A build-along book
The Home Server Book
Build a private server for your family, one idea at a time.
This is a book about putting a small computer in your house and slowly turning it into a photo server your family can rely on. The same isolation, identity, backup and monitoring pattern can support later applications.
It is written for someone who can use a terminal but has never run a server, and it refuses to hand you a script that does everything at once. Each chapter explains one idea, has you apply it yourself, and tells you what it traded away to get there.
How this book works
Read the chapter
Every chapter explains the idea before it gives you a command, and says out loud what it is trading away.
Try it on your own server
You type the commands. That is the part that turns reading into knowing, so the book never hands you a script that does the chapter for you.
Stuck? Copy a prompt
Every section has a prompt you can paste into a fresh AI session. It knows where you are and what you have built, and it is told to walk you through the problem instead of solving it behind your back.
Foundations
- 1 Why run a server at home? What you get, what it costs, and the four questions behind every decision in this book.25 min
- 2 Meet your server Learn to read the machine before you change it: what it is, what it runs, and what the installer already decided for you.50 min
- 3 A safe front door Key-only SSH, no root login, automatic security updates. Your first changes, made without locking yourself out.60 min
- 4 Default deny Decide what can reach your server, and test it from another machine.45 min
- 5 Make it repeatable Turn a dozen hand-made changes into a file you can run again, and that tells you when the server has drifted.60 min
Your first app
- 6 Containers, honestly What a container is, where its data lives, and why publishing a port walks straight past your firewall.75 min
- 7 Your photos Read the vendor's compose file critically, decide where the data lives before there is any, and get a photo library running on your network.90 min
- 8 One door, many rooms One port, several applications, routed by hostname. Plus what a certificate actually proves.80 min
Trust
- 9 Keeping secrets Where passwords leak from, why environment variables are the wrong place, and how to commit your configuration without committing its secrets.70 min
- 10 Your own private network Reach the server from anywhere over a deny-by-default private mesh, without publishing administration.75 min
- 11 Backups, and proving they work Put encrypted backups off the server, schedule them, then restore files and a database on purpose.110 min
- 12 Reachable from anywhere Give enrolled family devices private HTTPS access without putting photo and video traffic through an unsuitable public tunnel.65 min
- 13 One login for supported applications Run a current identity provider, protect it with the private mesh, connect Immich, and preserve recovery access.120 min
Living with it
Side reading
Nothing here is required to get through a chapter. It is the material that would have made chapters twice as long.
- Working with an AI assistant without outsourcing your brain How to use the prompts in this book, what they are trying to prevent, and what to do when the assistant is confidently wrong.
- When you have locked yourself out What to try, in order, when SSH stops letting you in. Read it before you need it.
- Reading journalctl without drowning The six flags that turn systemd's log from a wall of text into a useful answer.
- Reading iptables output Enough vocabulary to look under your firewall and understand what you are seeing, without becoming a netfilter expert.
- Containers are not virtual machines What the boundary actually is, what it stops, what it does not, and how much to trust it on a machine holding your family's data.
- Compose, Swarm or Kubernetes Why this book uses Docker Compose on one machine, what the alternatives buy you, and the honest signs that you have outgrown it.
- A restore drill Repeat the exact file and database recovery checks twice a year, without touching the live copy.
- DNS, enough of it Records, resolvers and caching, and why the same name can honestly give different answers to different people.
- OIDC in one page Every parameter in an OpenID Connect login, what it is for, and which one is causing your error.
- When a disk starts to fail Reading SMART attributes, which numbers actually predict failure, and what to do when one moves.
- Ansible without the enterprise The fraction of Ansible a home server needs, and the vocabulary its documentation assumes you already have.
- Users, groups, and the file owned by nobody Why a container writes files owned by a user that does not exist, and how to make it stop.
- What TLS actually asserts Certificates, chains of trust, and why a private authority is fine at home and worthless in public.
- Choosing hardware What actually matters for a family server, what does not, and what an old laptop can and cannot do.
- Pinning images, and reading a release note Tags against digests, and how to tell an upgrade that migrates your database irreversibly from one that does not.
- Storage layout, and moving a category later The directory structure that lets you add a disk without rebuilding, and the migration done carefully once.
- Glossary Short definitions of the words this book leans on, in the sense this book uses them.
Where the four questions get answered
Every chapter tightens one of the four questions from chapter 1. This is the map.
| Who can reach it | Who are you | Where the data lives | How you know it is alive | |
|---|---|---|---|---|
| 1–5 Foundations | firewall, key-only SSH | your own account, sudo | survey only | failed units, logs |
| 6–8 Your first app | published ports, one front door | each app's own login | bind mounts, appdata and data | container health |
| 9–13 Trust | private mesh, outbound tunnel | one identity, MFA, groups | encrypted secrets, tested restore | nothing yet |
| 14–15 Living with it | reviewed before real data | accounts reviewed | quotas | probes and alerts that reach you |
Not covered yet
The book gets you to a working, backed-up, monitored server holding your photographs. These are the next things, and they are not written.
More applications. Files and calendars, documents with searchable scans, a password vault, media for the television. Each follows the chapter 7 and 8 pattern: read the vendor's compose file, pick a data tier, give it a hostname, no published port. The book teaches the pattern rather than repeating it per application.
Applications talking to each other. One wants to read another's files. Read-only mounts, export directories, and why pointing two applications at the same writable tree corrupts things eventually.
Running containers as an unprivileged user, one image at a time, recording what each genuinely needs. Worth doing, and only after everything works, because it breaks images in ways that are tedious to diagnose.
Starting workloads only when asked for. A tool you open twice a month need not hold memory the rest of the time. A proxy plugin can start the container on the first request and stop it after a period of inactivity. Good on a small machine with a long list of occasional tools. The costs are another moving part in the request path and, usually, another thing wanting the Docker socket.
Wired networking, if your server is on wifi. Different interface name, possibly a different subnet, and a firewall rule that stops matching.
Power. Measuring it properly, and surviving a cut with a battery. Needs hardware, and the USB permissions to talk to it are their own small adventure.
Administration pages inside shared application routes. Most applications put their admin screens on the same private hostname family members use. Blocking paths at the proxy is brittle because routes change between releases. Prefer application roles or documented admin-network restrictions, and preserve a tested local recovery account.
Letting an assistant do the work. What you grant when you give one a login, how to keep it effective, and what never goes into a context window. Deliberately parked.
A search box for this book.
If you want to go further
Three directions, roughly in order of how much they change.
Do it again from scratch. The strongest test of whether the playbook and the backups are real. Reinstall the operating system, run the playbook, restore from backup, and see how far you get without this book open.
Replace a piece deliberately. Swap the reverse proxy, or the identity provider, or move to Podman. The reasoning transfers even when the syntax does not, and finding out which parts you understood is the point.
Write down what you would do differently. The decisions this book made are defensible, not correct. After a year you will disagree with some of them, and that disagreement is worth more than the original choice.