IT Fundamentals Handbook

Proxmox

What it is: Proxmox VE (Virtual Environment) is a free, open-source Type 1 hypervisor built on Debian Linux. It runs full virtual machines (KVM) and lightweight Linux containers (LXC) side by side, all managed from a web interface with built-in backups, snapshots and clustering.

Video Tutorial: https://www.youtube.com/watch?v=_u8qTN3cCnQ

Visit https://www.proxmox.com/en/ go to downloads page and download the "Virtual Environment" ISO.

Next you need a boot loader to properly load the ISO onto a flash drive. I prefer Rufus: https://rufus.ie/en/

Select flash drive device and ISO image and start.

Rufus 49.2256 Interface

Once image is finished…

• Plug ethernet into soon to be Hypervisor Machine.
• Attach flasher drive into Hypervisor Machine.
• Boot to bios.
• Change boot option #1 to the flash drive.
• Reboot
• Follow through with installation
• Host name and static IP are of important note
• Once installation finishes. Set machine to the side. You can now log in using the web UI

Log into web server by typing in URL: https://(static IP):8006

Login and select PVE and then Shell.

# I like to install tailscale on the host that way I can remote/connect to into the machine outside of the network.
sudo apt update && sudo apt install -y curl
curl -fsSL https://tailscale.com/install.sh | sh

# This installs the latest version for your OS automatically.
# Start Tailscale service:
sudo tailscale up

You will see an authentication URL: "To authenticate, visit: https://login.tailscale.com/a/xxxxxx"

Copy the URL from SSH output and open it on your local browser.

Log in with your preferred identity provider (Google, GitHub, Microsoft, etc.)

Once authenticated, the machine will appear in your Tailscale admin dashboard.

Check Tailscale status:

tailscale status

On the left hand side select local(PVE). Here ISO images can be uploaded and container images can be uploaded and downloaded.

Windows

What it is: On Windows, a static IP is set in the network adapter’s IPv4 properties: instead of obtaining an address automatically, you enter the IP address, subnet mask, default gateway and DNS servers yourself.

SSH

What it is: SSH (Secure Shell) is the standard way to log in to and manage a Linux machine from another computer. Everything you type and see is encrypted, so you can run commands on a server as if you were sitting in front of it.

Install OpenSSH Server:

sudo apt update
sudo apt upgrade
sudo apt install openssh-server -y

Verify it is running:

sudo systemctl status ssh

Allow through the Firewall:

sudo ufw allow ssh

Key-Based Authentication

What it is: Key-based authentication replaces SSH passwords with a key pair: a private key that never leaves your computer and a public key you copy to the server. It is far harder to crack than a password and lets you log in without typing one.

Windows Video: https://www.youtube.com/watch?v=rf1J8XSEiO0

Windows

On your machine in command line:

ssh-keygen -t ed25519

Note file save path location!

If you want login username & password enter it. If not just enter enter enter…

On host machine:

mkdir -p ~/.ssh
nano ~/.ssh/authorized_keys

Paste contents of .pub file into nano authorized_keys

Ctrl+o (Then Enter to Save)
Ctrl+x (To Exit)

sudo nano /etc/ssh/sshd_config

Set password authentication to "no". Delete the # in its front.

Ctrl+o
Ctrl+x
sudo systemctl restart ssh

Mac

Mac Guide: https://www.youtube.com/watch?v=vpk_1gldOAE&list=LL&index=2

On your machine in command line:

ssh-keygen -t ed25519

Or

ssh-keygen rsa -b 4096

Note file save path location!

If you want login username & password enter it. If not just enter enter enter…

On host machine:

scp ~/.ssh/id_rsa.pub user@ipaddress:/home/user/.ssh/name_key.pub
cat ~/.ssh/name_key.pub >> ~/.ssh/authorized_keys
chmod 700 ~/.ssh/
chmod 600 ~/.ssh/*
nano ~/.ssh/authorized_keys

Paste contents of .pub file into nano authorized_keys

Ctrl+o
Ctrl+x
sudo nano /etc/ssh/sshd_config

Set password authentication to "no". Delete the # in its front.

