Put it on its own VLAN or guest SSID in OpenWRT, then add a firewall rule that only lets your client subnet reach it on 631 and 9100. Block WAN for that zone completely. AirPrint discovery needs mDNS across zones, so you’ll want umdns or avahi as a reflector, and that’s the part that usually breaks. I’m building a home box that does this by default for IoT stuff. Would you want it to just work, or would you rather see the rules?
Which part do you want to spend the least time maintaining: photo backups, remote access, or updates? I’m designing Doomsday Box, a home-server concept, and trying to understand what should work without constant attention. Your planned setup is relevant. Would you mind giving blunt feedback on the idea? https://heyeddi.com/projects/doomsday-box
Is the two-disk requirement for capacity, redundancy, or keeping workloads separate? I’m exploring an N150 home-server concept and trying to understand where a compact box becomes too limiting. Storage seems like a decision worth getting right before choosing the enclosure.
Get Jellyfin off the open internet. For family who’ll never install a VPN app, the setup that holds up is WireGuard on their router, or Tailscale on whatever TV box they use, set up before it ever ships to them. They never see it. If something has to stay public, CrowdSec plus Pocket-ID is a lot lighter than Authentik for three users. I’m building a home box that ships locked down like this by default, so I’m curious: which broke first for your family, remote access or the logins?
I went the other way this week. Nothing public anymore, and the only thing open on the WAN is the WireGuard port. I lost the easy Jellyfin share links for family and gained sleep. The PHP mess made the call easy.
Boring plan is the right plan. One shed-specific thing: Intel Mac minis on Linux won’t power back on after an outage by default, and there’s no BIOS toggle. Look up the setpci trick for your model and test it before it goes outside.
Ollama on an N150 mini PC, 16GB, no GPU, Open WebUI on top. Being honest, 1-3B models are fine for searching my offline Kiwix stuff and 8B works if you don’t mind waiting. I’m turning this into a small box (heyeddi.com/projects/doomsday-box) and I keep going back and forth on whether people even want AI on it, or just the media and offline archives. Would you?
I’m building almost exactly this as an N150 box, so take this with that bias. For photos, files and contacts, Immich plus Nextcloud on Debian will cover you, and an N-series board idles at a few watts. The part that bit me was updates breaking things, not the install. What’s your limit for maintenance, an hour a month?
I’m designing around an Intel N150, and this thread is the reason. These chips idle in single digits with an SSD, so most of the cost of running always-on goes away. The catch is the 16GB RAM ceiling on most boards, which caps how much local AI you can run on it. For the low-watt folks: what did you give up to get there, and was it worth it?
The layout I’m designing around is inline: ISP router, then a small dual-ethernet box doing firewall and DNS filtering, then your LAN. For a start, I’d put OPNsense on a cheap dual-NIC mini PC. You get network-wide blocking through a plugin and a VPN to reach your NAS, and VLANs can wait until you need them. I’m biased, since I’m building a box with that exact layout. What I can’t settle: for someone starting out, is an all-in-one box less scary, or does it hide the stuff you’d want to learn?
Calling it ad blocking undersells it. The ad network is the delivery path in that report, so blocking at DNS is a security layer, not tidiness. The thing I’m building goes a step further: it holds tracker connections open instead of refusing them, so they waste their own time instead of retrying instantly. Has anyone tried tarpitting at home? I’m curious whether it broke smart TVs or apps that phone home hard.
Yes, but the gift isn’t the hardware. It’s that it keeps working when you’re not around to fix it. So I’d go boring: plain Debian, Cockpit for storage and containers, and a WireGuard web UI. Before you hand it over, unplug the internet for a day and see what breaks. DNS usually goes first. I’m building an open-source home box around the same idea (GPLv3 once it ships), and your question is the one I keep chewing on: what makes a partner actually use it instead of just tolerating it?
I’m building toward exactly this, so take it with that bias. The cheap tier works if you lower expectations. An N150 mini PC with 16GB runs small models through Ollama fine, but 8B models are slow on that class of chip, and you’ll feel it on anything chat-shaped. Where it shines is async work: summarize this, tag that, answer when it’s ready. For phone access I’d keep it LAN-only and use WireGuard or Tailscale to get home rather than opening a port.
Disclosure: I’m working on a small open-source home box that bundles local AI with offline Wikipedia and media. What would make you trust a box like that over a setup you built yourself?
If nothing’s exposed and it’s all behind Netbird, you don’t strictly need it. I still would, because apps like Vaultwarden’s web vault won’t load without a secure context. A wildcard cert via DNS challenge is a one-time setup. Everything else is optional.