Overview
Rather than relying on cloud subscriptions for media and services, I built a home server from scratch running Ubuntu Linux. Everything is containerized with Docker for clean isolation and easy updates. The server sits on my local network but its services are publicly accessible through a hardened cloud VPS — no port-forwarding my home IP, no dynamic DNS hacks.
What I built
- Docker stack: Four containerized services running continuously — including Jellyfin for media, Overseerr for requests, and this portfolio site itself. Each service is isolated and managed via docker-compose.
- WireGuard VPN tunnel: A WireGuard tunnel connects the home server to a cloud VPS (Iceland). Traffic for public-facing services enters the VPS and routes through the tunnel to the server — the home IP is never exposed.
- Nginx reverse proxy: Nginx on the VPS routes subdomains of trumanbreithaupt.com to the appropriate containers, handling SSL termination via Let's Encrypt.
- Pi-hole DNS filtering: Network-wide ad and tracker blocking for all devices on the LAN, with custom DNS records for internal hostnames.
- Tailscale: Secure remote access to the home network from any device without opening additional ports.
Outcome
The server has been running continuously since setup with no major outages. This project forced me to get comfortable with Linux networking, firewall rules, systemd, and the broader ecosystem of self-hosting — skills that carry directly into any infrastructure or embedded engineering role.
The portfolio site you're reading right now is served from this setup.