This is the guide I wish I had when I started. Block ads and malware on every device in the house, host the family's password manager on a machine you own, watch your own cameras without the app phoning home. One afternoon. Free.
Every smart device in a modern home leaks. The TV pings ad networks every few seconds. The phone calls home. A cheap IoT bulb talks to a server you cannot trace. Family passwords sit in a service whose breach disclosure will arrive after the breach. Most households accept this because the only alternative on the shelf is a $300 firewall box from a company that may not exist in two years.
There is a quieter alternative sitting in almost every household: an old laptop in a drawer. It is already a Linux box. It already has a battery, a screen, a keyboard, and a disk. It just needs a job. Mine is now a home server that handles four jobs at once and draws about as much power as a phone charger.
The laptop I used is an AMD C-70 netbook from 2013 — slower than a modern phone, plenty fast for DNS lookups and a SQLite database. Yours can be older. The floor is a 64-bit CPU, 2 GB of RAM, and a working SSD.
"Most people throw the old laptop in a drawer because they think a server is something you buy. A server is a Linux box that does not turn off. The laptop in your drawer is already a Linux box. It just needs a job."
Pick the laptop. Anything with a 64-bit CPU, 2 GB+ RAM, and a working battery good enough to ride out a flicker. Smaller is better. Older is fine. The C-70 in mine is from 2013 and still keeps up.
Boot from a USB stick, install Ubuntu Server (or Ubuntu Core for a minimal footprint). Wired ethernet if the router is close enough. Otherwise WiFi works. Set a static IP on the router so the address never changes. Disable lid-suspend so closing the lid does not put it to sleep: HandleLidSwitch=ignore in /etc/systemd/logind.conf.
Install openssh-server, ufw, fail2ban. UFW: deny all incoming, allow SSH from the LAN subnet only. Fail2Ban: ban after 3 failed SSH attempts. Install Tailscale (free for personal use, 100 devices). Now you can SSH in from anywhere without opening port 22 to the internet.
Install Docker. Run Pi-hole in --network host mode on port 53. In the router admin, change the DHCP DNS to the laptop's static IP. Every device on the network now resolves DNS through Pi-hole and inherits the blocklists. Add Tailscale's nameserver setting to push the same blocking to phones on cellular.
Run Vaultwarden in Docker, bound to 127.0.0.1:8080 only. Use Tailscale Serve to expose it inside the tailnet on an HTTPS URL like https://minibot.your-tailnet.ts.net. Install Bitwarden apps on phones and laptops, point them at that URL, enable 2FA on every account. Family password manager done. Never reachable from the public internet.
Daily cron at 3 AM: SQLite safe-backup of the vault, GPG-encrypt the dump (AES-256, passphrase chmod 600), upload to a free cloud drive via rclone. Telegram alert on failure. For belt-and-suspenders, plug in an SD card with two rotating checkpoints written by another cron job. The same SD card has a restore.sh that rebuilds the whole stack on a fresh machine. Disaster recovery tested means disaster recovery that works.
A small Python bot that loops over every service every 60s, checks DNS resolves, the Vaultwarden container is up, fail2ban has not banned the operator, the disk is not full. On any red, it messages Telegram. Daily summary at 8 AM. A status page on port 8788 makes it installable as a PWA on the phone. The homelab tells you when it is sick instead of you discovering it the day you needed it.
restore.sh that rebuilds the whole stack: pulls Docker images, restores Vaultwarden data, reinstalls cron and systemd units. Plug the SD card into any Linux machine and run the script. Up in about 20 minutes. The cloud copy is the second line of defense.pihole allow example.com. After a week of tuning the false-positive rate drops to near zero.apt update && apt upgrade and docker pull for each image. A single shell script handles it. The health bot pages you if anything is down. The first month is fiddly. After that it disappears into the background.Each project has good docs. Read them. They are the durable reference; this guide is the map between them.