DATAZONE Case Study: TrueNAS and Proxmox at a Law Firm with 25 Lawyers

This case study describes a real project we delivered in 2026 for a mid-sized law firm in southern Germany. The firm remains anonymous for confidentiality reasons, but the structure is typical of partnerships in this size range, and the technical decisions translate almost one-to-one to comparable firms. We describe what the firm had before, what it needed, what we built and where we had to adjust along the way.

If you are looking for a starter architecture for a much smaller practice, our article Three-lawyer firm: best-practice IT setup covers the fundamentals. This piece is the next step up: 25 lawyers, several sites, terminal servers, DATEV, real case-file volumes.

Starting point: grown IT in a 25-lawyer firm

The firm works primarily in commercial and employment law, with a noticeable share of public law. 25 lawyers, plus secretarial staff, accounting and a two-person IT team that runs the systems on the side. Before our project the IT looked like this:

• An older physical Windows server holding the case directories as an SMB share.
• Two ESXi hosts on VMware vSphere Essentials Plus, running the DMS server, DATEV server, a Windows terminal server and an AD domain controller.
• Backup via Veeam to an off-the-shelf NAS, with tapes rotated “at some point” every few weeks.
• Home office over Fritzbox VPN that kept dropping.
• One single file server that nobody wanted to touch any more, because “it had always worked”.

The trigger for the project was two-fold. VMware’s licence changes in 2024 made renewal financially unattractive, and a ransomware incident at a partner firm nearby had woken up the management team. The mandate was clear: clean separation of storage and compute, real snapshots, a reliable restore process, no more vendor lock-in and predictable ongoing costs.

Target architecture: decoupled storage and compute

After the assessment we settled on a clear two-tier design that has proven itself at this size:

1. TrueNAS as the file server and dataset layer for VMs — an enterprise storage system with ZFS holding the case files, the DMS databases and the VM disks.
2. Proxmox VE as the compute layer — three nodes with local NVMe SSDs for fast scratch volumes, but all production VMs on TrueNAS via NFS and iSCSI. We describe the pattern in Planning a Proxmox architecture and TrueNAS iSCSI storage for Proxmox.
3. Separate backup path — an independent Proxmox Backup Server and a second TrueNAS as replication target, plus an encrypted cloud off-site.

The TrueNAS systems are current enterprise models. For this firm a hybrid HDD-plus-NVMe-cache configuration was the right fit — we sized it with real customer numbers (case-file growth, DMS database size, backup window) using our TrueNAS configurator. Older M-series units such as M50 and M60 are end-of-life by now and were not in the running for a new install; we planned with the current M-series successors instead.

Why not a pure hyperconverged setup

Ceph inside the Proxmox cluster would have been technically possible. We deliberately chose against it, because the internal IT team runs day-to-day operations and ZFS snapshots via the web UI are much more approachable than Ceph operations. Hyperconvergence with Proxmox and Ceph is a great model for customers with in-house storage experience — see our overview Proxmox Ceph hyperconverged storage — but in a law firm with half an IT position it adds more complexity than value.

TrueNAS as the case-file store: datasets, permissions, snapshots

The file server is the beating heart of a law firm. Misconfigured permissions or lost snapshots surface immediately. We cut the datasets by responsibility, not by folder logic:

• kanzlei/akten — case directories, attached to the DMS, ACLs per practice group.
• kanzlei/vorlagen — pleading templates, writable only for secretariat and group heads.
• kanzlei/zeiterfassung — time-tracking back end, strict backup window.
• kanzlei/datev — data exchange with the tax adviser and internal DATEV archive.
• kanzlei/scan — landing zone for the Sharp multifunction printers, rotated daily.

Each dataset has its own snapshot schedule. Case files see hourly snapshots with 24-hour retention, daily with 30 days, weekly with a year and monthly with 24 months. The technical foundation is described in The value of TrueNAS snapshots and TrueNAS snapshots and replication explained.

The key insight is that snapshots and backups are two different protection layers. A snapshot is not a backup, but a snapshot is the fastest answer to “the associate just overwrote the wrong folder”.

Permission layers and Active Directory

The firm runs a Windows domain. TrueNAS is AD-integrated, ACLs are maintained per dataset. Associates see their case files, group heads see their group’s cases, managing partners see everything. Accounting is strictly separated, the secretariat has a defined slice. TrueNAS audit logs record sensitive access — especially in the datev and intern datasets.

Proxmox VE as the terminal-server platform

Three Proxmox nodes host the production VMs:

• Two Windows terminal servers (session hosts, not full VDI) as an active pair with a session broker. From here the lawyers work over RDP, whether in the office, at home or on a train.
• A DMS application server with the vendor’s back end for the firm’s software.
• A DATEV server for time tracking, billing and the tax-adviser exchange.
• Two Windows domain controllers as a redundant pair.
• A print and scan server connected to the Sharp fleet.
• Various utility VMs — monitoring, management consoles, a jump host for remote maintenance.

All production VM disks live on TrueNAS. That way we can move VMs between nodes without re-provisioning storage, and restores hit the same ZFS base. A clean migration playbook from an existing VMware estate is sketched in Moving from VMware to Proxmox.

Why terminal servers instead of full VDI

Full VDI with a dedicated desktop per lawyer would be nicer in theory, but more expensive and harder to run in practice. Session hosts are the pragmatic choice for a typical firm: 25 lawyers, homogeneous software, little personal specialist tooling. The two session hosts run as an active pair; if one drops, sessions continue on the other. For the lawyers it stays as the familiar RDP connection they already know.

