Ubuntu Home Server: Install, Static IP, SSH, and the First 5 Services

An Ubuntu home server is a small machine (an old desktop, a NUC, a mini-PC, a Raspberry Pi 4/5) running Ubuntu Server, with a static IP, SSH enabled, and a handful of self-hosted services. The team that has been wanting to leave Google Drive / Dropbox / iCloud behind builds this in an afternoon. The five services that earn the machine its place: a file share (Samba), a media library (Plex or Jellyfin), backups (rsync or Restic), DNS-level ad blocking (Pi-hole), and a dashboard (Homepage or Heimdall).

The base install
Set a static IP
Enable and harden SSH
The first 5 services
Maintenance and the next steps
How this fits the rest of the stack
FAQ

The base install

Download the Ubuntu Server ISO from ubuntu.com (the LTS - currently 24.04). Write it to a USB stick with dd, balenaEtcher, or Rufus. Boot the target machine from the USB.

The Ubuntu Server installer walks through:

Language and keyboard
Network (DHCP by default - we will set static after)
Storage (use the whole disk, LVM optional, encryption optional but recommended for laptops)
User account (use a strong password; this is the sudo user)
SSH (install OpenSSH server, import SSH keys from GitHub if you have them)
Featured snaps (skip - we will install services ourselves)

The whole install takes 10 minutes. The team that has done it a few times scripts it with autoinstall cloud-init.

Set a static IP

Modern Ubuntu uses Netplan. The default config is at /etc/netplan/01-netcfg.yaml or /etc/netplan/50-cloud-init.yaml. Edit to set a static address:


network:

  version: 2

  renderer: networkd

  ethernets:

    enp3s0:

      dhcp4: no

      addresses:

        - 192.168.1.10/24

      routes:

        - to: default

          via: 192.168.1.1

      nameservers:

        addresses: [1.1.1.1, 8.8.8.8]

Apply: sudo netplan apply. The team that has a router with DHCP reservations uses those instead - same result, no Netplan config to maintain.

Enable and harden SSH

OpenSSH is already installed (the installer did it). The hardening:


sudo systemctl enable --now ssh

sudo ufw allow OpenSSH

sudo ufw enable

Edit /etc/ssh/sshd_config: set PasswordAuthentication no (use keys only), PermitRootLogin no, and the port if you want to move off 22 (security through obscurity, but reduces noise).

The team that has not set up SSH keys yet does that first - copy the public key to ~/.ssh/authorized_keys on the server.

The first 5 services

Samba (file share) - sudo apt install samba. Edit /etc/samba/smb.conf to add a share. The team that replaces Dropbox runs this.
Jellyfin (media) - install via the Jellyfin apt repo. The team that has a media library on a NAS or external drive points Jellyfin at it. Plex is the alternative if you want the simpler UI.
Restic or rsync (backups) - restic to an external drive or to a remote object store. The team that has a backup strategy they actually test runs this.
Pi-hole (DNS-level ad blocking) - one-line install: curl -sSL https://install.pi-hole.net | bash. Point the router’s DNS at the server, every device on the network gets ad blocking for free.
Homepage or Heimdall (dashboard) - a single page that links to all the services. The team that has 5+ services running uses this as the homepage.

Maintenance and the next steps

Automatic security updates: sudo apt install unattended-upgrades (Ubuntu enables it by default but confirm).

Monitoring: install node_exporter + Prometheus, or just a simple healthcheck script that emails on failure. The team that does not monitor the home server finds out it crashed when the backups stop running.

Off-site backup: at least one of those services should back up off-site (Backblaze B2, Wasabi, S3, rsync.net). The team that loses the home server to a power surge and the backups along with it learns this lesson the hard way.

FAQ

Ubuntu Server or Ubuntu Desktop for a home server?

Server. The desktop pulls in a GUI, a display manager, and a lot of packages that are unnecessary for a headless box. Server also uses less RAM and less disk. The team that wants a desktop on the same machine for occasional use installs Server + the GNOME desktop: sudo apt install ubuntu-gnome-desktop.

Do I need a static IP from my ISP?

No. Use a dynamic DNS service (DuckDNS, No-IP, Cloudflare) to map a hostname to your home IP. Or use a tunnel (Cloudflare Tunnel, Tailscale) that does not require open ports on the home router. The team that does not want to expose SSH to the internet uses Tailscale.

What hardware do I need?

Depends on the services. For a file share + Pi-hole + Jellyfin, an old desktop with 8 GB RAM is enough. For Plex with hardware transcoding or several containers, a more modern CPU. The team that uses Raspberry Pi 4/5 for the light services and a mini-PC for the heavy ones splits the load.

Should I encrypt the home server disk?

Yes, if it is a laptop. No, if it is a desktop in a locked room. LUKS encryption at install time is the easiest way; the team that has done it once on a headless server knows the dance of typing the passphrase over SSH at boot.

How do I expose services to the internet?

Reverse proxy (Caddy, Nginx) + DNS + a port-forwarded 443 (or a Cloudflare Tunnel). The team that uses Cloudflare Tunnel does not need to open ports on the home router - the tunnel is outbound, and the public hostname resolves through Cloudflare’s edge.

How this fits the rest of the stack

For a sense of what the full project costs before it commits, the RunxBuild hosting calculator shows the line items together. The API, the database, the storage, the worker, the bandwidth - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers.

Useful related references: