Home Server Master Plan: Docker, AI, and Self-Hosted Everything

I’m done paying monthly subscriptions for services I could run myself. Done with rate limits on AI models. Done with “the cloud” having more access to my data than I do.

This is the master plan for a unified home server that replaces $40+/month in cloud subscriptions, runs uncensored local AI models with no rate limits, and keeps working when the internet goes down.

Why Self-Host?

Cost savings: $40+/month in subscriptions ($480/year) means the hardware pays for itself in 3-4 years. After that, you’re saving money while owning the infrastructure forever.

Data ownership: Your photos, documents, passwords, and media stay on hardware you control. No terms of service changes, no unexpected shutdowns, no de-platforming.

Offline capability: When your internet goes down (or you choose to disconnect), your services keep running. Local AI, media library, document search, password manager — all available without connectivity.

No rate limits: OpenAI charges per token and rate-limits free tiers. Local AI inference is unlimited. Run as many queries as you want, with models you choose, at no marginal cost.

Learning: Operating production infrastructure teaches you systems administration, networking, containerization, and troubleshooting in ways that cloud platforms abstract away.

Architecture Overview

The core setup is a Mac Mini M4 Pro for compute + QNAP NAS for storage + Tailscale for remote access. Everything runs in Docker containers orchestrated by Docker Compose.

Home Server ArchitectureMac Mini M4 Pro12-core CPU • 24GB RAMDocker + 30+ containersQNAP NAS32TB StorageNFS MountMedia + BackupsNFSTailscale VPNRemote AccessZero Port ForwardMesh NetworkVPNAI & DevOllamaOpen WebUIAnythingLLMVS Code ServerGiteaMediaPlex / JellyfinRadarr / SonarrNavidromeAudiobookshelfImmich PhotosNetworkAdGuard HomeNginx ProxyVaultwardenWireguardUptime KumaProductivityPaperless-ngxKiwix (Wiki)MealieNextcloudCalibre-WebInfraPortainerHomepageGrafanaPrometheusPower Backup8.9 kWh Battery5+ days offline runtimeLocal NetworkStatic IP + DNS*.home.local domainsTotal Services: 30+Power: ~15W idle, ~35W full loadCost: ~$5-7/month electricityReplaces: ~$40+/month subscriptions

Hardware:

  • Compute: Mac Mini M4 Pro (12-core CPU, 24GB RAM, 512GB SSD) — $1,699
  • Storage: QNAP TS-464 NAS with 32TB (existing infrastructure)
  • Network: Ubiquiti UniFi Dream Machine (existing infrastructure)
  • Power: 8.9 kWh battery backup system (see tiered power article)

Software:

  • OS: macOS Sequoia
  • Runtime: Docker Desktop + Docker Compose
  • Orchestration: Portainer (web UI for container management)
  • Reverse Proxy: Nginx Proxy Manager (clean URLs + SSL)
  • DNS: AdGuard Home (network-wide ad blocking + local DNS)
  • VPN: Tailscale (remote access without port forwarding)

The Service Catalog

Here’s what runs on this single machine, organized by function:

CategoryServicePurpose
AI & DevOllamaLocal LLM inference (Llama 3, Mistral, others)
Open WebUIChatGPT-like interface for local models
AnythingLLMRAG over personal documents
VS Code ServerBrowser-based code editor
GiteaSelf-hosted Git server
MediaPlex / JellyfinMedia streaming (movies, TV, music)
Radarr / SonarrAutomated media management
ProwlarrIndexer management
NavidromeMusic streaming server
AudiobookshelfAudiobook and podcast library
ImmichGoogle Photos replacement
NetworkAdGuard HomeDNS-based ad blocking
Nginx Proxy ManagerReverse proxy with SSL
VaultwardenBitwarden-compatible password manager
TailscaleMesh VPN for remote access
Uptime KumaService monitoring and alerts
ProductivityPaperless-ngxDocument management and OCR
KiwixOffline Wikipedia + reference libraries
MealieRecipe management
NextcloudFile sync and collaboration
Calibre-WebeBook library manager
LinkwardenBookmark manager
InfrastructurePortainerDocker container management
HomepageUnified dashboard
GrafanaMetrics visualization
PrometheusMetrics collection
WatchtowerAutomatic container updates

Total: 30+ services running concurrently on a single Mac Mini.

