Why local first
You have a few realistic options for where your services live: the old laptop in your drawer, a small dedicated computer on your home network, or a rented virtual private server (VPS) in a datacenter. Start at home. It is cheaper, nothing is exposed to the public internet until you decide it is, and mistakes stay private while you learn.
- An old laptop or desktop — free, and the one most people already own. A built-in screen and battery (a crude UPS) are genuine advantages.
- Raspberry Pi 5 — cheap, silent, sips power. Perfect for DNS blocking and light services. Add an SSD; do not run from an SD card long-term.
- Mini-PC (Intel N100 class) — the sweet spot. Paperback-sized, near-silent, powerful enough to run everything in this guide at once.
- A VPS — when you need it reachable from anywhere with a stable IP. Come back to this once you have run things locally.
Pick the operating system it runs
The box needs an operating system. This choice shapes every command in this guide, so the tabs on each step match it. Choose based on the hardware you have — and be honest about the trade-offs.
The natural home for self-hosting: free, light, stable, and what almost all this software targets first. Install Debian (rock-stable) or Ubuntu Server LTS. Do a minimal install with just SSH selected — no desktop.
hostname: takeitback
user: you (not root)
This is the recommended path. If you're repurposing an old laptop, wiping it and installing Linux gives the longest, lightest life as a server.
A Mac mini or an old MacBook makes a genuinely good, quiet server, and macOS is Unix underneath so most tooling works. Install Homebrew — the package manager this guide will lean on throughout:
Then, in System Settings → General → Sharing, turn on Remote Login to enable SSH. Also set the Mac to never sleep while plugged in, or it won't answer at 3am.
Honest take: native Windows is the weakest base for these services, and faking PowerShell equivalents would send you down broken paths. The right move is WSL2 — a real, full Linux environment running inside Windows. You then follow the Linux tab for every step.
# reboot, set a username/password, and you're in a real Ubuntu shell
For anything containerized later, install Docker Desktop, which uses this same WSL2 engine. From here on, use the Linux commands inside your WSL2 shell.
Lock down remote access (SSH)
SSH is how you'll control this box without a monitor attached. Out of the box it may accept passwords, which bots hammer relentlessly. Switch to key-based login. First, on the computer you'll connect from, create a key and copy it to the box:
you@laptop:~$ ssh-copy-id you@192.168.1.50
Then on the box, edit /etc/ssh/sshd_config so these read exactly, and restart:
PasswordAuthentication no
root@box:~$ sudo systemctl restart ssh
Same keys, same idea — macOS ships the identical OpenSSH tools:
you@mac:~$ ssh-copy-id you@192.168.1.50
Harden the same /etc/ssh/sshd_config lines, then reload the service:
Work inside your WSL2 shell (or PowerShell — both ship OpenSSH now):
$ ssh-copy-id you@192.168.1.50
# powershell has no ssh-copy-id; append the key to the box's
# ~/.ssh/authorized_keys by hand, or run this from WSL2
The hardening happens on the box, so it follows the box's OS tab — not Windows.
Keep it patched
A server you never update is a liability. Turn on automatic security updates so it happens without you thinking about it.
root@box:~$ sudo dpkg-reconfigure unattended-upgrades
# keep Homebrew packages current too:
you@mac:~$ brew update && brew upgrade
Windows Update handles the host automatically. Keep your Linux environment current inside WSL2:
Before you move on
- OS installed, fixed local IP assigned (DHCP reservation in your router)
- Key-based SSH working; passwords and root login disabled
- You confirmed a second login works
- Automatic security updates enabled
That's the foundation. Next we make this box quiet the entire network.