Video summary

FUTO's Guide to a Self Managed Life: part 1

Main summary

Key takeaways

Technology

Tech/DIY Concept Summary (from subtitles)

Core premise: self-managed software + “normal people” guides

  • The speaker (Futo Software) argues that self-hosting matters because it avoids vendor/cloud abuse and gives control over:
    • server access
    • source code (AGPL licensing is mentioned as often unreadable by non-experts)
  • They propose a long-term, beginner-friendly but complete approach to self-managed infrastructure—avoiding terse “RTFM” documentation.
  • The focus is on practical, end-to-end systems, not just software lists:
    • alerts
    • backups
    • access control
    • spam filtering
    • working integrations

Part 1: Build the foundation (router, VPN, security → first services)

1) Install/validate the home server router stack (pfSense on dedicated hardware)

  • pfSense OS: installed from an ISO onto a dedicated x86 router computer.
  • Hardware choice:
    • Prefer known-good networking hardware (e.g., Intel NICs).
    • Avoid random no-name mini PCs; the talk warns about counterfeits/unreliable listings.
  • Key setup points:
    • Disable Secure Boot to boot the pfSense installer.
    • Identify WAN/LAN interfaces on first boot (use no VLANs initially).
    • Configure LAN IP, DHCP ranges, and web UI credentials.
    • Enable Dynamic DNS for remote access (example uses a free DNS provider updated via a pfSense “update URL”).
    • Notes that residential ISPs often use dynamic public IPs.

2) Why VPN + “single exposed port”

  • Configure the router so only OpenVPN is exposed to the internet.
  • Rationale:
    • Exposing many service ports increases attack surface (the “doors” analogy).
    • OpenVPN is described as widely audited/hardened due to adoption.

3) OpenVPN server + client profile export

  • Uses pfSense tools/packages to simplify certificate and profile creation:
    • Create a Certificate Authority (CA)
    • Generate a server certificate
    • Generate a client user + client certificate (OpenVPN “user certificate”)
  • VPN settings include:
    • A custom tunnel network (client IP pool)
    • DNS routed through pfSense DNS (so ad-blocking applies through the VPN)
    • Options to force all client traffic through the tunnel to prevent DNS/traffic leaks

4) Ad blocking at the router level (PFBlockerNG + AdGuard DNS)

  • The guide measures baseline ad-blocking performance with testing tools.
  • Installs pfBlockerNG on pfSense:
    • Blocks ads via domain and IP feed lists
      • Both matter because domains can map to different IPs over time
    • Uses Unbound-mode DNS blocking for domains
    • Updates feed lists and checks improved scores
  • Optionally reinforces with AdGuard DNS by overriding upstreams from the pfSense DNS resolver.
  • Final checks:
    • DNS leak testing
    • Confirm ad-blocking on a smartphone while connected via VPN

Virtualization and first server roles

5) Ubuntu Server installed on RAID1 (main host)

  • Uses Ubuntu Server LTS for stability and documentation.
  • RAID1:
    • Mirrors OS drives for uptime if one fails
    • Important clarification: RAID is not backups
  • OS disk uses encrypted root volume.
  • Enables SSH and uses pfSense for static IP mapping.

6) Networking for VMs: bridge + iptables persistence

  • Uses bridge networking so VMs appear directly reachable on the LAN.
  • Applies iptables rules for the bridge interface and makes them persistent across reboots (VM connectivity otherwise breaks).

7) VM-based service isolation (avoid “one container breaks everything”)

  • VMs are used so that if one service fails (e.g., Nextcloud), you can restore just that service without rolling back everything else.
  • Creates VMs using Virtual Machine Manager (GUI).

8) Mail/Calendar/Contacts foundation: Mailcow (Docker) inside a VM

  • Runs mailcow in a dedicated mail VM using Docker:
    • docker compose pull
    • docker compose up -d
    • Requires Docker 24+
  • Web UI steps:
    • Change admin password
    • Add domain/mailboxes
    • Enable rate limiting
  • Calendar/contacts integration is implied via DAV protocols used later (CalDAV/CardDAV).

Mobile sync: DAVx for contacts/calendar

  • Uses DAVx5 on Android to connect to Mailcow calendars/contacts via CalDAV/CardDAV.
  • Sync behavior:
    • Phone changes push to the server
    • Server changes sync back on intervals
  • Emphasizes privacy: avoid pushing contacts/calendar to Google if avoiding that is the goal.

