For context: I have 0 programming, coding, etc. related knowledge.
For some months I’ve been dedicating time into setting up a Homelab that hosts music, movies, maybe home security (Frigate, I suppose), minecraft servers (or maybe other games too) and maaaaybe local AIs (if I get a better system), in that order, from more to less important. Some of the caractheristics that I prioritize are: privacy first, Zero third-party exposure, disk data encryption, self-hosting, FOSS priority perspective, trying not to compromise in any way my home network-using devices through all the process. Since, as I said, I have 0 programing or even Linux experience, I’ve done all this process guided by a local ran AI (Qwen 3.6), YouTube videos and forums (not the perfect formula for a cybersecurity safe environment, I know).
In an old laptop (Acer Aspire ES15-… with AMD A6-6310 / 16GB RAM) I’ve installed Linux Debian Trixie 13 (GNOME) with Docker and CasaOS with Jellyfin (for movies, it worked), Navidrome (for music, also worked) and recently Netbird, this one to connect into the local network from outside my home net, which kinda worked, but not as I expected it to work.
And this is where I feel I’m stuck. My main absolute priority the whole time setting this all up was being able to stream music from my homelab in my phone from everywhere in the world as long as I had internet connection, but when I managed to achieve that connection after soooo many hours and even stream music from my phone only with mobile data, it needed like 1 minute to load 3 seconds of a song, so it’s not enough at all. After seeing this, I’ve reseted all netbird data so I can do a clean install.
I need help with the process of setting this (I believe it’s a VPN) up in a way that it is Self-hosted, secure and fast enough so I can make it all achieve my expectations. Any video, forum thread or personal recomendation that you can give me will be so much appreciated.
Summarizing it a little, this is what I was trying to achieve:
CasaOS Architecture: Netbird (FOSS WireGuard mesh) + (maybe) Caddy Reverse Proxy + (maybe) Internal PKI + (maybe) LUKS Encryption Security Model: Zero port forwarding, outbound-only private tunnels, device-by-device approval, end-to-end HTTPS, full data-at-rest encryption.
Let me know if I’m missing any important information and I will do my best to share it.
Thank you so so much in advance!!
I have a similar use-case.
What I did for the VPN was to use Wireguard. I configured it using wg-easy, and it’s, well, very easy. What your need to do is:
- Install wg-easy via Docker.
- Configure it and create a profile.
- Open ports in your router to allow port-forwarding the Wireguard tunnel.
- (Optional). Install a Wireguard client on your cellphone. I use “WG Tunnel”, a FOSS client. Note that the author of the app is a bit of a religious nut, If you care about that kind of stuff.
- Scan the profile QR generated in wg-easy on your WG Tunnel.
- Increase the “PersistentKeepalive” parameter to something like 30 seconds in WG Tunnel. This will increase the tunnel’s resiliance to disconnections due to small packet losses; without that, Jellyfin/Navidrome will constantly disconnect.
- Open Navidrome/Jellyfin, and done :)
Let me know If you have any questions, glad to help.
I mean my only comment would be that starting off with zero third party exposure is probably starting with a higher level of difficulty. Id recommend picking popular solutions (so there’s lots of guides / videos) and then over time as you build skill set around problem solving / maintenance etc you can move to more fully self hosted services ?
Maybe a really stupid question these days but…what upload speed do you have? Depending on the encoding of the music (e.g. FLAC) it might just be too much for your internet connection 😅
It would help to know how you setup the Netbird ports to be available on the internet too.
You could - for debugging - use the Netbird SaaS server (I believe there’s a free tier and Netbird being a German startup, I would at least assume, data privacy for the debugging shouldn’t be a big concern 😅 Germans don’t tell their granny their own name if they’re not legally allowed to 😂).
Just use Tailscale for your VPN. If you want to be 100% FOSS self hosted, set up Headscale as your control server somewhere. It’s simple, secure, and has excellent performance.
EDIT: And also check what your upload speed is from your server. It sounds like you’re running off your home internet connection and many ISPs have terrible upload speeds, particularly for sustained traffic.
+1 on tailscale. It’s really easy to set up, and that’s exactly how I’m connecting my phone to navidrome in my home lab.
