Getting Started with Self-Hosting on Raspberry Pi

Session notes — covers the why, the networking problem, hands-on setup, and a tour of popular self-hostable services.

1. Why Self-Host?

• Own your data instead of trusting a third-party SaaS company with it.
• Cost savings over time — a one-time Pi purchase vs. recurring subscriptions.
• Learning value — this is how real infrastructure actually works: networking, containers, DNS, reverse proxies.

2. Self-Hosting Fundamentals

• Self-hosting = your hardware + your OS + your services, instead of someone else’s cloud.
• Client-server basics: ports, and why “works on localhost but not from my phone” is the #1 beginner confusion.
• Docker / containers are the standard way modern self-hosted apps are packaged. Most projects ship a docker-compose.yml — learn this and you can deploy almost anything.
• Extra: Docker installation script
• The core problem: how does the outside world reach a device sitting behind your home router with no public IP, or behind CGNAT? This is the bridge into networking.

3. The Networking Problem

Traditional approach: Port Forwarding

• Forward a port on your router to your Pi’s local IP.
• Downsides: opens attack surface directly to your home network, breaks with dynamic IPs, and many ISPs (especially in India) block inbound traffic entirely via CGNAT — so this often doesn’t even work.

Two modern solutions — they solve different problems

Simple decision framework:

Private & personal → Tailscale. Public & shared → Cloudflare Tunnel.

Bonus / newer feature — Tailscale Funnel: lets you expose a service publicly directly through Tailscale, no Cloudflare or domain needed:

tailscale funnel 443 on

Blurs the “private vs public” line a bit — good for quick demos without owning a domain.

4. Hands-On Setup

1. Flash Raspberry Pi OS Lite (headless), enable SSH during imaging.
2. Install Tailscale, join the same tailnet, test SSH/ping between devices:

   curl -fsSL https://tailscale.com/install.sh | sh
   tailscale up
   

3. Install cloudflared, create a tunnel, set up the DNS CNAME, and route a local service via config.yml.
4. Install Docker + docker-compose on the Pi.

Note: Cloudflare Tunnel setup needs a domain + Cloudflare account per person, so it’s often easier as a pre-recorded/pre-done walkthrough in a live workshop rather than something everyone does hands-on. Tailscale is much lower-friction — just needs a free account.

5. Famous Self-Hostable Services

Password / secrets

• Vaultwarden (self-hosted Bitwarden-compatible vault)

Media

• Jellyfin
• Sonarr / Radarr (the “*arr stack”)
• Immich — self-hosted Google Photos alternative with on-device face/object recognition. Great demo: upload a few photos, watch it cluster faces. Strong answer to “why bother self-hosting instead of the cloud.”

Dashboards

• Homepage
• Homarr

Files / sync

• Nextcloud
• Syncthing

Notes / knowledge

• Trilium
• Outline

Monitoring

• Uptime Kuma — fast to deploy, visually satisfying, ties in nicely as “monitor the very Pi we just tunneled.”

Networking / DNS

• Pi-hole — often the very first self-hosted service people run. Network-wide ad blocking at the DNS level, easy and satisfying to demo.

Smart home

• Home Assistant

Container maintenance

• Watchtower — auto-updates your Docker containers.

6. Pi-Specific Reliability Notes

These matter specifically because it’s a Pi, not just “self-hosting in general”:

• SD card vs USB/NVMe boot — SD card corruption from unclean shutdowns or write wear (logs, databases) is the #1 cause of self-hosted Pi setups dying. Consider booting from a USB SSD, or NVMe via a HAT on Pi 5.
• Power — undervoltage causing random reboots is a classic mystery bug. Use a proper PSU; consider a PoE HAT to avoid needing a separate outlet near the router.
• Backups — a restic or rsync cron job to another disk/cloud. Self-hosting without backups is a time bomb.

7. Security Reminders

• Don’t skip updates.
• Never expose admin panels without authentication.
• Look into Tailscale ACLs if you want tighter access control.

8. Where to Go Next

• Awesome-Selfhosted — huge curated list, good rabbit hole.
• Reverse proxies (Nginx / Caddy / Traefik) — natural next topic once you’re running multiple services behind Cloudflare Tunnel.
• k3s on multiple Pis — lightweight Kubernetes; popular specifically because Pis are cheap enough to cluster. A good “how far this rabbit hole goes” closing thought.