I became more interested in personal privacy after my Roku started spying on what we were watching outside the Roku itself, our mesh WiFi router switched to a subscription model for "AI" and "cloud" features, and our smart home switches required access to "the cloud" just to turn on lights. TVs, WiFi routers, and smart home devices are all driving prices down by supplementing hardware sales revenue with personal data sales.
On top of that, after creating a custom smart lock, I saw first hand how Google and Amazon's smart home infrastructures are built around selling cloud services and capturing my personal data, while Apple HomeKit is designed to work without any internet access at all.
Given these consideration, I wanted a more robust router and firewall between my home network and the internet. I wanted to be able to completely block smart home devices from accessing the internet. And I wanted to do everything as cheaply as possible while maintaining compute resource (CPU, RAM, disk) separation between self-hosted services.
The Ubiquiti EdgerRouter X is the router and firewall while the mesh WiFi is in "bridge" mode, effectively operating as a switch. IP addresses are assigned in ranges and firewall settings are used to block all devices from the internet except those that need it (Apple TV, Laptops, Phones, etc.).
Four Raspberry Pis host all self-hosted services. Public services like code hosting, federated social networks, and a bitcoin node. And private services like DNS-based ad and tracker blocking. (After using Pi-Hole for a while, I switched to AdGuard Home, which is just simpler and easier to maintain.)
Finally, power over Ethernet (PoE) with a PoE switch is used to reduce the cords to the Raspberry Pis.
A downside of not using a standard rack-mounted host is the non-standard form factors of the Raspberry Pis and hard drives etc.
To handle this, I 3D printed a Raspberry Pi 2U rack mount. It's not used in a rack configuration but it's actually just a great way to have easy, uniform, and modular access to the Pis.
Hardware was purchased from McMaster-Carr.
For the hard drives, I designed and 3D printed a custom stand.
Host configuration is managed with Ansible. The roles are written to be minimally invasive and optimized for low maintenance.
The Ansible roles are open source.
For clarity, my specific Raspberry Pi Ansible playbook in provided below:
- hosts: rpis
roles:
- rpi-base
- apt-cacher/client
- prometheus/rpi-client
- hosts: admin.local
roles:
- adguard-home
- apt-cacher/server
- prometheus/server
- hosts: btc.local
roles:
- block-device
- bitcoind
- lnd
- bitcoind-prometheus-exporter
- hosts: media.local
roles:
- block-device
- plex
- transmission
- homebridge
- minecraft
- nginx
- hosts: web.local
roles:
- block-device
- postgresql
- pleroma/aws-s3-backup
- pleroma/otp
- writefreely
- mercurial/aws-s3-backup
- mercurial/web
- oragono
- prosody
- nginx
Using a hardwired router as the articulation point between the internet and the rest of a home network is a great way to get privacy, security, and self-hosting without really investing much.