Home Server from an Old PC: Secure Access from Anywhere (Ubuntu/Debian)

Complete step-by-step guide for beginners: Install Ubuntu/Debian, web management with Cockpit, file sharing (Samba), secure remote access with Tailscale (recommended) and/or public HTTPS address via Cloudflare Tunnel.
Everything is free, no public IP, no port forwarding required.

1) What you need

• Old 64-bit PC or laptop (recommended: 4 GB RAM+).
• Small SSD for system + larger HDD/SSD for data.
• LAN cable (more stable than Wi-Fi).
• USB stick (8 GB+) for installation.

2) Download OS & Create USB

• Ubuntu Server 24.04 LTS – recommended.
• Ubuntu Desktop 24.04 LTS – with GUI.
• Debian 13 “Trixie” (netinst).

Tools: balenaEtcher, Rufus

3) Install Ubuntu/Debian

sudo apt update && sudo apt upgrade -y

4) Web-based management (Cockpit)

sudo apt install -y cockpit udisks2
sudo systemctl enable --now cockpit.socket

Browser: https://SERVER_IP:9090

5) File sharing in LAN (Samba/SMB)

sudo apt install -y samba
sudo mkdir -p /srv/data/shared
sudo chown -R $USER:$USER /srv/data/shared

[shared]
path = /srv/data/shared
browseable = yes
read only = no
create mask = 0640
directory mask = 0750
valid users = @smbusers

sudo groupadd smbusers
sudo usermod -aG smbusers $USER
newgrp smbusers
sudo smbpasswd -a $USER
sudo systemctl restart smbd

6) Secure access from anywhere (Tailscale)

curl -fsSL https://tailscale.com/install.sh | sh
sudo systemctl enable --now tailscaled
sudo tailscale up

7) Web-based file access (File Browser)

curl -fsSL https://raw.githubusercontent.com/filebrowser/get/master/get.sh | bash
filebrowser -r /srv/data

sudo mkdir -p /var/lib/filebrowser
sudo tee /etc/systemd/system/filebrowser.service >/dev/null <<'EOF'
[Unit]
Description=File Browser
After=network.target

[Service]
User=YOUR_USER
Group=YOUR_USER
ExecStart=/usr/local/bin/filebrowser -r /srv/data -p 8080 -d /var/lib/filebrowser/filebrowser.db
WorkingDirectory=/var/lib/filebrowser
Restart=on-failure

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable --now filebrowser

8) Alternative: your own cloud (Nextcloud)

sudo snap install nextcloud

9) Public HTTPS without ports (Cloudflare Tunnel)

cloudflared tunnel login
cloudflared tunnel create my-tunnel

sudo tee /etc/cloudflared/config.yml >/dev/null <<EOF
tunnel: UUID
credentials-file: /etc/cloudflared/UUID.json

ingress:
  - hostname: files.your-domain.com
    service: http://localhost:8080
  - service: http_status:404
EOF

cloudflared tunnel route dns UUID files.your-domain.com
sudo cloudflared service install
sudo systemctl enable --now cloudflared

10) Basic security

sudo apt update && sudo apt upgrade -y
sudo apt install -y ufw
sudo ufw allow OpenSSH
sudo ufw allow 9090/tcp
sudo ufw enable
sudo ufw status

ssh-keygen -t ed25519 -C "email@example.com"
ssh-copy-id user@SERVER_IP
# /etc/ssh/sshd_config:
PasswordAuthentication no
sudo systemctl restart ssh

11) Alternatives

• OpenMediaVault
• CasaOS