How to Set Up a Self-Hosted Home Server on Linux

Disclosure: some links on this page are affiliate links. If you sign up through them we may earn a commission at no extra cost to you. It helps keep LinuxDistroFinder free.

Running your own self-hosted home server on Linux gives you full control over your data, eliminates recurring subscription fees, and turns an old laptop or mini PC into a genuinely powerful hub for file syncing, media streaming, password management, and more. This guide walks you through every step — from choosing hardware and picking a Linux distro, to installing your first services and locking things down securely.

Step 1: Choose Your Hardware

You don't need to spend a lot. In fact, some of the best home servers are repurposed hardware that would otherwise sit in a closet. Here's how to think about it:

For most people starting out, an old laptop with its lid closed or a Beelink mini PC (the S12 Pro with an Intel N100 is a popular 2025–2026 pick at around $110) is the sweet spot. It's quiet, draws under 15 W, and comfortably runs 5–8 Docker containers simultaneously.

Step 2: Pick a Linux Distro for Your Server

You want something stable, well-supported, and with a large community. Here are the top picks specifically for home server use:

Step 3: Install Ubuntu Server 24.04 LTS

Download the ISO from ubuntu.com/download/server and flash it to a USB drive using Balena Etcher or the dd command. Then boot your server hardware from USB and follow the installer.

Key choices during install:

• Select Minimized install — you don't need a GUI on a server.
• Enable OpenSSH server during setup so you can SSH in immediately.
• Use LVM for storage if you might want to expand your disk later.
• Set a strong password and note your username — you'll need both.

After install, SSH in from your main machine on the same network:

# Replace 192.168.1.50 with your server's local IP
ssh youruser@192.168.1.50

Then immediately update everything:

sudo apt update && sudo apt upgrade -y
sudo apt install -y curl wget git htop ufw

Step 4: Assign a Static Local IP

Your router assigns IPs dynamically by default, meaning your server's IP could change on reboot. Fix this by either setting a DHCP reservation in your router's admin panel (preferred — no config files to edit) or by setting a static IP in Ubuntu's Netplan config.

# Find your network interface name
ip link show

# Edit netplan config (filename may differ)
sudo nano /etc/netplan/00-installer-config.yaml

An example static IP Netplan config looks like this:

network:
  version: 2
  ethernets:
    enp3s0:
      dhcp4: no
      addresses:
        - 192.168.1.50/24
      routes:
        - to: default
          via: 192.168.1.1
      nameservers:
        addresses: [1.1.1.1, 8.8.8.8]

sudo netplan apply

Step 5: Install Docker and Docker Compose

Almost every modern self-hosted application ships as a Docker image. Using Docker means you can spin up complex apps like Nextcloud in two commands, update them safely, and keep them isolated from each other. Docker Compose lets you define multi-container apps in a single YAML file.

# Install Docker using the official convenience script
curl -fsSL https://get.docker.com | sudo sh

# Add your user to the docker group (no sudo needed after re-login)
sudo usermod -aG docker $USER

# Log out and back in, then verify
docker --version
docker compose version

Step 6: Choose and Deploy Your First Services

Here are the most popular self-hosted services and what they replace:

Example: Deploy Vaultwarden (Bitwarden-compatible password manager)

Vaultwarden is the lightest, most privacy-respecting way to self-host a password manager. It uses just ~50 MB of RAM and runs as a single container.

# Create a directory for your service
mkdir -p ~/services/vaultwarden && cd ~/services/vaultwarden

# Create a docker-compose.yml file
cat > docker-compose.yml << 'EOF'
services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    ports:
      - "8080:80"
    volumes:
      - ./vw-data:/data
    environment:
      - SIGNUPS_ALLOWED=true
EOF

docker compose up -d

Now visit http://192.168.1.50:8080 in your browser and create your account. After that, set SIGNUPS_ALLOWED=false in the compose file and restart the container so no one else can register.

Example: Deploy Jellyfin (media server)

mkdir -p ~/services/jellyfin && cd ~/services/jellyfin

cat > docker-compose.yml << 'EOF'
services:
  jellyfin:
    image: jellyfin/jellyfin:latest
    container_name: jellyfin
    restart: unless-stopped
    network_mode: host
    volumes:
      - ./config:/config
      - ./cache:/cache
      - /mnt/media:/media:ro
EOF

docker compose up -d

Access Jellyfin at http://192.168.1.50:8096 and point it to /media during the setup wizard. For hardware transcoding on Intel CPUs (including the N100), you'll want to pass through the GPU device — the Jellyfin docs cover this well.

Step 7: Set Up a Reverse Proxy with Nginx Proxy Manager

Running services on raw ports like :8080 and :8096 gets messy fast. A reverse proxy lets you access them via friendly names like vault.home or jellyfin.home and also handles SSL termination if you want HTTPS (even locally, using a self-signed cert).

Nginx Proxy Manager is the friendliest option — it has a full web GUI.

mkdir -p ~/services/npm && cd ~/services/npm

cat > docker-compose.yml << 'EOF'
services:
  npm:
    image: jc21/nginx-proxy-manager:latest
    container_name: nginx-proxy-manager
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "81:81"
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt
EOF

docker compose up -d

The admin panel is at http://192.168.1.50:81. Default login is admin@example.com / changeme — change it immediately.

