Home Server

Your own cloud, on hardware
you already own.

Home Server turns a Linux machine you already have — a Raspberry Pi, a mini PC, an old laptop — into a private home cloud: media, files, passwords, a local LLM and full Linux desktops, all installed with one click and all staying in your house.

Pre-release. It runs and is used daily on a Raspberry Pi, but it is not ready for anyone else yet: the source is not public, and it has never once been run on an x86 machine. This page describes what exists today, not what is planned.

What you get

A real app store

Jellyfin, Nextcloud, Vaultwarden, Ollama with Open WebUI, VS Code Server, a file manager — one click each, no compose files. Plus a community catalog and a sideload form for any other Docker image.

Updates that cost nothing to check

Every installed app is compared against its registry by manifest digest, so a full sweep costs a few kilobytes rather than a pull. If an update fails to start, the previous image is put back.

Full desktops in a browser

Ubuntu desktops in a container, ready in about a minute and light enough for a Pi — or real KVM virtual machines on hardware that can take them.

Local AI

Ollama and Open WebUI are one click, running entirely on your own hardware. No API key, no request leaving the house.

It finds itself

It appears in Windows File Explorer and at your-machine.local on Mac and Linux, over mDNS, WS-Discovery and UPnP. No IP hunting, no companion app.

Two-factor authentication

Standard TOTP, with the enrolment QR drawn on the box itself — the secret never leaves it, and enrolment works with no internet at all. Recovery codes included.

Four free ways to reach it from anywhere

Getting at a box behind a home router is the part that normally does not work. Pick whichever of these suits you — you can run more than one, and none of them costs anything.

You want	Use	It costs you
Just your own devices, minimal setup	Tailscale Serve	A Tailscale account
Public access, no domain, no router changes	Tailscale Funnel	A Tailscale account
Public access at a name you own	Custom domain	A domain, and ports 80/443 forwarded
The same, behind CGNAT	Cloudflare Tunnel	A domain on Cloudflare

Tailscale Serve is the least work of the four: a real, publicly-trusted certificate on your tailnet name, with no domain, no ports and no browser warning. Only the dashboard is ever published by any of these — your apps stay on your network, behind the login.

Installing it

It installs onto a Linux machine you already have, alongside whatever else that machine is doing. There is no image to flash and no SD card to write. One thing has to land before you can do this.

git clone https://github.com/Jackson-Brooks/home-server.git
cd home-server
sudo bash install.sh

The source, opened up

Everything is one repository — dashboard, installer, helper scripts, tests — and it goes public under the Apache License 2.0 with the first release. Until then the command above has nothing to clone.

After that: open your-machine.local in a browser. There is no account to make and no password shipped — the first screen asks you to set one, so do it before you walk away. Removing it again is sudo bash uninstall.sh, which leaves your data alone.

What it runs on

Debian 12+ or Ubuntu 22.04+, on amd64 or arm64, with systemd.

Raspberry Pi 4 or 5 — what it is developed and tested on. 4 GB or more if you want virtual machines.
Intel N100-class mini PCs — supported by the same installer, but never once run. Treat it as unfinished.
An old laptop, or a VPS — same installer. On a VPS, remote access has different answers than it does on a LAN.

What it deliberately does not do

A missing capability found at the wrong moment is worse than one written down, so:

It does not back itself up. Backup is a wide problem with different right answers per person, and a restore path that half-works is worse than none. What it ships instead are the pieces that make any backup tool work: attach a drive, then grant one backup app read-only access to exactly the data you choose.

It is not a security boundary against itself. The dashboard holds the Docker socket, because being an app store requires it, and Docker socket access is root-equivalent. Anyone threat-modelling this should treat the dashboard as root on the box.

It cannot set itself up with no network. Installing means running a command on the machine, so it has to be reachable already. Earlier versions shipped as an image with a Wi-Fi setup portal for a box with no connection at all; that went when the image did, and it is the one capability the change cost.

Community apps are third-party software. Entries are checked for what they may ask of your box — no host mounts, no reaching another app's data — not audited for what the software itself does.

Your own cloud, on hardwareyou already own.