Building the Ultimate Privacy Home Server

0:00 The year is 2031. Peace with Iran is imminent. Elections as we knew them are outlawed. The benevolent world rulers instead use your cloud data to cleverly anticipate your voting intentions and select those eligible for re-education. But you remember watching a video by the RAD lectures which taught you how to build your own sovereign private home server. You are exempt from this dystopia. All is not lost. Today, we take back control of our digital lives. In the last few years, there has been countless high-profile data breaches. In France, practically every citizen had their personal data exposed. In the United States, they saw what they deemed to be the most serious cyber security incident in their history. In Australia, even highly protected boomer class saw attacks on their pension funds known as superanuation funds. But it's not just the western countries. India saw what is most likely the largest breach of personal data in human history. The desire to take back control of our digital lives, to escape digital slavery and subscription hell has never been more reasonable than ever before. Now, the good news is that it's never been easier to take back control of our digital lives with all of the great free and open source projects and also the fact that hardware, which is highly capable, although considered dated, is readily available and is cheap. If you're anything like me, then you have all of your data out there on the internet already. You've been using cloud providers, even though you knew that you shouldn't, but it was convenient. And like they say, the best time to plant a tree was 20 years ago, and the second best time is today. So, with that being said, let's get into it.

1:58 In this video, we're going to be using free and open-source alternatives to things like Google and Apple Photos, cloud storage providers, password managers like Bit Warden. We're going to be self-hosting our passwords, and we're going to be doing this on our own Linux private home server. The goal here is not to outperform Google's security team. I'll be the first to admit that a poorly managed or administered home server or self-hosted cloud is much worse than just using most cloud products. Okay. The point here is to regain sovereignty is to educate and show what's possible using your own hardware, your own old laptop and free and open source projects. Now, just a word on the threat model. We're not thinking about state actors. So, we're concerned with opportunistic data breaches with theft. If the device gets stolen, we want the data to be encrypted and we don't want people snooping as well. And importantly, it needs to be practical. Whether you're in a cafe in Hanoi or you're hiking in Machu Picchu, you need to be able to access the data which is on your cloud server. So, it needs to be highly available and accessible from anywhere. Obviously, it needs to adhere to security principles so that not everyone can access it. But if this guide is not super easy and the implementation is not usable, then no one's going to use it. The difference is that the infrastructure belongs to us.

3:26 Now, essentially, you can use any laptop. Any old laptop, any old computer will do. I'm using this old laptop motherboard. It's got an eighth generation quadcore processor. And I've scraped together some RAM. I've got 16 gig of RAM, a few unused SSDs and a heat sink, a charging cable, and a keyboard. That's it. In my case, I've got no peripheral microphone or camera. That's a good thing. I don't even have a screen. But if you do have a screen, if you got a full laptop, that's handy because having a screen and a keyboard, you can actually access it when you need to. So, all in, I'm at about $200, $250 because I had a few parts around. It was probably a little bit less than that.

4:10 And of course, like I said, any laptop will work. And one of the great things about laptop is that they're designed to run with power efficiency in mind. So, this one runs at 15 W. And while at idle, it only draws 7 to 8 W, which in the middle of a global energy crisis is an added benefit. Laptops also have built-in batteries, which means they sort of act as a mini USB or uninterruptible power supply. Now, aside from the electricity bill, which should be negligible with this kind of system, the only thing that you need to pay for is the parts and thereafter there's no subscriptions. I'm not going to refer you to any third parties who are going to charge you on a monthly basis. That's it. Now, if you're familiar with the GNU Linux ecosystem or you're just getting started with it, you'll often hear that Debian is one of the OGs of the Linux world. And especially when it comes to servers, people often recommend Debian because it is so stable and it certainly is a good Linux distribution. In this video though, I'm going to be using DevO. All it does is it builds on Debian. But as a lot of my esteemed audience keep telling me, there are intelligence agencies using systemd the init system that's on most GNU Linux distribution as a backdoor. Now, I don't know if that's true or not, but I do know that systemd has a massive attack surface. It is estimated that across the whole project, there's more than a million lines of code. And I do scratch my head at how it has so many lines of code. Nevertheless, DevOwan differentiates itself from Debian in that it allows you to choose a different init system. Now, in my case, I'm using OpenRC. Open RC is just a dependencybased init system and it just does what it says. It is an initialization system. Now, no serious technologist leaves their system unencrypted. So, I've encrypted it with Lux, which is the standard for GNO Linux systems. Each of the SSDs is encrypted at rest. Meaning, if the power is cut or someone steals a laptop and it is powered off, they will need the passphrase for each of the devices to unlock them. Okay, so we've got Linux installed and we've encrypted the device, but now we need to access it from anywhere, right? So, we need to set a few things up. We can go to our BIOS, the basic input output system or the UEFI, that unified extensible firmware interface. Basically, that's just that graphical user interface which you go to when you start the machine. You can hit F1 or F12 or whatever it is on your machine. Go in there. And the first thing I'm going to do, I'm going to do power on AC because if the power gets cut and the laptop battery runs out, then I want it to be able to power back on. Even though I'm not physically present, when the power comes back, I want it to also turn the laptop on. Now, once the laptop is on, this is where a solution called Drop Bear comes in. It's a tiny SSH server that runs from the init RAM FS before the disk is unlocked.

7:18 So basically before your system is fully booted, it allows you to remotely connect to it and decrypt it. Now I do love the name of this project, Drop Bear, because it highlights one of the most dangerous creatures in the Australian outback. Everyone always talks about snakes and spiders, but I can tell you as an OG bogan that the thing you really need to watch out for is those drop bears. The way this works is if someone steals the machine, it reboots. It'll just be waiting there.

7:45 Drop it will just be waiting for a passphrase for you to contact it and unlock it. For me, this is a pretty tolerable risk acceptance. Still, no one can access all of the data on your device without the passphrase. I'm going to configure Drop Bear to send me a message on my Telegram when it's ready to unlock. Okay, so we're finally working from within the system. First things first though, we need to harden the SSH configuration to use a public private key pair. This is pretty basic stuff. It's important that you do this.

8:16 We want to block root access and we also want to block password only access. We want to set it up to only accept a few fail attempts as well. I've changed the standard port from the standard 22 to the very lucky 888. Now, just keep in mind that this is obscurity security obscurity. It's not actually security, but it will result in less noise in our logs or less pollution. Okay, so a moment ago I demonstrated unlocking the device via Drop Bear. We contacted it remotely and we entered the passphrase and then we got into the system. But right now, that's only working on the local network. We can't actually, if I leave my house and I take this laptop with me and we're on a different network, we still can't access the home server. So we need a way to access the server from any location and this is where we're going to use tail scale. So the benefit of tail scale is that we don't even have to have a publicly exposed port from our home and in some cases we can't. For example, if you're behind the cgnat now tail scale does get a bunch of metadata. They can't actually see what is in your encrypted traffic.

9:27 But much like your internet service provider, they can see certain metadata and that is a consideration. Now what you could do is you could go ahead with a free and open source option like headscale. Headscale is an open-source self-hosted replacement for tail scales coordination server. So you got the same clients, the same protocol, it's your infrastructure, but it needs a publicly reachable infrastructure somewhere which is usually a VPS and in my case I wanted to keep this stack as manageable as possible. So for me, tail scale is a great solution. And just on that, one thing I learned from my time in banking is that it's often not that important where a company is incorporated. they still have mechanisms and legal means to get what they need or what they want.

10:17 There's overlapping tech infrastructure. There's intelligence agencies that share information amongst one another or for example justice departments. So even if a company operates in one place, there's almost always legal mechanisms in place to get them to disclose information in another country. Okay, so that's tail scale. The important thing is we can now access our server from outside of our local network. Now in my case I'm actually going to install tail scale on the Raspberry Pi. The reason is is that the Raspberry Pi is unencrypted and it's always on and it's going to act as a jump box into other devices on the network. The beautiful thing about this is that for example the power goes out, the power comes back on. Well, the Pi is always ready to go and I can use it to SSH into the drop bear on the server.

11:11 So, I did investigate and you can actually set up by the looks of it a drop bear tail scale connectivity, but I found this to be a slightly more robust implementation. Basically, the Raspberry Pi is connected on tail scale and it advertises the home subnet and I can SSH into the server or any other device on the home network via the Pi. Next, I'm going to set up a firewall on both the server and of course the Pi. And I'm going to use NFT tables, which is what something like the uncomplicated firewall UFW. It just uses NFT tables under the hood. And so now the server only accepts incoming traffic from the PI or tail scale. Of course, we need to ensure that the PI is locked down. We can only access it by the local LAN or tail scale. Now, just for your information, in my case, I'm running the PI OS light, which is a lightweight headless Debian based image. Okay. And all this and we don't have any services yet, but we're very very close. And so the next thing that I'm going to do is I'm going to install Podman. Now, all of the services that we're going to be running are going to be running in containers. There's many arguments to use containers. For example, they all have their own dependencies and they're encapsulated in that specific container.