Ctrl+o
Ctrl+x
sudo systemctl restart ssh

Vim/Nano

What it is: Vim and Nano are text editors that run in the terminal, used to edit configuration files directly on a server. Nano is simple, with its shortcuts listed at the bottom of the screen; Vim is more powerful and keyboard-driven, with a steeper learning curve.

Installation Steps

For Ubuntu, Debian, or Raspberry Pi OS:

sudo apt update
sudo apt install nano vim

For CentOS, RHEL, or Rocky Linux:

sudo dnf install nano vim-enhanced

For Arch Linux:

sudo pacman -S nano vim

How to use them

Using Nano:

• To open a file: nano filename.txt
• Save: Press Ctrl + O then Enter.
• Exit: Press Ctrl + X.
• Search: Press Ctrl + W.

Using Vim:

• To open a file: vim filename.txt
• Type Text: Press i to enter Insert Mode.
• Stop Typing: Press Esc to return to Normal Mode.
• Save & Exit: In Normal Mode, type :wq and hit Enter.
• Exit without Saving: In Normal Mode, type :q! and hit Enter.

Htop

What it is: htop is an interactive, color-coded process viewer for the terminal. It shows live CPU, memory and swap usage alongside every running process, and lets you sort, search and stop processes. It is the quickest way to see what is slowing a server down.

Depending on your Linux distribution, use the corresponding command below:

For Ubuntu, Debian, Linux Mint, or Kali:

sudo apt update
sudo apt install htop

For CentOS, RHEL, or Rocky Linux:

# First, enable the EPEL repository
sudo dnf install epel-release
# Then install htop
sudo dnf install htop

For Fedora:

sudo dnf install htop

For Arch Linux:

sudo pacman -S htop

How to use htop

Once installed, simply type htop in your terminal to launch it.

Quick Cheat Sheet for htop:

Once the interface is open, you can use these keyboard shortcuts to navigate:

• F2 (Setup): Customize the colors, meters, and columns.
• F3 (Search): Find a specific process by name.
• F4 (Filter): Hide everything except processes matching your keyword.
• F5 (Tree): See the parent-child relationship between processes.
• F6 (Sort): Choose to sort by CPU%, Memory%, PID, etc.
• F9 (Kill): Send a signal (like SIGKILL) to stop a process safely.
• F10 (Quit): Exit the program.

Net-tools

What it is: Net-tools is a package of classic Linux networking commands such as ifconfig, netstat, route and arp. They show network interfaces and IP addresses, open ports and connections, and the routing table, which makes them handy for troubleshooting connectivity.

Installation Steps

For Ubuntu, Debian, Linux Mint, or Kali:

sudo apt update
sudo apt install net-tools

For CentOS, RHEL, Fedora, or Rocky Linux:

sudo dnf install net-tools

For Arch Linux:

sudo pacman -S net-tools

What's inside net-tools

Quick Examples

Check your IP address: shows each network interface with its hardware (MAC) address, local IP address (inet) and packet statistics.

ifconfig

Check listening ports: shows which programs are listening on which ports (for example, port 80 for HTTP).

sudo netstat -plnt

Check your default gateway: shows the routing table; the line with destination 0.0.0.0 is your default gateway (usually your router).

route -n

CURL

What it is: curl is a command-line tool for sending and receiving data over URLs. It is used to download files and install scripts, test websites and APIs, and check whether a service is responding.

sudo apt install ca-certificates curl

Docker

What it is: Docker runs applications in containers: lightweight, isolated packages that bundle an app with everything it needs. A container runs the same way on any machine, so installing, updating or removing a service is one command and never clutters the host system.

Documentation: https://docs.docker.com/engine/install

# Add Docker's official GPG key:

sudo apt update
sudo apt install ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

# Add the repository to Apt sources:

sudo tee /etc/apt/sources.list.d/docker.sources <<EOF
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
Components: stable
Signed-By: /etc/apt/keyrings/docker.asc
EOF

Install the Docker packages:

sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
sudo apt update
sudo systemctl status docker
sudo systemctl start docker
sudo docker run hello-world

Docker Compose

What it is: Docker Compose describes one or more containers (their images, ports, volumes and settings) in a single docker-compose.yml file, then starts or stops the whole stack with one command. It is how most of the self-hosted apps on this page are deployed.

