Build journal
Build Journal
A self-hosted home network — a small VPS, a VPN, and a Raspberry Pi — built one piece at a time, with the reasoning and the mistakes left in. A high-level design overview of what I built and why, rather than a how-to: no configuration steps, and no product or vendor recommendations — just the reasoning, and what I’d do differently. Ten parts, meant to be read in order, from the first sketch of the idea to the alarm that prompted the whole thing.
Part 1
The idea
A self-hosted home network built one piece at a time — why these specific pieces, what the VPN and CGNAT problems are, and what the alternatives were.
Part 2
Choosing the box and name
Renting an unmanaged VPS and deciding whether to put a domain in front of it — provider, plan sizing, OS choice, and registering the name.
Part 3
Taking control
The first SSH login, locking the box down, and finding it was already under constant automated attack — with the hardening pass that followed.
Part 4
The speed test
The service the whole build was for: over-built at first, cut back to something small, undone by a silent failure, and finally moved off the public web to a private tool behind the tunnel.
Part 5
The tunnel
The VPN hub the whole build turns on — how it's shaped, why every device dials out to it instead of the other way around, and the small lessons that only showed up once it was running.
Part 6
The home anchor
The always-on end of the tunnel — why a tiny low-power computer rather than the router, moving it off its memory card for reliability, and how it stays connected without holding the household hostage.
Part 7
DNS & ad-blocking
The first service on the home anchor: network-wide ad and tracker blocking, scoped to the tunnel on purpose so it follows every device onto any network — and so the home box can never break the household's internet.
Part 8
File sharing
Turning the home anchor into shared storage for my own devices — proving the idea on a scrap drive before buying the right one, and a quiet bug that served an empty folder after every power cut until I understood why.
Part 9
Monitoring & alerts
Giving the setup a sense of its own health: dashboards for what's normal, a phone alert the moment something isn't, and the night an alert caught a problem that turned out not to be mine at all.
Part 10
The alarm
The problem that started everything, finally solved: reaching the home alarm from anywhere with no way in from the public internet — and the security trap I walked into on the way, where the rule looked locked down and wasn't.