNothing: storage only.Docker apps and VMs.
Where you workThe box's own screen, the text console and the zxp command, over RDP or at the box; no web UI, on purpose.Its web UI and its API.
Not yet in zxpDirectory services (local users only), iSCSI, NVMe over Fabrics, S3, high availability.AD and LDAP, iSCSI and NVMe-oF; HA on its Enterprise hardware.

TrueNAS is iXsystems' mark. What is said of it is from its own documentation and release notes, as of October 2026.

stop 10 · featuresmodules

Everything a pool needs

M-01Pools from a design: mirrors, raidz1 to 3, special, log, cache and spares, the verdict first
M-02Import and export, never forced; nothing ever upgrades a pool's features
M-03Snapshot policies inherited down the tree; pruning only what the policy made
M-04Rollback, clones and holds; rollback refused while newer snapshots stand
M-05Scrub, trim and SMART long tests on a schedule per pool
M-06NFS and SMB from one property: root squashed, no guests, your own subnets only
M-07Previous versions in Windows, from the policy's snapshots
M-08Replication by snapshot GUID, kept alive by bookmarks, resumed when cut
M-09Encrypted datasets sent raw, their keys staying home
M-10Peers over ssh, each host key pinned at enrolment; replicas land read-only
M-11The drill: a restore tested, its result an event
M-12Files: browse live and in snapshots, a file's versions, what changed between two points
M-13Restore a file beside the live one or in its place; a trash with undo; permissions and ACLs
M-14Keys loaded and unloaded, passphrases on stdin, never on a command line
M-15Every second the pools were busy: latency, I/O by process, slow calls, six weeks kept
M-16A health check where a check that did not run counts as failed
M-17Events on the bar, pushed to ntfy, Gotify, Discord or any JSON hook
M-18One daemon behind the desktop, the text console and the zxp command, an audit line for every change
Skyline, one of the saver's scenes: a city of data halls at night under a red sky, their windows lit
the saver, Skyline
stop 11 · in practiceone line each

Things you will actually do

Real commands; the desktop does the same from its menus, and every change takes --dry-run.

A pool from a designzxp pool-create tank raidz2 ata-A ata-B \ ata-C ata-D ata-E ata-F log nvme-X \ --confirm tankThe verdict first; the pool's name typed again to erase the disks named.
Every hour, keeping a dayzxp set tank/data \ com.zettarack:snapshots=hourly=24,daily=7Snapshots that take and prune themselves, on everything under tank/data.
Shared with Windowszxp set tank/media com.zettarack:share=smb zxp user-add anna --password-stdinThe password on stdin, never on the command line.
One file, from Tuesdayzxp versions tank/data docs/plan.odtEvery copy across the snapshots, and whether it changed.
stop 12 · arriveget zxp

Get one on your shelf

Download

x86-64 · UEFI · one file for a USB stick or a disc · installs with no network

LTS · kernel 6.12 · OpenZFS 2.3 · fixes only

zxp 0.6.0 · 857 MB

Beta · kernel 7.2 · OpenZFS 2.4 · the new line, proven on the bench first

zxp 0.9.0 · 973 MB

Verify

Each release comes with SHA256SUMS (beta's), its signature by the release key, and the key itself.

LTS sha256 bc4d3bcc0a04e2cfd67ccc6471f959946410c8fbe6590ff93f68a8654d8942b0

beta sha256 094974df312124818ad68d8ba55b3f1e0ab1675a0efc4a3d3fe92071d378940e

openssl pkeyutl -verify -pubin \
  -inkey release.pem -rawin \
  -in SHA256SUMS -sigfile SHA256SUMS.sig
sha256sum -c SHA256SUMS --ignore-missing

Write to USB

sudo dd if=zettarack-zxp-0.6.0.iso of=/dev/sdX \
  bs=4M status=progress conv=fsync

On Windows, use Rufus in DD mode or balenaEtcher.

You'll need

  • UEFI firmware
  • A disk of 8 GiB or more for the system, apart from your pool's disks
  • Existing pools are found and left alone: a disk that holds part of one is never offered
  • With Secure Boot on: confirm the certificates once in MokManager on the first boot; the password is zxp
zettarack.com · website designed by North Star