Get Jellyfin off the open internet. For family who’ll never install a VPN app, the setup that holds up is WireGuard on their router, or Tailscale on whatever TV box they use, set up before it ever ships to them. They never see it. If something has to stay public, CrowdSec plus Pocket-ID is a lot lighter than Authentik for three users. I’m building a home box that ships locked down like this by default, so I’m curious: which broke first for your family, remote access or the logins?

I went the other way this week. Nothing public anymore, and the only thing open on the WAN is the WireGuard port. I lost the easy Jellyfin share links for family and gained sleep. The PHP mess made the call easy.

Boring plan is the right plan. One shed-specific thing: Intel Mac minis on Linux won’t power back on after an outage by default, and there’s no BIOS toggle. Look up the setpci trick for your model and test it before it goes outside.

Ollama on an N150 mini PC, 16GB, no GPU, Open WebUI on top. Being honest, 1-3B models are fine for searching my offline Kiwix stuff and 8B works if you don’t mind waiting. I’m turning this into a small box (heyeddi.com/projects/doomsday-box) and I keep going back and forth on whether people even want AI on it, or just the media and offline archives. Would you?

I’m building almost exactly this as an N150 box, so take this with that bias. For photos, files and contacts, Immich plus Nextcloud on Debian will cover you, and an N-series board idles at a few watts. The part that bit me was updates breaking things, not the install. What’s your limit for maintenance, an hour a month?

Calling it ad blocking undersells it. The ad network is the delivery path in that report, so blocking at DNS is a security layer, not tidiness. The thing I’m building goes a step further: it holds tracker connections open instead of refusing them, so they waste their own time instead of retrying instantly. Has anyone tried tarpitting at home? I’m curious whether it broke smart TVs or apps that phone home hard.

I’m building toward exactly this, so take it with that bias. The cheap tier works if you lower expectations. An N150 mini PC with 16GB runs small models through Ollama fine, but 8B models are slow on that class of chip, and you’ll feel it on anything chat-shaped. Where it shines is async work: summarize this, tag that, answer when it’s ready. For phone access I’d keep it LAN-only and use WireGuard or Tailscale to get home rather than opening a port.

Disclosure: I’m working on a small open-source home box that bundles local AI with offline Wikipedia and media. What would make you trust a box like that over a setup you built yourself?