12:31 We can also use configuration files or docker files which have everything set up and are built by the community and because they're widely used, we can have more confidence in their implementation. So the reason I'm using podman is that unlike docker which has a root damon running at all times podman doesn't have a damon and it is rootless by default and so you are once again much like in the case of systemd and the init system by using open rc we were reducing the surface or making a smaller attack surface and it's the same with podman we are having a smaller attack surface and we are running these containers just as a normal user rather than root. All right, so finally we're into our apps.

13:20 The first thing I'm going to install is Sync Thing, which is a peer-to-peer file synchronization between devices. So there's no cloud provider, there's no central dependency. We just have file replication directly across all of your linked devices. And this is awesome with a service like Obsidian for note takingaking, for example. Once again, Obsidian, it has a great service. there is a subscription fee service. In my case though, for example, I can just use sync thing. I can sync the files including my notes across my machines and I can also use sync thing for my library and other documents. Next, we have image. Now, image is awesome. It's effectively a self-hosted Google Photos replacement. You've got automatic uploads, timeline view, mobile apps, facial recognition, but it's using a local machine learning container which doesn't expose your data and it also has search based on all the metadata. And image does require a couple of containers. For example, it's got a server, it's got the machine loading container like I mentioned, it's got Postgress as a database, and then it's got Reddus as an in-memory database. And so we're going to manage it with Podman Compose. And all this is is just doing orchestration of these containers. We've got more than one container. So we're going to use a docker compose.yaml.

14:41 And so basically everything else in this project is running as a standalone container. But in the case of image, it is using multiple containers. So we're using the compose file. And this is one of those projects that genuinely makes self-hosting feel just like the best thing ever. As soon as I opened this up and loaded all my photos, I was like, I was so glad that I'd done this. Next, we're going to install Vault Warden, and this is for all of the passwords and other credentials. Vault Warden is self-hosted Bit Warden, and it works with the Bit Warden browser extension.

15:14 So, we just need to configure it to point to our server. And this is the most important service on the entire machine because if this gets compromised, everything else follows. Okay, the next thing that we need to do is I am going to install tail scale onto the server. We've already got it on the Pi so that we can access our local network and we can SSH via the PI subnet. But tail scale also provides us with transport layer security TLS certificates. So for example, we can have that little lock on the browser in image or sync thing or vault warden. And there's two real reasons that we want to have this. One is that Vault Warden just won't work without it because it needs to be totally end to end encrypted.

15:59 Secondly, just annoying to click through those certificate warnings on our own services. We want the lock right now. We're getting into maintenance and monitoring. So, the first thing that we want to do is I'm going to install unattended updates. And all this does is it's going to update the system whenever there's updates that are available, which is stable. And then I'm going to install the advanced intrusion detection environment. And basically it's called aid. It's just a utility that creates a database of all the files on the system.

16:29 Then it uses that database to ensure file integrity and also detect system intrusions. And then we've got audit d which are just going to install and audit d it just handles kernel level audit logging. Now the file system that I'm using here on this system is butterfs or B3FS and what it is is a modern copy on write file system which has support for snapshots. So snapshots allow us to roll back to a certain time and while they're not backups they are certainly an excellent option when it comes to the first point of call when it comes to recovering our system. So now let's get on to backups. And you might be thinking, am I using RAID? And I'm not because RAID is primarily concerned with redundancy. Now, recall that third SSD, I'm going to use that for the automated backups. And here we're going to be using a system called Borg backup or Borg for short. And essentially what Borg does is it provides us with space efficient storage of backups. It's secure. It's got secure authenticated encryption. It's got compression. and it's also under a free software BSD license and it's got a big active open source community. Now the thing about backups is it does require a lot of discipline. So ideally what you want to have is you want to have three copies and you want to have a physically separate copy. You've got one copy on your server then one on your device and then you could for example use a service like Hznner or rsync.net and you could have the backups there. In my case, I'm just going to use this third SSD. Like I mentioned at the beginning of the video, this is all going to be designed in such a way that everything is going to be totally free of charge. You don't have any ongoing monthly subscription fee. And it would be a good option to go and back it up on one of those services. Okay. We wouldn't be skits maxing our own privacy home server if we didn't replace the stock bias with a free and open source one from core boot. Now, if this is unfamiliar to you, that's totally fine.