Home office runs through an internal RD Gateway behind an OPNsense firewall. WireGuard is the second path for administrative access. If you are interested in the firewall side of that story, see Setting up OPNsense WireGuard VPN.

Ransomware resilience: snapshots, replication, off-site

The ransomware incident nearby was the emotional trigger — the technical response has three layers:

1. ZFS snapshots on the primary TrueNAS. Read-only, not mutable over SMB, with the retention above.
2. Replication to a second TrueNAS in the same network, but in a different fire zone. The replication target uses a separate admin account; a compromised Windows admin cannot delete it.
3. Off-site backup via Proxmox Backup Server to encrypted cloud storage. PBS produces deduplicated VM backups; ZFS-send also puts file datasets into encrypted off-site storage. We wrote up the fundamentals in ZFS backup strategies and The 3-2-1 backup rule for SMB.

During the project phase we ran two real restore exercises — one from a snapshot, one full restore from cloud backup. Both were scheduled and reviewed; the firm now runs them quarterly. Why exercises matter more than backup reports is the theme of TrueNAS data security and ransomware resilience.

DATEV, beA and legal-industry software

On the application side the firm has three special topics that need to live side by side:

• DATEV for time tracking, billing and the exchange with the external tax adviser. DATEV runs the classic way as a Windows application on its own server; the tax-adviser exchange goes through DATEVnet on a dedicated data path.
• beA (the German lawyers’ electronic mailbox) on every associate’s client — no central server component, but well-maintained card readers and a documented support process.
• Legal software (DMS) with its own database back end, files on TrueNAS, application on a Windows VM in Proxmox.

We deliberately did not want to “modernise” anything in that stack. Legal software and DATEV are not the place where an infrastructure project should get stuck. What we did do: cleanly separate the data paths, define permissions and give every domain its own dataset.

Operations, monitoring and the people behind them

Technology is only half the story. During handover we wrote runbooks with the internal IT team for the most common cases: snapshot restore, VM restart, cleanly terminating a terminal-server session, clearing a Sharp print queue, applying a DATEV update. Monitoring runs on our DATAZONE Control platform — a single pane of glass over TrueNAS, Proxmox, Windows VMs and OPNsense.

One point mattered to the firm above all others: no offshore call centre when something is on fire. First-level support runs through our IT service desk with German-speaking contacts and defined response times. Second-level on storage and virtualisation we do ourselves; third-level is the vendor support at iXsystems for TrueNAS hardware.

What the move actually delivered — an honest balance sheet

After six months of production we can say the following without marketing gloss:

• Terminal-server sessions are noticeably faster than in the old estate. That is less about Proxmox itself and more about a properly designed NVMe cache tier on TrueNAS and a matching 25/100 GbE backbone.
• Licence costs are down, but not by an order of magnitude. VMware was expensive, Proxmox is cheap, but we invested that difference into setup and runbooks. The annual IT bill is smaller, and above all more predictable.
• Ransomware resilience is materially higher. We do not measure that as a single number but by what restore tests reveal: from any point in the last twelve months we get case files back in under an hour.
• The internal IT team works on different things now. Less firefighting, more evolution.

We will not sugarcoat one point either: in the first weeks there was friction over permissions because the old “everyone can see everything” no longer worked. That is normal in a firm with grown structures, and it took a number of conversations between the managing partner and the practice groups before the layers were accepted.

What a comparable setup costs

We deliberately do not publish fixed prices — hardware pricing for NVMe, HDDs and networking gear moves too much, and every firm has different constraints (number of sites, home-office ratio, DMS choice, migration effort). What we can say: for a project of this size we plan with a clear range for the initial investment and a transparent calculation for operations, support and cloud off-site. We are happy to produce an individual proposal on request; the initial rough estimate we usually do using our TrueNAS configurator and a short call.

FAQ

How long does a project like this take at a firm with 25 lawyers?

From the first assessment to the productive terminal-server cutover we needed roughly four months. Hardware lead times were the single largest block. The actual cutover ran over an extended weekend; the firm was live on the new platform first thing Monday morning.

What happens in a ransomware incident on the new platform?

We have three protection layers: read-only ZFS snapshots, replication to a second TrueNAS in another fire zone and an encrypted off-site backup in Proxmox Backup Server. Restore exercises happen quarterly. The question is no longer “can we recover”, but “how fast and from which point in time”.

Why Proxmox rather than VMware or Hyper-V?

Commercially, because the 2024 VMware licence changes made the operating model unattractive — background in VMware licence changes and Proxmox as an alternative. Technically, because Proxmox works very well with ZFS and TrueNAS and because we know how to run it in production. Hyper-V would have worked; the firm just wanted away from a single large vendor.

Is TrueNAS certified with DATEV?

DATEV certifies application servers, not file systems. The DATEV server is a Windows VM on Proxmox with a local data directory; TrueNAS only appears as a backup and archive target. That is a pattern we run at several law and tax firms without any DATEV support issues.

How do you handle the German BRAO and GDPR?

The retention duties under the German lawyers’ code (BRAO) are covered by long snapshot retention and off-site backup. GDPR mainly concerns processor agreements for cloud storage, MFA for every lawyer and documented access logs for sensitive datasets. A general overview lives in the IT security checklist for SMB.

Who is this case study transferable to?

Law and tax firms between roughly fifteen and fifty lawyers with grown IT benefit almost one-to-one from this pattern. Smaller offices find their starting point in the article about the three-lawyer firm; larger partnerships need extra building blocks (two-site active-active, dedicated SIEM, VDI). If you play in this size range: talk to us.