Starting Your Homelab: From Raspberry Pi to Self-Hosted Services
Starting a homelab is less about buying the biggest hardware and more about building a system you understand. This guide is adapted from my 2025 Starting Your Homelab presentation for Hou.Sec.Con, now known as Cybr.Sec.Con.
There are many valid ways to build a homelab. The steps here describe a practical path that has worked for me, not the only correct architecture.
Download the original PowerPoint presentation
Why build a homelab?
Self-hosting is a way to become more invested in the services you use every day. It provides a hands-on environment for learning Linux, networking, identity, containers, certificates, and operational troubleshooting.
It also creates an opportunity to reduce dependence on services whose policies, pricing, or data practices can change without warning. The tradeoff is responsibility: a self-hosted service still needs updates, backups, access controls, monitoring, and a recovery plan.
Start with accounts and identity
Before installing software, establish a few separate identities and recovery paths:
- Use a new email address for homelab administration and recovery.
- Store credentials in a password manager and enable multifactor authentication.
- Create a separate Tailscale identity for the lab rather than sharing personal credentials.
- Keep recovery codes offline or in another protected location.
- Treat GitHub, DNS, email, and certificate-provider accounts as part of the security boundary.
Tailscale can use an external identity provider such as Google, Microsoft, Apple, Okta, or another OpenID Connect provider. Whichever option you choose, make sure you can recover the account before making it the only way into your network.
Choose a starting platform
The first host can be modest:
- Raspberry Pi 3 with a powered external drive
- Raspberry Pi 4 with an NVMe drive and enclosure
- An older PC with more memory and storage
- A cloud VPS for services that need public availability
For a Raspberry Pi, use Raspberry Pi Imager to install Raspberry Pi OS Lite 64-bit when a headless system is the goal. Before writing the media, configure the hostname, username, password, Wi-Fi details, country, timezone, and SSH access. A small HDMI capture device or spare monitor can help when remote access is not working, but SSH is usually the more convenient interface.
Complete the initial Debian setup
Connect directly or over SSH and update the operating system:
sudo apt update
sudo apt upgrade -y
Networking problems are common during first setup. If the host needs a static address, inspect the connection names first:
sudo nmcli connection
Then modify the connection using its actual name. A typical configuration might use an address outside the router’s DHCP range, the home router as the gateway, and either a local DNS resolver or a public resolver:
sudo nmcli connection modify "Wired connection 1" \
ipv4.method manual \
ipv4.addresses 192.168.1.10/24 \
ipv4.gateway 192.168.1.1 \
ipv4.dns "1.1.1.1 8.8.8.8"
The connection name, address range, gateway, and DNS servers must match your network. Do not copy these values blindly.
Add a private network with Tailscale
Tailscale provides a mesh VPN built on WireGuard. It allows devices and services to communicate securely across networks without exposing every service directly to the public internet.
Follow the official Debian installation guide, then use the Tailscale admin console to confirm that the new host appears and is using the expected identity.
Split DNS can make internal names resolve through the right DNS server while ordinary internet lookups continue to use their normal path. It is especially useful when the same homelab services need stable names from multiple devices.
Use DuckDNS for a manageable name
DuckDNS provides a free dynamic DNS name that can point to a changing address. In a Tailscale-first setup, use the host’s Tailscale address where the service requires an internal destination. Be deliberate about which records are public and which are only intended for your private network.
Install Docker carefully
Docker makes it easier to run applications as isolated, repeatable services. Containers are not virtual machines: they share the host kernel, can be networked together, and need deliberate persistent storage.
Install Docker by following the official Debian instructions. After installation, verify that the engine works before adding a platform:
sudo docker run hello-world
Plan storage before deploying applications. Databases, uploads, configuration, and backups should live in known persistent locations rather than disappearing with a container recreation.
Choose a management platform
There are many homelab platforms. The presentation focuses on Cosmos Cloud, with CasaOS as another option to consider. The important part is understanding what the platform manages for you and what remains your responsibility.
The Cosmos installer documented in the presentation is:
curl -fsSL https://cosmos-cloud.io/get.sh | sudo -E bash -s
Review an installation script before piping it to a shell, and use the project’s current documentation if the command or release process changes.
After installation, configure Cosmos through the host’s Tailscale address. Choose a clean install when appropriate, then configure Docker, the database, and the administrator account. Keep the admin credentials in the password manager created earlier.
Configure HTTPS with Let’s Encrypt
The general certificate flow is:
- Create the DuckDNS name.
- Add the relevant split DNS entry in Tailscale.
- In Cosmos, enter the hostname and choose automatic Let’s Encrypt certificates.
- Provide the Let’s Encrypt email address.
- Choose DuckDNS as the DNS provider.
- Create the DNS challenge and provide the DuckDNS token.
- Enable a wildcard certificate only when it matches the services you intend to run.
The DNS challenge lets Let’s Encrypt verify control of the name before issuing a signed certificate. Keep the DuckDNS token secret; it grants access to your DNS account and should never be published in a post, screenshot, repository, or log.
Troubleshooting: be patient with DNS
Certificate issuance and DNS updates are not always immediate. If the hostname does not work:
- Confirm that the name resolves to the expected Tailscale address.
- Try the hostname over HTTP and HTTPS as appropriate for the current setup.
- Check the service status and logs.
- Restart the service only after checking the configuration.
For the service name used in the presentation, the troubleshooting commands were:
sudo systemctl status CosmosCloud
sudo systemctl restart CosmosCloud
The exact unit name may differ by release. If the service is listening on port 80, the certificate step may not have completed. Give DNS and certificate challenges time to settle before repeatedly changing working configuration.
What comes next?
Once the base platform is stable, add applications one at a time. The Awesome Cosmos Cloud, Awesome Selfhosted, and selfh.st apps directories are useful places to discover projects.
Every new service should have a purpose, a storage plan, an update path, and a backup strategy. That discipline is the difference between a collection of containers and a homelab you can maintain.