18:32 And this is totally an optional step. The thing is when you buy a laptop, the Intel management engine say on Intel chips or AMD has similar implementations. There's firmware which is code. It runs on the device and it is proprietary. We can't actually get in there and inspect the code. So we don't know what it does. But in theory, as long as there's power going to the laptop, it might be looking at your screen. It could use the microphone. It has access to the keyboard. It can see what you're typing. And of course, this is for many security conscious people a clear concern. So the core boot project aims to get around this. Not every device is supported by core boot, but basically what it does is it heavily truncates or mutters the Intel management engine. It tries to the extent that it can to replace the proprietary blobs or the code which runs like I mentioned. And while it's not perfect, it still relies, in the case of this motherboard, which is a T480 ThinkPad, it still relies on a lot of proprietary blobs, but it is an excellent project which is going in the right direction, and it does definitely neuter or remove a lot of the capabilities of the Intel management engine, which can put you slightly more at ease. So, I'll leave the links to this and every other technology that I mentioned in this video in the description. If you're interested in more, go ahead and take a look. This is only really the top of the iceberg when it comes to all of the security measures that, like I said, our threat model.

20:03 We're considering theft, casual snooping. We're considering opportunistic data breaches essentially. And so, you could do more. For example, some people might say you could have a UB key. You could have a key USB that needs to be on the device in order to boot it up. The problem is that you're not going to be around your home server all the time, right? And so with our system with drop bear and sshing in and decrypting it, that's a good approach.

20:30 Now the init RAM FS is not signed. There is actually a project called heads and it builds on core boot. So in my case, we've installed core boot on this machine and we've got secure boot. So the kernel is signed but all the init RAM FS is not signed. So if someone got physical access to your machine then they could tamper with it. They could log your passphrase for example. There's also mandatory access control system. So for example app armor and SE Linux are advanced use cases and they are something worth exploring. Perhaps in a separate video I'll look at those. The goal here is to reduce risk and it is to educate and to show what's possible on your own system. And when it comes to security, often the most important thing is just to be not the most exposed.

21:21 I'm not condoning having a weak system. But what I'm trying to say is we need to get some level of practicality against what is achievable for many users. And I don't want you to be intimidated by these security steps or the hardening steps that you need to take. I want you to go out there with confidence understanding that much of the attack surface is covered in this video. Now, even with everything that we've done here, there are still vulnerabilities.

21:45 The keys, for example, are still living in the RAM when the machine's on. And if someone came in, then they could freeze the RAM and they could read them out in what is called a cold boot attack. But I would say that if you are concerned about this threat model, then you really got to be concerned about air gapping a machine. The haters are also going to point out that you know telegram that's proprietary. Tail scale that's proprietary. In the case of telegram Mr.

22:10 Palurov was apprehended in France. Did he did he squeal? I don't know. But if it bothers you using a proprietary service like telegram then you can look at other options that signal has for example. And we could swap additional services. For example you could have jellyfin in that is the equivalent of Netflix. For me I don't even watch television. You could use searchng instead of Google email servers as well. And email is an area that I would advise caution because it does take a lot of setup. You really need to know what you're doing. In my case, and I'm not shilling for Proton, but I just use Proton Mail. And the reason is that I have mostly I have a decent amount of trust in their services. I find it it works for me, especially for the business side of things. And you can just limit your use of that means. You got to understand that Proton for example, they've been subpoenaed many times and while sometimes they push back, they have ultimately adhered to Swiss law and provided a lot of metadata. And I'm not necessarily pointing at Proton and saying they're doing the wrong thing. To my earlier point, all they're doing is they're adhering to their local law. And there's usually a way for governments to push companies to provide the information that they want officially or unofficially. Then we set up sync thing, but then of course you can set up nextcloud if you want the full cloud suite replacement. And then another thing that I would definitely set up in the future is for ad blocking on your local network.

23:43 Ultimately, there's a balance when it comes to security. But this video was about winning back some of our digital sovereignty. And I think that we've done that at least to some extent. You can tell me what you think in the comments. For those who are interested in going even further, you can look at the heads firmware. You can look at the headscale replacement for tail scale for example. But what we have here is an excellent foundation for a home server for a sovereign private home server. And if you enjoyed this video, please let me know in the comments. Like and subscribe. Tell me, are you going to implement your own home server or have you already done it? Have I missed any services that you couldn't live without?

24:21 Let me know.