Documentation: https://docs.docker.com/compose/install/

Tailscale

What it is: Tailscale is a mesh VPN built on WireGuard. It links your computers, servers and phones into one private network (a “tailnet”), so they can reach each other securely from anywhere without opening ports on your router.

Connect to your remote server via SSH:

ssh user@your_server_ip

Ensure you have sudo privileges on the target machine.

Install Tailscale

Update package list (Debian/Ubuntu):

sudo apt update && sudo apt install -y curl

Download & install Tailscale:

curl -fsSL https://tailscale.com/install.sh | sh

This installs the latest version for your OS automatically.

Authenticate Server

Start Tailscale service:

sudo tailscale up

You will see an authentication URL: "To authenticate, visit: https://login.tailscale.com/a/xxxxxx"

Copy the URL from SSH output and open it on your local browser.

• Log in with your preferred identity provider (Google, GitHub, Microsoft, etc.)
• Once authenticated, the machine will appear in your Tailscale admin dashboard.

Firewall configuration

What it is: A firewall controls which network traffic may enter or leave a machine, using rules based on port, protocol and source address. On Ubuntu, UFW (Uncomplicated Firewall) is a simple front end to the firewall built into the Linux kernel.

Intrusion Detection/Prevention System (IDS/IPS)

What it is: An Intrusion Detection System (IDS) watches network traffic or system activity for signs of an attack and raises alerts; an Intrusion Prevention System (IPS) can also block that traffic automatically. Snort and Suricata are widely used open-source options.

Vulnerability scanning

What it is: Vulnerability scanning automatically checks systems for known weaknesses such as missing patches, outdated software, open ports and weak settings. Tools like Nessus and OpenVAS produce a report ranked by severity, so the most serious issues can be fixed first.

What DNS Is and Why It Exists

▶ Watch this in the tutorial (15:37)

• IP address: every device on a network (your PC, your phone, a web server) has an IP address, like a phone number for the internet. IPv4 looks like 192.168.1.10; IPv6 looks like 2606:50c0:8000::153 and exists because the world is running out of IPv4 numbers.
• Domain name: a human-friendly name that is easy to remember and doesn’t change when the server behind it moves to a new address.
• DNS: a worldwide, distributed database that maps names to addresses (and other information, such as which servers handle email). No single server holds everything; each domain’s records live with that domain’s DNS provider.

Without DNS you would have to type an IP address for every site. With it, a site can move to a new server and only its DNS record changes; everyone keeps using the same name.

How a DNS Lookup Works

When you type www.example.com into a browser, this happens in a fraction of a second:

1. Local cache: your browser and operating system first check whether they looked the name up recently. If so, they reuse the answer.
2. Recursive resolver: if not, the computer asks its configured DNS server, usually your router, your ISP, or a public resolver such as 1.1.1.1 (Cloudflare) or 8.8.8.8 (Google). The resolver does the legwork.
3. Root servers: the resolver asks a root server, “Who handles .com?”
4. TLD servers: the .com servers answer, “example.com is handled by these nameservers” (the domain’s NS records, set at the registrar).
5. Authoritative nameserver: the domain’s own DNS provider returns the actual record, for example the A record with the IP address.
6. Answer and caching: the resolver returns the IP to your computer, and every step caches the answer for the record’s TTL. The browser then connects to that IP and asks the web server for the page.

DNS Record Types

▶ Watch this in the tutorial (20:25)

Every record has the same four parts: Type, Host (name), Value and TTL.

Host / name field

• @ means the bare (root) domain itself, e.g. example.com. Some providers leave the field blank instead.
• Anything else is a subdomain in front of the domain: www → www.example.com, studio → studio.example.com. Subdomains let one domain host several separate sites.
• * is a wildcard that matches any subdomain without its own record, e.g. *.tail.example.com.

TTL and propagation

TTL (time to live) is how many seconds resolvers may cache a record. A short TTL such as 300 (5 minutes) means changes take effect quickly; a long TTL such as 3600 or 86400 means fewer lookups but slower changes. Lower the TTL a day before a planned move, then raise it again afterwards. “Propagation” is simply old cached answers expiring around the world, which is why new records can take anywhere from minutes to 24–48 hours to work everywhere.

How DNS Is Used

• Websites: A/AAAA and CNAME records point a domain at a web host, such as GitHub Pages (see the worked example below and Deploy an HTML Site).
• Email: MX records route incoming mail; TXT records hold SPF, DKIM and DMARC so other servers trust mail sent from the domain.
• Proving ownership: services ask you to add a TXT record (or CNAME) to verify a domain, and Let’s Encrypt can issue certificates through a DNS challenge, as in the wildcard certificate steps.
• Internal networks: companies run their own DNS (for example on Windows Server) so PCs find file servers, printers and domain controllers by name; Active Directory depends on it.
• Home lab: a local DNS server such as Pi-hole answers for your devices, can create local names like nas.home, and blocks ads by refusing to resolve ad domains.
• Load balancing and failover: several A records for one name spread visitors across servers, as GitHub Pages does with its four addresses.

Worked Example: Point a Domain at GitHub Pages

From the Deploy an HTML Site tutorial: link a domain bought at Namecheap to a website hosted on GitHub Pages.

Step 1: Open the domain’s DNS settings

▶ Watch this in the tutorial (18:51)

Namecheap: Account → Domain List → Manage → Advanced DNS → Host Records. Other registrars have a similar DNS records or Manage DNS page.

Step 2: Look up GitHub Pages’ IP addresses

▶ Watch this in the tutorial (21:56)

Use MxToolbox DNS Lookup on YOUR-USERNAME.github.io, or:

nslookup YOUR-USERNAME.github.io

Step 3: Add the records

▶ Watch this in the tutorial (22:20)

Checking DNS from the Command Line

Look up a domain’s A records (works on Windows, macOS and Linux):

nslookup example.com

Ask a specific DNS server, to compare answers or bypass your local cache:

nslookup example.com 1.1.1.1

Look up a specific record type:

nslookup -type=MX example.com
nslookup -type=TXT example.com
nslookup -type=NS example.com

Linux/macOS: dig gives more detail, including the TTL left on each answer:

dig example.com A +noall +answer
dig www.example.com CNAME +short
dig example.com MX +short
dig @1.1.1.1 example.com +short

Windows PowerShell:

Resolve-DnsName example.com -Type A
Resolve-DnsName example.com -Type MX -Server 1.1.1.1

Clear your computer’s DNS cache after changing records:

# Windows
ipconfig /flushdns

# Ubuntu / systemd-resolved
sudo resolvectl flush-caches
# macOS
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

Troubleshooting

Example Values Used in the Commands

The commands below use one consistent example setup so you can see exactly what goes where. The video doesn’t show its Pi-hole’s IP or username, so these are example values; change only these before pasting:

What Pi-hole Does

▶ Watch this step (0:35)

• Network-wide ad and tracker blocking: blocklists (“adlists”) contain hundreds of thousands of ad, tracking and malware domains. Lookups for them are blocked for every device that uses Pi-hole as its DNS server.
• DNS caching: answers are remembered, so repeat lookups are instant and browsing feels a little faster.
• Local DNS records: give home-lab machines easy names, e.g. ubuntu-server.home.arpa instead of 192.168.1.93.
• Query log and dashboard: see which devices look up what, how many queries were blocked, and the top domains.
• Optional DHCP server: Pi-hole can hand out IP addresses if your router can’t point clients at a custom DNS server.

Choosing Hardware

▶ Watch this step (1:18)

Pi-hole needs very little: about 512 MB of RAM and a few gigabytes of disk. It must be always on, because if it goes down, devices that rely on it can’t look up names.

