The home anchor: a small computer that's always there

The tunnel from the last part needs something at the home end that’s always on. My phone and laptop dial in when they’re around, but they come and go — and the whole design depends on there being a permanent, reliable presence at home that’s always reachable through the hub. That presence is a small, low-power computer sitting quietly on the home network. This part is about that machine: why it’s a tiny dedicated box rather than the obvious alternatives, and the decisions that made it dependable enough to trust as the anchor for everything else.

Choosing the hardware

There were a few candidates for the home end of the tunnel, and working through them is most of the story.

The home router was out for the reasons covered last part — I wanted it left alone. The next candidate was a machine I already owned: an old laptop I’d since converted to Linux and used as a tinkering box. On paper, reusing it costs nothing. In practice it was the wrong choice for an always-on anchor. It’s a decade-old machine with a tired battery, and something meant to run continuously, year-round, wants to draw as little power as possible and have no aging battery in the loop. An old laptop left on permanently is more heat, more electricity, and more things that can fail than the job warrants.

That pointed at a small single-board computer — the low-power kind that draws a few watts, makes no noise, and can run untouched for months. I settled on a Raspberry Pi 5. I also weighed a small mini PC, which is more capable. The honest accounting surprised me a little: once I added a proper case and a solid-state drive to the single-board computer, the cost crept up close to what a basic mini PC would have been. What settled it was power. The single-board computer draws a fraction of what even a small mini PC does at idle, and for a device that’s on every hour of every day, that idle draw is the number that matters — it’s the one I pay for continuously. Factoring in the other things I wanted this box to grow into over time, the low-power option was the better long-term fit even though it wasn’t the cheapest once fully kitted out. I went with the small board, eyes open about the trade.

The case earns its place

The one part of the hardware I’ll single out is the case, because it’s doing more than holding the board. I chose one with active cooling — a proper fan and a metal enclosure that acts as a heatsink — rather than a bare board or a passive case.

For a machine that’s meant to run continuously and eventually take on more work, heat is the enemy of longevity. A board that runs hot throttles itself and ages faster; keeping it cool keeps it both fast and long-lived. The case runs its fan only when temperature calls for it and stays silent at idle, so the cooling costs nothing in noise most of the time. It also adds a safe power button — a proper shutdown rather than pulling the plug, which matters for a box that isn’t sitting on my desk — and keeps the board’s expansion header accessible for whatever later projects want it. For a few dollars more than a plain enclosure, it turns the board into something built to run hard for years, which is exactly what an always-on anchor needs to be.

Getting it off the memory card

Small computers like this usually boot from a memory card, and that’s fine to start with — but a memory card is the least reliable part of the machine. They wear out with repeated writes and tend to fail without warning, which is precisely the wrong failure mode for something whose entire value is being dependably up.

So one of the first things I did was move the system off the memory card onto a proper NVMe solid-state drive fitted inside the case. The machine now boots and runs from the faster, far more durable drive, and the memory card stays in its slot as a fallback — if the drive ever fails, I can fall back to the card rather than being dead in the water.

The move itself taught a small lesson. The obvious purpose-built tool for cloning the system across refused to work, tripped up by how the new drive named its partitions. Rather than fight it, I copied the system over with a plain general-purpose file-copy tool, then pointed the boot configuration at the new drive by its unique identifier and told the machine to prefer it. It worked on the first try. The lesson was a familiar one: when the specialised tool balks at an edge case, the plain, well-understood method underneath it often just works — and you understand exactly what it did, which matters when the thing you’re setting up is meant to be reliable.

Connected, but not in charge

The anchor holds its link to the hub continuously and brings it back automatically after any reboot, so it recovers from a power blip or an update on its own without me needing to be there. That auto-reconnect is what makes it trustworthy as the permanent home end — it doesn’t depend on me noticing it dropped.

The more important decision is what the tunnel doesn’t do to it. The anchor sends only the traffic that belongs on the tunnel through the tunnel; everything else — its own general internet access — goes out the normal way, directly. That split matters for reliability: if the hub is ever down for maintenance, the anchor doesn’t lose its internet connection along with the tunnel. It keeps working locally, keeps its own connectivity, and simply re-establishes the tunnel when the hub returns. The tunnel is something the anchor participates in, not something it depends on to function.

This is the same principle as keeping the router out of the VPN, applied one level in: the anchor is genuinely independent. Nothing about the household’s normal operation rides on it, and nothing about its own operation rides on the tunnel being up. That independence is deliberate — an always-on device becomes a liability the moment the rest of your setup can’t function without it, so I made sure it never became that.

What it’s there to carry

On its own, the anchor is just a small computer holding a tunnel connection. Its value is in what it lets me run at home — services that live behind the tunnel, reachable by my devices from anywhere but never exposed to the internet.

That’s the pattern the rest of the series follows: with a reliable, always-present home box on the tunnel, I can put private services on it one at a time, and each becomes reachable from anywhere I am without opening a single door in the home network. The next parts are those services — starting with the one that quietly runs on every device I own, all day, and was the reason the tunnel became something I leave on rather than something I switch on.