Should I install the NAS operating system on the appliance's small internal eMMC, or does that burn out?

One thing to check before you commit: whether the firmware will actually boot from the eMMC once an OS is on it, and whether it stays first in the boot order.

Some of these appliances ship with the eMMC carrying a vendor OS and a firmware boot order tuned for that. Install something else on it and the machine boots to the wrong thing, or to nothing, after a power cut. It is recoverable but it is much nicer to discover it now, with an empty machine, than after you have migrated your data.

Test it properly: install, then pull the power rather than doing a clean shutdown, and confirm it comes back on its own. That is the case that matters, because that is what a power cut looks like.

Strong agreement on the config backup, and let me put a number on why it matters more than the wear question.

I have had a boot device fail. Total downtime was about forty minutes: install to the replacement, import the config, import the pool, done. Everything came back including shares, users and scheduled tasks.

Someone I know had the same failure with no config export. He got his data back — the pool was fine — but he rebuilt every share, every dataset permission, every user and every scheduled job from memory over a weekend, and was still finding missing pieces a month later.

Same hardware failure. The difference was one exported file.

It works, and it is a compromise rather than a trap — but you should make it knowing which part is the compromise.

What is actually true about the wear. eMMC is flash with a controller, and the controller in an eMMC module is simpler than the one in a decent SSD: less over-provisioning, weaker wear levelling, no meaningful write cache. A NAS operating system writes more than people expect — system logs, a reporting or metrics database sampling every few seconds, and the state of whatever is running on top.

Of those, the metrics and logging are the real write load, not the OS itself. The OS is mostly read-only in normal operation.

What that means in practice. These modules are usually specified in tens of terabytes written. A steady stream of logs and metrics is on the order of a few gigabytes a day, and at that rate you are talking about many years, not eighteen months. It is not the immediate death sentence the forums suggest. What it is, is a boot device with a finite and unmonitorable life, soldered to the board, in a machine you would like to leave alone.

So the order I would actually put these in:

1. A small SATA or NVMe device on an internal port, if the box has a free one. Best answer by a distance. A cheap small SSD has far better endurance than the eMMC, reports its own health so you get warning before it fails, and costs very little. Many of these appliances have an internal M.2 slot that is not one of the bays — check before assuming you have no options.
2. The eMMC. Fine. Do it if there is genuinely nowhere else.
3. A USB stick. No. This used to be normal advice and it stopped being good advice a long time ago; consumer sticks have poor controllers, get hot in a permanently powered port, and fail without warning.

Whichever you pick, do these two things, because they are what actually determine whether this bites you:

Keep a config backup off the box. The boot device holds the operating system and your configuration, not your data. Your data is on the pool and survives the boot device dying. So a current configuration export, stored somewhere else, converts "boot device failed" from a disaster into an hour with a fresh install and a restore. Export it after every change you would not want to redo.

Cut the write volume if you can. If the system lets you relocate the metrics or reporting database onto the pool, do it. That is most of the write traffic, and moving it changes the endurance question from interesting to irrelevant.

If the box does have a free internal port, mirroring two small SSDs as the boot device is an option a lot of these systems support natively, and it is cheap peace of mind for a machine you want to ignore.

Not necessary. But if the reason you are asking this question is that you do not want to think about the boot device again, that is the version that actually delivers it.