Building a Home Server from a Mini PC

1 August 20252 min read

I picked up a Beelink SER5 Mini PC (Ryzen 5 5500U, 16GB RAM, 500GB NVMe) as a home server. Here's a condensed guide covering the important bits, particularly the things that tripped me up.

Why Ubuntu Server (not Desktop)

No GUI, no unnecessary services, smaller attack surface, lower resource usage. You plug in a monitor and keyboard for the initial setup, then SSH in from that point on. Use Ubuntu Server 24.04 LTS.

The LVM gotcha

This is the one that catches everyone out. Ubuntu Server's installer enables LVM by default, but only allocates about 100GB to the root volume, even on a 500GB drive. The rest sits there doing nothing.

Fix it after install:

sudo lvextend -l +100%FREE /dev/ubuntu-vg/ubuntu-lv
sudo resize2fs /dev/ubuntu-vg/ubuntu-lv
df -h /

You should now see the full ~465GB available.

SSH hardening

Once you've confirmed key-based login works (use Ed25519 keys, not RSA), lock it down:

PermitRootLogin no
PasswordAuthentication no
AuthenticationMethods publickey
MaxAuthTries 3
AllowUsers your-username
X11Forwarding no

The golden rule: test from a second terminal before closing your current session. If you've bolloxed the config, you'll still have a way back in.

Firewall and brute-force protection

sudo ufw allow ssh
sudo ufw enable

sudo apt install fail2ban -y

Create /etc/fail2ban/jail.local:

[DEFAULT]
bantime  = 1h
findtime = 10m
maxretry = 3
banaction = ufw

[sshd]
enabled  = true
port     = ssh
logpath  = /var/log/auth.log
maxretry = 3

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

Even with key-only auth, Fail2Ban reduces log noise and bans the bots that constantly probe port 22.

Podman over Docker

I went with Podman for this box. It's daemonless, runs containers rootless by default, and is in the Ubuntu 24.04 repos:

sudo apt install podman -y

Enable the rootless socket (for Docker compatibility with tools like Portainer):

systemctl --user enable podman.socket
systemctl --user start podman.socket
sudo loginctl enable-linger your-username

The enable-linger bit is important. Without it, your user services stop when you log out.

Automatic security updates

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure -plow unattended-upgrades

Select "Yes" and you're sorted. Security patches get applied automatically without you having to think about it.

Day-to-day

Set up ~/.ssh/config on your local machine:

Host myserver
    HostName 192.168.1.100
    User your-username
    IdentityFile ~/.ssh/myserver_ed25519
    IdentitiesOnly yes

Then it's just ssh myserver and you're in. Unplug the monitor and keyboard, the box is headless now.

A mini PC like this draws about 10W idle. Runs Podman containers, serves files, handles DNS, all silently sitting on a shelf. Hard to beat for the price.