Only issues I ran into were to turn off tailscale DNS because it was messing with my phone’s general Internet connection while away from home.
Isn’t CasaOS deprecated now and replaced with ZimaOS? Also, does that mean you’re running it in something like Gnome Boxes? Because from what I remember CasaOS was customized Debian
I’ve never used CasaOS, so I can’t help you with that, but I run NetBird for remote access to my homelab. What you’re describing sounds to me like an issue I used to have with Tailscale.
I think NetBird might be trying to route your traffic through a STUN/TURN server to get around a NAT or firewall. A NAT (in case you haven’t heard of it) is a sort of “mapping” from one IPv4 address to many IPv4 addresses. Its used to "make more "addresses, otherwise we would have run out decades ago. (this is a simplification, its actually much more complicated)
The first thing to check here is: Are you behind a CG-NAT? (there’s probably some websites to check this)
If yes, then there is little you can do without setting up a VPS to get around it.
If that’s not it, then you’ll have to figure out how CasaOS handles networking internally. Your services might be behind a NAT inside.
As for ressources/information, I mostly stuck to the official docs.
Honestly if you use Claude just tell it to set it up for you. I have a truenas server running on a cheap $500 dell office PC that I got from Best Buy and it hosts pihole and a ton of other services like a password manager and Nginx etc… I just use the truenas mcp and give my agent access to stuff and let it manage it for me. I’ve been a software engineer for 7 years now and I still hate managing it myself. Ever since I realized I could just use ai to do it for me it’s been a major burden lifted. It’s no longer a hassle for me to manage it.
Honestly if you use Claude just tell it to set it up for you.
Not the point of a homelab and additionally very dangerous as Claude tends to like insecure configurations.
Check the Netbird relay setting and try toggling it. I recall some people mentioning it defaults to something that can cause slow connections.
Sounds ambitious! Good for you for diving right in.
I’m no expert but I would look at your home internet speeds/capabilities. Most home packages are optimized for download, and if you are self-hosting a streaming server you may a differently provisioned service to support that. If the download to upload ratio is heavily tilted towards download then I would look there first. It sounds like you are able to stream outside your home network, just slowly.
Everything else is waaay beyond me in terms of establishing a secure perimeter and allowing in only desired traffic. I self host a few servers on proxmox, but it’s strictly limited to my home network.
I’ve never used Netbird or casaOS. I run debian and docker containers. I would recommend looking at wg-easy as a VPN. it also uses wireguard but for me it just works. you open 1 port on UDP and route it to wireguard, it’s a secure way to access your network and is quite hard to detect from the outside.
I’ve heard good things about caddy.
“data at rest/LUKS” is something you should consider if your personally worried about someone physically trying to get information off your computer/server. if the server is running or an attacker gets into your system remotely, it doesn’t matter. as a beginner, I would determine if the data your saving is worth the extra headache of encrypted media, especially if something goes wrong/an update breaks something or your configs/setup messes something up. if you do, keep a copy of your decryption keys on a NEW USB drive (flash drives go bad) or printed out in addition to saved on your workstation/laptop/password manager.
Personally for new systems I recommend Proxmox hypervisor instead of running directly on the laptop. having your debian OS/casa or whatever you use virtualized gives you the ability to take snapshots in time of your OS, makes backups easier and can help when you expand later (backup and restore on the new computer running proxmox). mine is: proxmox on bare metal old office PC
- | debian > docker w/ portainer (I plan to replace portainer w/ komono)
- | TrueNAS > S3 bucket application (garage)
if Casa becomes limiting as you learn and grow, I would recommend docker compose stacks w/ a web gui like komono.
one final note, although AI can be very useful for troubleshooting and getting some code to fix a problem (albiet logic/problem solving isn’t their strength) it’s awful for retaining knowledge and learning in the same way that using a calculator or other tool before fully understanding how to do addition/multiplication manually. I would strongly recommend taking some time to learn the basics without ai if your goal is to understand how everything works. resources to start with are using and reading “man + command”, command help flags, online courses and websites: https://linuxbasecamp.com/ https://explainshell.com/ - copy paste a command with all arguments and it tells you what it does. https://training.linuxfoundation.org/training/introduction-to-linux/