Step 8: Harden Your Server

A home server on your LAN is relatively safe, but good habits matter — especially if you ever expose services to the internet.

Enable and configure UFW firewall

# Allow SSH so you don't lock yourself out
sudo ufw allow OpenSSH

# Allow HTTP and HTTPS (for reverse proxy)
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Enable the firewall
sudo ufw enable
sudo ufw status verbose

Disable root SSH login and use key-based auth

# On your local machine, generate a key pair if you don't have one
ssh-keygen -t ed25519 -C "homeserver"

# Copy your public key to the server
ssh-copy-id youruser@192.168.1.50

# On the server, harden SSH config
sudo nano /etc/ssh/sshd_config

Set these values in sshd_config:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

sudo systemctl restart ssh

Keep your system updated automatically

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades

Step 9: Set Up Automatic Backups

Your home server is only as good as its last backup. At minimum, back up your Docker volumes — these contain all your app data. A simple approach is rsync to an external USB drive or a second machine.

# Backup all service data to an external drive mounted at /mnt/backup
rsync -avz --progress ~/services/ /mnt/backup/homeserver-services/

# Add to crontab for daily 2am backups
crontab -e
# Add this line:
0 2 * * * rsync -az ~/services/ /mnt/backup/homeserver-services/ >> ~/backup.log 2>&1

For offsite backups, consider Restic — it's a modern, encrypted backup tool that can push to B2, S3, SFTP, or any remote location. It deduplicates data efficiently, so incremental backups after the first run are very fast.

Step 10: Access Your Server Remotely (Optional)

Once your home server is running well locally, you'll want access from outside your network. There are three main approaches:

• Tailscale (recommended for most people): A zero-config VPN built on WireGuard. Install it on your server and your phone/laptop — they'll appear on a private network together no matter where you are. No port forwarding required, works behind CGNAT.
• Port forwarding: Forward ports 80 and 443 on your router to your server. Requires a static or DDNS-tracked public IP. Exposes your services to the internet — ensure everything is properly hardened.
• Cloudflare Tunnel: Free, no open ports, traffic proxied through Cloudflare. Great for HTTP/S services, but adds Cloudflare as a middleman.

# Install Tailscale on Ubuntu Server
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

After running tailscale up, you'll get a URL to authenticate in your browser. Once done, your server appears as a node on your Tailscale network with its own stable IP (usually 100.x.x.x).

Frequently Asked Questions

What's the minimum hardware for a Linux home server?

You can run a functional home server with as little as 2 GB of RAM and a dual-core CPU. A Raspberry Pi 4 (4 GB model) or any laptop from 2012 onwards will comfortably run Vaultwarden, AdGuard Home, and a small Nextcloud instance simultaneously. For Jellyfin with hardware transcoding or Immich with AI photo recognition, aim for 8 GB RAM and a reasonably modern CPU (Intel 8th gen or newer, or an N-series Alder Lake chip like the N100).

Do I need to open ports on my router to run a home server?

No — not if you only want local network access or use Tailscale for remote access. You only need to open ports if you want services to be directly reachable from the public internet without a VPN or tunnel. For most home users, Tailscale is the recommended approach because it requires no firewall changes and encrypts all traffic end-to-end.

Is Docker required for a home server?

Not strictly, but it's highly recommended. You can install services like Nextcloud or Jellyfin directly via apt or from source, but Docker makes updates, isolation, and backups dramatically simpler. Each service lives in its own container, so a broken Nextcloud update can't affect your Jellyfin instance. Most self-hosted app documentation assumes Docker in 2026.

Which distro is best for a Raspberry Pi home server?

Ubuntu Server 24.04 LTS for ARM64 or the official Raspberry Pi OS Lite (64-bit) are both excellent choices. Raspberry Pi OS Lite has better hardware compatibility for Pi-specific features (GPIO, camera module, etc.), while Ubuntu Server offers a more familiar environment if you're also running x86 servers. For Proxmox on a Pi, note that it's not officially supported — use a proper x86 machine for Proxmox.

How do I secure Nextcloud on a home server?

At minimum: use HTTPS (even with a self-signed cert, or use Let's Encrypt if you have a domain), enable two-factor authentication for your admin account, keep Nextcloud and its apps updated regularly, and make sure the data directory is outside the web root. If exposing to the internet, also consider rate-limiting failed logins via Fail2Ban and setting a strong admin password. Nextcloud's built-in Security & Setup Warnings panel flags most issues automatically.

What's the difference between a home server and a NAS?

A NAS (Network Attached Storage) is purpose-built for file storage, usually running a proprietary OS (like Synology DSM or TrueNAS). A Linux home server is more flexible — you can run any service alongside file storage. Many people start with a NAS OS and graduate to bare Linux once they want more control. TrueNAS SCALE (based on Debian) is a popular middle ground that gives you a polished UI and the full power of Linux underneath.