Self-Hosting on an Old ThinkPad
A week ago I had a ThinkPad T440s in a drawer and a phone backup that did not fit anywhere. Today that laptop is the house DNS server, a torrent box, a private search engine, a password manager, and a sync target for my Mac, and I can reach all of it from anywhere without opening a single port. This is the short version of why self-hosting is worth the trouble.
It started with a backup
macOS cannot read btrfs, so a 4 TB drive formatted for Linux is useless plugged into a Mac. The ThinkPad handles it natively, and one rsync command later the backup problem was solved:
rsync -avP /path/to/PhoneBackup/ nixbox:/mnt/backup/PhoneBackup/
If the connection drops, rerun it. It picks up where it left off. That was the whole plan. Then the laptop was already on, so why not give it more to do.
A laptop is a server with a built-in UPS
Power here cuts out on a schedule, a few times a day, and the longest outage runs through the night. A desktop would need a UPS. A laptop has two batteries. I measured the real draw by forcing the machine onto battery with the charger still plugged in:
| State | Draw | Runtime on both batteries |
|---|---|---|
| Idle, bare | 4.2 W | about 7.4 h |
| All services running | 4.7 W | 6.6 h |
Both batteries are worn, one at 49 percent of design, and it still clears the longest gap. Lid closed, sleep masked, backlight off. It just sits there.
The house stops seeing ads
AdGuard Home is one Go binary. The router hands out the laptop as DNS, lookups leave the house encrypted to Quad9 and Cloudflare, and 2.8 million rules block the rest:
dig @192.168.18.7 doubleclick.net +short
0.0.0.0
Every phone, TV, and laptop in the house gets this for free, no extensions, no per-device setup. It also means the box is now critical infrastructure. When it goes down, the internet goes down, which is a strong incentive to do everything else properly.
No port forwarding, ever
The line is behind carrier-grade NAT, so nothing from the internet can reach the router even if I wanted it to. Tailscale builds the tunnel outbound from both ends and the problem disappears. One line opens the whole interface:
sudo ufw allow in on tailscale0
Every web UI binds to localhost and Tailscale Serve puts HTTPS in front of it, one port per service, with a Homer landing page tying them together. Nothing is reachable from the internet. The tailnet is my two devices and that is it.
Native installs, one unit each
The box runs a minimal Debian trixie install, nothing but sshd and a shell until I added what I needed. Every service is a Debian package or upstream installer, one systemd unit, one config file. journalctl -u shows everything and apt keeps it patched. Docker only came in for Vaultwarden, because a database-backed app is where containers earn their keep, and even then the first step was moving the data root off the tiny /var partition:
printf '{\n "data-root": "/srv/docker"\n}\n' | sudo tee /etc/docker/daemon.json
Six services do not need an orchestrator. The wiki I kept while doing this is the reproducibility story, and a nightly tarball of every hand-edited config syncs to the Mac so a rebuild is a restore, not an afternoon of retyping.
Things break, and that is the fun part
On day two the box vanished from the network for 23 minutes during a power cut. The ethernet chip had gone into runtime power saving on battery, woke on a link change, and never renegotiated. The fix was a TLP denylist plus a udev rule that pins the chip on:
ACTION=="add", SUBSYSTEM=="net", KERNEL=="enp0s25", RUN+="/bin/sh -c 'echo on > /sys/class/net/enp0s25/device/power/control'"
Plus a one-minute watchdog that bounces the port if the carrier has been gone for 30 seconds, because the house DNS must not stay dead. I now understand my laptop’s NIC better than I ever wanted to, and that is the point.
Why bother
Because the cloud services this replaces are someone else’s computer with someone else’s rules. Search queries stay on my network. Passwords sit in a database I back up nightly with an integrity check. The torrent folder is a Samba share in Finder. Metrics from this box and my cloud servers land on one dashboard. All of it on hardware I already owned, drawing less than a lightbulb, and documented well enough that future me can rebuild it.
If you have an old laptop, it is a better home server than you think.