Self-Hosting 101: Your First Server, Start to Finish

Buy a used mini PC for about $150, install Debian, run three apps in Docker (a media server, a password manager, a photo backup), and set up one backup job. That's the whole first month, it replaces roughly $25/month in subscriptions, and everything else in self-hosting is a variation on those four moves. Here's each one in enough detail to actually do it.

The hardware: skip the Raspberry Pi

The default beginner advice — buy a Raspberry Pi — is outdated. A Pi 5 with a case, power supply, and decent storage lands around $120–140 and gives you 8GB RAM on ARM. For the same money, a used Lenovo ThinkCentre M720q or Dell OptiPlex Micro off eBay gives you an x86 CPU that's 3–4× faster, 16GB RAM, a real NVMe slot, and far better software compatibility (some container images still don't ship ARM builds). Idle power is the Pi's only win: ~4W versus ~10W, which at $0.15/kWh is about $8/year. Take the mini PC.

Whatever you buy: 16GB RAM is the comfortable floor, and put a 500GB+ SSD in it. Media libraries can live on an external USB drive at first.

The OS: boring Debian, no desktop

Install Debian stable (or Ubuntu Server LTS if you prefer newer packages) — minimal install, no desktop environment, SSH server enabled. The machine lives headless in a cupboard; you administer it from your laptop terminal.

Three commands after first boot:

sudo apt update && sudo apt upgrade -y
sudo apt install -y curl git ufw
curl -fsSL https://get.docker.com | sh

Then two safety rails before anything else — a firewall that only admits SSH and web traffic, and automatic security updates:

sudo ufw allow OpenSSH && sudo ufw allow 80,443/tcp && sudo ufw enable
sudo apt install -y unattended-upgrades

Why Docker, in one paragraph

Every self-hosted app has its own pile of dependencies. Docker isolates each app with its runtime in a container, defined in a short text file, so installing anything is docker compose up -d and removing it is just as clean. Near-universal advice in the community is to learn Compose on day one — it's the difference between a server you understand and a server you fear. Keep one directory per app under /opt/stacks/, each with its own compose.yml.

Your first three apps

Start with apps that replace money you're already spending. A media server (Jellyfin), a password manager (Vaultwarden), and photo backup (Immich) are the classic trio. Jellyfin as the worked example:

# /opt/stacks/jellyfin/compose.yml
services:
  jellyfin:
    image: jellyfin/jellyfin:latest
    ports:
      - "8096:8096"
    volumes:
      - ./config:/config
      - /mnt/media:/media:ro
    restart: unless-stopped

docker compose up -d, then open http://<server-ip>:8096 from any device on your network. Immich and Vaultwarden follow the same shape — official compose files are in each project's docs, and the pattern (image, ports, volumes, restart policy) transfers unchanged. Add Uptime Kuma as a fourth when you want a dashboard that tells you something is down before your family does.

One rule while you're new: don't expose anything to the internet yet. Everything above is LAN-only. Remote access done safely (Tailscale, WireGuard, or a tunnel) is its own topic — do it in month two, deliberately.

The backup habit that separates survivors from casualties

The self-hosting failure story is always the same: eighteen months of photos on a single SSD that died. Set this up in week one, not "eventually":

• Config and data: a nightly restic job to any second location — an external drive is fine to start, cloud object storage (Backblaze B2 runs about $6/TB/month) when you're ready for off-site.
• The compose files themselves: a git repo. Your entire server becomes reproducible from git clone plus data restore.
• Test one restore. A backup you've never restored from is a hope, not a backup.

restic -r /mnt/backup/repo init
restic -r /mnt/backup/repo backup /opt/stacks --exclude="**/cache"

What it costs and what it returns

Break-even lands around month six or seven. The non-financial return — your photos, passwords, and media under your control on hardware you own — is the actual point, and it starts on day one.

What I'd do, condensed

Used ThinkCentre M720q → Debian minimal + SSH → UFW + unattended-upgrades → Docker via get.docker.com → Jellyfin, then Vaultwarden, then Immich, one per weekend → restic to an external drive with one tested restore → only then think about remote access. When an app annoys you, browse its category here and swap it — the freedom to do that is why you built this.