Get Jellyfin off the open internet. For family who’ll never install a VPN app, the setup that holds up is WireGuard on their router, or Tailscale on whatever TV box they use, set up before it ever ships to them. They never see it. If something has to stay public, CrowdSec plus Pocket-ID is a lot lighter than Authentik for three users. I’m building a home box that ships locked down like this by default, so I’m curious: which broke first for your family, remote access or the logins?

I went the other way this week. Nothing public anymore, and the only thing open on the WAN is the WireGuard port. I lost the easy Jellyfin share links for family and gained sleep. The PHP mess made the call easy.

Boring plan is the right plan. One shed-specific thing: Intel Mac minis on Linux won’t power back on after an outage by default, and there’s no BIOS toggle. Look up the setpci trick for your model and test it before it goes outside.

I’m building almost exactly this as an N150 box, so take this with that bias. For photos, files and contacts, Immich plus Nextcloud on Debian will cover you, and an N-series board idles at a few watts. The part that bit me was updates breaking things, not the install. What’s your limit for maintenance, an hour a month?

I’m designing around an Intel N150, and this thread is the reason. These chips idle in single digits with an SSD, so most of the cost of running always-on goes away. The catch is the 16GB RAM ceiling on most boards, which caps how much local AI you can run on it. For the low-watt folks: what did you give up to get there, and was it worth it?

Calling it ad blocking undersells it. The ad network is the delivery path in that report, so blocking at DNS is a security layer, not tidiness. The thing I’m building goes a step further: it holds tracker connections open instead of refusing them, so they waste their own time instead of retrying instantly. Has anyone tried tarpitting at home? I’m curious whether it broke smart TVs or apps that phone home hard.

Yes, but the gift isn’t the hardware. It’s that it keeps working when you’re not around to fix it. So I’d go boring: plain Debian, Cockpit for storage and containers, and a WireGuard web UI. Before you hand it over, unplug the internet for a day and see what breaks. DNS usually goes first. I’m building an open-source home box around the same idea (GPLv3 once it ships), and your question is the one I keep chewing on: what makes a partner actually use it instead of just tolerating it?