KDE Connect if you're on Plasma, Syncthing for anything ongoing, and LocalSend for one-off files. All three stay on the LAN. I'd skip anything that wants an account.

If nothing's exposed and it's all behind Netbird, you don't strictly need it. I still would, because apps like Vaultwarden's web vault won't load without a secure context. A wildcard cert via DNS challenge is a one-time setup. Everything else is optional.

Put it on its own VLAN or guest SSID in OpenWRT, then add a firewall rule that only lets your client subnet reach it on 631 and 9100. Block WAN for that zone completely. AirPrint discovery needs mDNS across zones, so you'll want umdns or avahi as a reflector, and that's the part that usually breaks. I'm building a home box that does this by default for IoT stuff. Would you want it to just work, or would you rather see the rules?

Which part do you want to spend the least time maintaining: photo backups, remote access, or updates? I’m designing Doomsday Box, a home-server concept, and trying to understand what should work without constant attention. Your planned setup is relevant. Would you mind giving blunt feedback on the idea? https://heyeddi.com/projects/doomsday-box

Is the two-disk requirement for capacity, redundancy, or keeping workloads separate? I’m exploring an N150 home-server concept and trying to understand where a compact box becomes too limiting. Storage seems like a decision worth getting right before choosing the enclosure.

Get Jellyfin off the open internet. For family who'll never install a VPN app, the setup that holds up is WireGuard on their router, or Tailscale on whatever TV box they use, set up before it ever ships to them. They never see it. If something has to stay public, CrowdSec plus Pocket-ID is a lot lighter than Authentik for three users. I'm building a home box that ships locked down like this by default, so I'm curious: which broke first for your family, remote access or the logins?

I went the other way this week. Nothing public anymore, and the only thing open on the WAN is the WireGuard port. I lost the easy Jellyfin share links for family and gained sleep. The PHP mess made the call easy.

Boring plan is the right plan. One shed-specific thing: Intel Mac minis on Linux won't power back on after an outage by default, and there's no BIOS toggle. Look up the setpci trick for your model and test it before it goes outside.

Ollama on an N150 mini PC, 16GB, no GPU, Open WebUI on top. Being honest, 1-3B models are fine for searching my offline Kiwix stuff and 8B works if you don't mind waiting. I'm turning this into a small box (heyeddi.com/projects/doomsday-box) and I keep going back and forth on whether people even want AI on it, or just the media and offline archives. Would you?

I'm building almost exactly this as an N150 box, so take this with that bias. For photos, files and contacts, Immich plus Nextcloud on Debian will cover you, and an N-series board idles at a few watts. The part that bit me was updates breaking things, not the install. What's your limit for maintenance, an hour a month?

I'm designing around an Intel N150, and this thread is the reason. These chips idle in single digits with an SSD, so most of the cost of running always-on goes away. The catch is the 16GB RAM ceiling on most boards, which caps how much local AI you can run on it. For the low-watt folks: what did you give up to get there, and was it worth it?

The layout I'm designing around is inline: ISP router, then a small dual-ethernet box doing firewall and DNS filtering, then your LAN. For a start, I'd put OPNsense on a cheap dual-NIC mini PC. You get network-wide blocking through a plugin and a VPN to reach your NAS, and VLANs can wait until you need them. I'm biased, since I'm building a box with that exact layout. What I can't settle: for someone starting out, is an all-in-one box less scary, or does it hide the stuff you'd want to learn?