When you build a home server, it’s tempting to start with the fun stuff, like a media library, a photo vault or a smart home dashboard. But after doing this several times, I know it typically ends with a weekend of rebuilding everything.

Now whenever I build a home server, I start by installing these four unglamorous containers. They are free and usually take about an hour or two to complete. Yet they can decide whether that server becomes something your household can rely on.

Kopia

The undo button for everything else you’ll break

Kopia takes encrypted snapshots of your folders, saving only what has changed between its last run. You’d need to be patient on the first run, but subsequent runs are small and fast enough that I usually don’t know it’s happening.

You may not celebrate a successful backup, but it becomes the most important tool in your arsenal the day you need one. So, instead of treating it as an afterthought, it’s my number one step. It takes just an evening to reinstall anything else on my server, but my photos, documents, and app settings can’t be reinstalled.

It would also be wrong to assume RAID or a synced folder already does the job. RAID or a synced folder can happily replicate a deleted or corrupted file. If a setup doesn’t keep old versions you can fall back to, it’s not a real backup.

On an app like Immich, which is my Google Photos replacement, I grab its own database dumps instead of the live database files, to avoid ending up with a backup that won’t restore.

Don’t lose Kopia’s repository password, or your data could be gone for good. I usually write it down somewhere not on my server, and test a restore early, before I really need it.

To get started, pull the official Kopia Docker image by running this command:

docker pull kopia/kopia:latest

But that’s just a first step. You should take time to configure persistent storage, set a repository password, mount the folders you want to protect, and choose where Kopia should store your backups.

Uptime Kuma

A smoke alarm that texts you before your family does

Your photo app can die on Monday, and you might only find out on Thursday when someone asks why nothing loads. That conversation doesn’t have to happen if you have Uptime Kuma.

It can ping you on Telegram, Discord, email or a push notification to your phone if one of your services stops answering. I like its status page, because it allows my family to check for themselves instead of messaging me.

I now rely on Uptime Kuma’s keyword monitoring more than a basic “is the container running” check, because the page a container serves may be a blank error screen even while the container is up. I can catch the blank page by telling Uptime Kuma to look for a specific word on that page.

I advise setting up retries before anything else, so that you don’t get a 3 a.m. buzz on your phone just because of a ten-second blip. If Uptime Kuma runs on the same server that dies, the monitor goes down with that server and you get no warning. If you can afford to, put it on a spare Raspberry Pi.

You may run the command below to get the official Uptime Kuma Docker image:

docker pull louislam/uptime-kuma:latest

All that’s left is to create a container with persistent storage and configure your monitors and notification methods.

AdGuard Home

Every device in the house asks it first

From the name, you may easily deduce that AdGuard Home blocks ads and trackers. While this is true, the part that I actually install it for is the query log. It shows me which devices are contacting which domains or services, and some of what I’ve seen has been eye-opening. I’ve found smart TVs to be particularly chatty.

I also like that it makes my self-hosted apps nicer to use. Using its DNS rewrites feature, I can turn 192.168.1.40:8096 into a name that actually sticks. For this, I’d recommend using a domain you already own.

There are downsides to using AdGuard Home. The most common one I’ve run into is aggressive blocklists breaking some apps. Also, certain devices ignore your setup because they hardcode their own DNS. Your entire house will assume the internet is down if AdGuard goes down.

It helps to set a backup DNS server on your router, but some queries may then skip filtering.

Here is the command that pulls the official AdGuard Home Docker image:

docker pull adguard/adguardhome:latest

Again, running this command is only a first step. Follow it up by configuring persistent storage, setting up your DNS settings, and pointing your devices or router to AdGuard Home so it can filter DNS requests.

Nginx Proxy Manager

One front door instead of a dozen side windows

If you don’t configure a reverse proxy, apps will live at their own IP addresses and ports. You would also get a “Not secure” warning on each of them in your browser, which your family may not click through. Additionally, some features only work over HTTPS.

I use Nginx Proxy Manager (NPM) as a single entry point. It sends each name to the right app and uses Let’s Encrypt to handle HTTPS certificates, including renewals. While AdGuard converts names to addresses, NPM sends each request to the right app. You end up with a clean URL that works on all devices.

You can do a similar job with Caddy and Traefik, but I stick to NPM because I prefer clicking through a web panel to editing config files.

The command below pulls the official Nginx Proxy Manager Docker image:

docker pull jc21/nginx-proxy-manager:latest

Next, I configure persistence, expose the required ports, and set up my domain names and proxy hosts through its web interface.

The boring-first rule

The order follows what hurts most to lose or miss. This puts data at the top, since it makes every other mistake survivable. Next is silence. If you don’t know something is broken, you can’t fix it. Names and the front door come last, since they just make everything tidier.

None of these four are meant to impress you. But they are why I can break Jellyfin or Immich and shrug it off.

Get these four running before you add anything you can’t afford to lose