Phased Rollout: Don’t Do Everything At Once

The worst approach is trying to set up 30 services in a weekend. You’ll burn out, hit configuration conflicts, and end up with a brittle system you don’t understand.

Instead, implement in phases:

Phase 1: Foundation (Week 1)

Set up the infrastructure that everything else builds on.

  1. Docker Desktop: Install and configure with sufficient resources (8GB RAM minimum, more if you have it).
  2. Portainer: Web UI for managing containers. Makes everything else easier.
  3. Nginx Proxy Manager: Reverse proxy so services get clean URLs (ai.home.local instead of localhost:8080).
  4. AdGuard Home: DNS server that resolves local .home.local domains and blocks ads.
  5. Tailscale: VPN for remote access without exposing services to the internet.
  6. Homepage: Dashboard that links to all services in one place.

At the end of Phase 1, you have a working infrastructure layer with monitoring, DNS, reverse proxy, and remote access. This is your foundation.

Phase 2: AI (Week 2)

This is the main event — local AI inference with no rate limits.

  1. Ollama: Download and run local LLMs. Start with Llama 3.3 70B or Qwen 2.5 72B for high-quality inference.
  2. Open WebUI: ChatGPT-like interface. Connect to Ollama and start using local models immediately.
  3. AnythingLLM: RAG (Retrieval-Augmented Generation) over your personal documents. Point it at documentation, notes, or codebases and ask questions.

At this point, you have unlimited local AI with better privacy than cloud services. No API keys, no rate limits, no usage tracking.

Phase 3: Media (Week 3)

Migrate media streaming from the NAS to the Mac Mini for better transcoding performance.

  1. Plex or Jellyfin: Media server for movies, TV, and music. I prefer Jellyfin for being fully open-source, but Plex has better client apps.
  2. Radarr / Sonarr / Prowlarr: Automated media management. These are the “arr stack” for organizing and updating media libraries.
  3. Navidrome: Music streaming server with Subsonic API support. Excellent mobile apps (Symfonium on Android, play:Sub on iOS).

Mount your NAS media library via NFS so services can access it without duplicating data.

Phase 4: Privacy (Week 4)

Replace cloud services with self-hosted alternatives that respect privacy.

  1. Vaultwarden: Bitwarden-compatible password manager. All passwords stored locally, synced via Tailscale when remote.
  2. Immich: Google Photos replacement with mobile app auto-upload, facial recognition, and search. This one is worth the setup effort.

Phase 5: Knowledge (Week 5)

Build an offline knowledge base that works without internet.

  1. Kiwix: Offline Wikipedia and reference libraries. Download ZIM files for Wikipedia, Stack Overflow, medical references, repair manuals.
  2. Paperless-ngx: Scan and OCR documents. Searchable archive of every paper document you own.
  3. Gitea: Self-hosted Git server for private repositories.
  4. Calibre-Web: eBook library with OPDS support for mobile reading apps.

Phase 6: Nice-to-Haves (Ongoing)

Additional services that improve quality of life but aren’t critical:

  1. Mealie: Recipe manager with meal planning.
  2. Audiobookshelf: Audiobook library with playback tracking.
  3. Linkwarden: Bookmark manager with full-page archival.
  4. Nextcloud: File sync for documents and photos (alternative to Dropbox).

Network Design: Clean URLs and Zero Port Forwarding

The goal is services accessible via clean URLs like ai.home.local, plex.home.local, docs.home.local — no port numbers, no localhost confusion.

Local DNS: AdGuard Home resolves .home.local domains to the Mac Mini’s static IP (e.g., 192.168.1.100). Configure your router to use AdGuard as the primary DNS server.

Reverse Proxy: Nginx Proxy Manager routes requests from clean URLs to the correct container port. Example:

  • ai.home.local → localhost:3000 (Open WebUI)
  • plex.home.local → localhost:32400 (Plex)
  • docs.home.local → localhost:8080 (Paperless)

SSL Certificates: Nginx Proxy Manager generates self-signed certificates for .home.local domains. No certificate warnings in browsers.

Remote Access: Tailscale creates a mesh VPN between your devices and home server. Access services from anywhere using the same .home.local URLs — no port forwarding, no exposing services to the internet, no Dynamic DNS complexity.

Example Tailscale setup:

  1. Install Tailscale on Mac Mini and register device.
  2. Install Tailscale on laptop/phone and authenticate.
  3. Access services via Tailscale IP or MagicDNS hostname: http://mac-mini.tail-scale.ts.net or http://ai.home.local (if you configure Tailscale DNS to forward .home.local queries).

