Will's avatar
Will Webberley
📣 Mastodon 🖼️ Pixelfed 💻 Git

Note list ▼

Books Umami Traefik Email client (aerc) Obsidian Uses nb jrnl Tailscale Sidecars Vaultwarden Photoprism Podcasts Cloudfront + S3 PostgreSQL MongoDB Links Hosting S3 content via Bunny CDN Woodpecker CI Hosting on Bunny.net Server & database backups Selfhosting Joplin Raspberry Pi Setting-up a Mac Donations 2FAuth Managing s3cmd profiles 🌱 About these notes Gitea Encrypting volumes with LUKS Nextcloud Nitter Teddit FreshRSS Fixing unzip on Alpine Linux Monica Plain Text Accounting Design Ideas Geminispace

Raspberry Pi

This note was last updated on 9 December 2022

technology selfhost

I have a small fleet of Raspberry Pis (mostly the Pi 4 Model B), which I use at home for various tasks.

They are all firewalled off and are reachable via Tailscale. A small number of the services they run are also exposed to the local network.

What they run

As of the time of writing, services I run on the Pis include the following:

  • Nextcloud
  • Photoprism
  • Home Assistant
  • Jellyfin
  • FreshRSS

Storage

I use large SSDs (e.g. this one) for the Pis that require extra storage, such as for my photos. These are connected via USB3-SATA cables (such as these).

Encryption

For sensitive data, I encrypt the enclosing directories using Fscrypt. Follow the instructions on the Arch Wiki.

OS

I tend to use Manjaro Linux as an OS for the Pis.

Setup notes

To setup a new Pi I follow this rough guide:

  1. Prepare a micro SD card with the chosen OS (e.g. using the official imager)
  2. Boot the Pi
  3. Get the IP address (from your router or otherwise) of the Pi
  4. SSH into the new OS (default user: root with no password)
  5. Set-up in the usual way (e.g. create non-root user, harden in usual way)
  6. Update all current packages pacman -Syyu
  7. Install new packages (pacman -S vim tailscale docker ufw)
  8. Bring up and enable services
  9. Configure Tailscale (tailscale up)
  10. Configure UFW (ufw allow in on tailscale0, ufw default deny, ufw enable)
  11. Add non-root user to docker group (usermod -aG docker will)
  12. Pull and run required Docker containers

Note: Make sure to use the arm64 version of any Docker images required.