Homelab

Self-hosting from scratch

← JPNAS.NET
πŸ–₯️ A complete example

A whole home self-hosting setup, piece by piece.

Mail, files, photos, calendars and a website – all on your own hardware instead of a cloud service or an off-the-shelf NAS. This example follows one household from start to finish: a small Debian server for mail, the web, files and photos, a second mini PC just for Home Assistant, and a UniFi gateway that keeps everything in separate networks behind a strict firewall.

The network map below shows how the pieces fit together, and the chapters go step by step – the command, what it does, and how to check that it worked. It's an example, not a recipe: take what fits your home and leave the rest. An AI assistant helps a lot with planning and troubleshooting – just make sure you understand a command before you run it.

πŸ—ΊοΈ The network map

Click a device to see what it is and what runs on it, or pick a scenario and watch the traffic move through the network – and where the firewall stops it.

β€” solid line: cable  Β·  dotted: Wi-Fi  Β·  dashed blue: VPN tunnel

← Swipe sideways to see the whole map.

πŸ“š Chapters

Each chapter is one step: the command, what it does, and how to check it. They'll appear here one by one.

A Β· The server – foundation

  1. 1Installing Debian 13 on a fully encrypted disk (LUKS + LVM)Coming soon
  2. 2Unlocking the encrypted disk over SSH after a reboot (dropbear)Coming soon
  3. 3Hardening: SSH keys only, ufw, fail2ban, automatic updates, zramComing soon
  4. 4Data disk: RAID1 (mdadm) and LUKS with a key fileComing soon
  5. 5Users, groups, folders and permissions (setgid, ACL)Coming soon

B Β· The network (UniFi)

  1. 6Networks and VLANs on the Cloud Gateway UltraComing soon
  2. 7Zone-based firewall: block everything, then allow only what's neededComing soon
  3. 8WireGuard VPN for phone and laptops (split tunnel)Coming soon
  4. 9Encrypted DNS (Quad9 over HTTPS), local DNS records, IPSComing soon
  5. 10Locking down the gateway: no cloud access, 2FA, port forwardsComing soon

C Β· Web services

  1. 11Apache (mpm_event), separate PHP-FPM pools and MariaDBComing soon
  2. 12Let's Encrypt certificates and automatic renewalComing soon
  3. 13Docker – and the trap where it quietly bypasses ufwComing soon
  4. 14Moving a website and web apps to the new serverComing soon

D Β· E-mail

  1. 15Mail server with docker-mailserver (Postfix, Dovecot, rspamd, ClamAV)Coming soon
  2. 16SPF, DKIM, DMARC, PTR – up to 10/10 on mail-testerComing soon
  3. 17A local Unbound resolver, so Spamhaus checks workComing soon
  4. 18Moving mailboxes from the old NAS, setting up Thunderbird and the phoneComing soon

E Β· Apps

  1. 19Contacts and calendars with Radicale (CalDAV, CardDAV)Coming soon
  2. 20A self-hosted bookmark sync server and browser extensionComing soon
  3. 21Network drives with Samba (SMB3 with encryption)Coming soon
  4. 22Immich for photos and videosComing soon
  5. 23Authelia: login with 2FA (OIDC, TOTP, passkeys)Coming soon
  6. 24A self-hosted screen recorder with live streaming (WebSocket, ffmpeg, HLS)Coming soon

F Β· Backups and migration

  1. 25Nightly backups of the server with ResticComing soon
  2. 26Copying the data off the old NAS (read-only CIFS, rsync, tmux)Coming soon

Later in the series: Kopia backups for the computers, the second disk in the RAID1, Home Assistant on its own mini PC, DNS at deSEC, an off-site backup, and a UPS with NUT, SMART checks and monitoring.

🌱 Background in the Digital Garden

The theory behind the steps – why things work the way they do.