Zero ports exposed to the internet. Zero firewall rules. Zero attack surface.

Cost Analysis: When Does This Pay For Itself?

Initial Investment:

  • Mac Mini M4 Pro: $1,699
  • NAS (if not already owned): $500-1,000 for 4-bay + drives
  • UPS / Battery backup: $200-2,000 (depending on runtime target)
  • Total: ~$2,400-4,700

Ongoing Costs:

  • Electricity: ~15W idle, ~35W full load = $5-7/month
  • Internet: No additional cost (existing connection)
  • Total: ~$60-85/year

Replaced Subscriptions:

  • ChatGPT Plus: $20/month
  • Google Drive (200GB): $3/month
  • Bitwarden Premium: $10/year ≈ $1/month
  • Spotify / Music: $11/month
  • Google Photos (2TB): $10/month
  • Plex Pass (optional): $5/month
  • Total savings: ~$40-50/month or $480-600/year

Break-even: ~4-5 years (sooner if you count avoided NAS upgrades from not running services there).

But here’s the thing: after 4 years, you’re not just “breaking even” — you own the infrastructure. No subscription can be canceled on you, no terms of service can change, no rug-pull. The hardware keeps working for 7-10 years, and you’ve saved thousands while maintaining complete control.

Power and Resilience

The Mac Mini pulls ~15W at idle and ~35W under load. Combined with the NAS (~30W), total system power is 45-65W.

On my tiered home power system, this runs for 5+ days on battery backup during grid outages. That means:

  • No internet needed: Local AI, media library, password manager, documents, and knowledge base all work offline.
  • Extended outages: Continue working, streaming, and accessing information during multi-day power failures.
  • ISP independence: If your ISP goes down, critical services remain available locally.

This is infrastructure resilience at the household scale.

What This Unlocks

Unlimited AI queries: Run as many prompts as you want through Ollama and Open WebUI. No rate limits, no usage tracking, no content filtering.

Offline Wikipedia: With Kiwix, you have the entirety of Wikipedia available locally. Add Stack Overflow, medical references, repair manuals — offline knowledge when you need it.

Private photo backup: Immich uploads photos from your phone automatically, with facial recognition and search — without uploading to Google or iCloud.

Cross-device password sync: Vaultwarden syncs passwords across devices via Tailscale, with no cloud middleman.

4K media streaming: Plex or Jellyfin transcodes on the fly. The M4 Pro handles 4K HEVC with ease.

RAG over personal docs: Point AnythingLLM at your notes, documentation, or codebases and ask natural language questions.

Lessons Learned: What I’d Do Differently

Start smaller: I tried to set up 20 services in the first weekend. Bad idea. Do Phase 1, verify it works, then add Phase 2. Incremental > big bang.

Document everything: Write down URLs, ports, credentials, and configuration decisions. You will forget why you configured something a certain way six months from now.

Use Docker Compose: Hand-managing 30+ containers in Portainer is tedious. Docker Compose files are version-controlled, repeatable, and easier to restore after failures.

Automate backups: Critical data (passwords, documents, configuration) should automatically back up to the NAS on a schedule. I use a cron job + rsync.

Monitor everything: Uptime Kuma pings services every 60 seconds and alerts if anything goes down. Without monitoring, you discover failures when you try to use the service.

Over-provision RAM: I started with 16GB and hit swap during Ollama inference. Upgraded to 24GB. If you’re running local AI, don’t skimp on RAM.

Get Started

If you’re convinced and want to build this yourself, start with Phase 1: Foundation. Set up Docker, Portainer, and Nginx Proxy Manager. Get comfortable managing containers and routing traffic.

Then add AI (Phase 2). Local LLM inference is the most compelling reason to self-host — no rate limits, no content filtering, no usage tracking.

After that, add services based on your priorities. Media (Phase 3) if you want to stream content. Privacy tools (Phase 4) if you want to replace cloud services. Knowledge base (Phase 5) if you want offline reference libraries.

Don’t try to implement everything at once. Build incrementally, document as you go, and test each layer before moving to the next.

The goal isn’t complexity for its own sake — it’s owning your infrastructure, reducing dependence on cloud services, and building resilience into your digital life.

This is the master plan. Now go build yours.