Next: Home Assistant (local-only smart home control)

  • Deploys Home Assistant OS as a VM (QEMU/KVM image).
  • Uses local API access on smart devices (thermostat example shown).
  • Assigns static IP and DHCP static mapping for Home Assistant.
  • Remote access:
    • Use OpenVPN to reach the Home Assistant UI and automations.

Next: Frigate for AI camera detection + alerts to Home Assistant

Camera setup

  • Example uses Hikvision cameras.
  • Finds streams via Nmap scanning for RTSP ports; tests with VLC.
  • Frigate runs via Docker (prefers an older version for better UI usability).

Frigate UI and detection tuning

  • Older Frigate UI is described as better for:
    • browsing events/clips
    • adjusting thresholds
  • Explains how confidence thresholds influence detections.

Automations and notifications

  • Installs HACS
  • Sets up:
    • an MQTT broker (typically Mosquitto)
    • MQTT integration in Home Assistant
    • Frigate blueprint to simplify automations (avoid hand-written YAML)
  • Notifications include mobile alerts (critical notifications option shown).
  • Example triggers include “intruder”-style detected events.

Security hardening for Frigate

  • Treats default Frigate UI on port 5000 as unsafe (missing auth/weak assumptions).
  • Implements:
    • Firewall/iptables rules so only Home Assistant can reach Frigate’s internal port
    • NGINX reverse proxy over HTTPS (self-signed certificate)
    • HTTP basic auth to require login for the UI
  • Validates:
    • direct port access fails
    • Home Assistant integration still works
    • external access uses HTTPS + login

File sync + “cloud alternatives” (SyncThing, Nextcloud, etc.)

SyncThing VM

  • Deploys a dedicated VM for SyncThing for file syncing.
  • Uses static IP and disables global discovery (manual addressing preferred).
  • Avoids common mistakes:
    • syncing the wrong DCIM folders
    • confusing camera vs other DCIM subfolders
  • Includes a “data recovery” lesson: apps saving to unexpected folders often leads people to back up the wrong directory.

Nextcloud usage

  • Uses Nextcloud primarily for notes (Post-it-like workflow).
  • Notes that Nextcloud is not the focus for contacts/calendar/email in this guide.

Office/document editing: OnlyOffice + WebDAV workaround

  • Deploys OnlyOffice (workspace edition via script + Docker).
  • Main issue:
    • OnlyOffice document server needs file access, and direct container volume mounting doesn’t work as expected.
  • Solution:
    • Run a WebDAV server (Python-based) to expose server folders to OnlyOffice
    • User-based auth via PAM (not plaintext users)
    • Demonstrates proper symlink creation so WebDAV directories are visible
  • Performance comparison:
    • OnlyOffice is described as faster/smoother than Nextcloud Office editing (Google Docs referenced too).

Notes system: Nextcloud Notes

  • Uses Nextcloud Docker setup for Notes.
  • Described as simple enough to maintain a Google Keep-like workflow.
  • Tradeoff mention:
    • Joplin might be better engineered, but Nextcloud Notes is chosen for familiarity and “Post-it note” UX.

Overall conclusions (product/review style emphasis)

  • Security
    • Prefer VPN tunneling + one exposed service
    • Router-level controls
    • Authenticated reverse proxy for exposed UIs
  • Reliability
    • Use stable versions (e.g., LTS)
    • Be careful with “wrong versions”
  • Usability
    • UI matters in self-hosting
    • Frigate’s older UI is preferred for browsing events/clips quickly
  • Avoiding paid cloud dependency
    • Everything should run locally to reduce vendor lockout/abuse
  • Caution about “cloud-like” misconfig
    • Wrong folders, wrong versions, and missing DNS/VPN rules can cause “data lost” scenarios

Main speakers/sources

  • Speaker/brand: “Lewis Rossman” / Futo (Futo Software channel/author)
  • Primary software referenced (as tools):
    • pfSense, OpenVPN, pfBlockerNG/Unbound, AdGuard DNS
    • Mailcow, DAVx5, Home Assistant, Frigate
    • HACS, MQTT broker (Mosquitto), Nginx
    • OnlyOffice, SyncThing, Nextcloud

Original video