Step 1: Prepare the Server (Debian)

▶ Watch this step (4:21)

1. Download a Debian netinst image (the video uses Debian 11 32-bit because the old Mac’s CPU is 32-bit; use 64-bit amd64 on any modern PC), and flash it to a USB drive with balenaEtcher or Rufus.
2. Boot from the USB drive and install Debian. At Software selection, untick every desktop environment (a server doesn’t need one) and tick “SSH server” so you can manage it remotely.
3. Remove the USB drive and reboot.

Update the system and install the basics

▶ Watch this step (4:51)

Log in at the console, switch to root, update everything and install sudo, net-tools and curl:

su -
apt update && apt upgrade -y
apt install -y sudo net-tools curl

Find the server’s IP address (look for inet 192.168.x.x):

ifconfig
# or, without net-tools:
ip a

Give your user sudo rights and switch to SSH

▶ Watch this step (5:10)

Now you can unplug the monitor and keyboard and connect from another computer over SSH. The example user is haven and the server is 192.168.1.53; use your own values from the table above:

ssh haven@192.168.1.53
su -
usermod -aG sudo haven
exit

Log out and back in, then confirm sudo works (it should print root):

sudo whoami

Step 2: Give the Server a Fixed IP Address

▶ Watch this step (6:01)

Every device will be told “your DNS server is this IP”, so the IP must never change. Choose one:

• DHCP reservation (easiest, used in the video): in your router’s admin page, find the DHCP / LAN settings and reserve the server’s current IP for its MAC address (see MAC Addresses).
• Static IP on the server: set the address on the server itself. See Static IP (Ubuntu uses Netplan; Debian uses /etc/network/interfaces). Pick an address outside the router’s DHCP range.

Step 3: Install Pi-hole

▶ Watch this step (5:32)

Run the official one-line installer from pi-hole.net:

curl -sSL https://install.pi-hole.net | bash

The installer is a text menu (use arrow keys, Space to select, Enter to confirm):

▶ Watch this step (6:21)

When it finishes, it shows the admin address (http://192.168.1.53/admin) and a random password.

Set your own admin password

▶ Watch this step (6:44)

# Pi-hole v6 (current)
sudo pihole setpassword

# Pi-hole v5 (older installs, as shown in the video)
sudo pihole -a -p

Alternative: Run Pi-hole in Docker

If you already run Docker on a home server, Pi-hole runs well as a container. Create a folder (e.g. ~/docker/pihole) with this docker-compose.yml:

services:
  pihole:
    image: pihole/pihole:latest
    container_name: pihole
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "8080:80/tcp"      # admin page at http://192.168.1.53:8080/admin
    environment:
      TZ: "America/New_York"
      FTLCONF_webserver_api_password: "CHANGE-ME"
      FTLCONF_dns_listeningMode: "all"
    volumes:
      - ./etc-pihole:/etc/pihole
    restart: unless-stopped

cd ~/docker/pihole
sudo docker compose up -d
sudo docker logs -f pihole

Step 4: Tour the Admin Page

▶ Watch this step (6:54)

Open http://192.168.1.53/admin and sign in.

Step 5: Test It on One Computer

▶ Watch this step (7:07)

Before switching the whole network, point a single PC at Pi-hole:

1. Windows: Settings → Network & Internet → your adapter → DNS server assignment → Edit → Manual → IPv4 on → Preferred DNS = the Pi-hole IP → Save.
2. Open an ad-heavy web page, then hard-refresh (Ctrl+F5). Many of the ads should be gone.
3. Open Query Log in the admin page to watch the blocked requests appear.

Confirm from a terminal: a blocked domain returns 0.0.0.0, a normal one returns a real IP.

nslookup doubleclick.net 192.168.1.53
nslookup google.com 192.168.1.53

Step 6: Use Pi-hole for the Whole Network

▶ Watch this step (7:37)

Your router tells every device which DNS server to use when it hands out IP addresses (DHCP). Change that setting once and every device follows:

Option A: router DHCP DNS setting (recommended). In the router’s admin page, find the DHCP / LAN settings and set the DNS server to the Pi-hole’s IP. Devices pick it up when they renew their address. Reconnect them or wait for their lease to renew.

Option B: router WAN/Internet DNS. Some routers only let you change their own upstream DNS. Setting it to Pi-hole works, but every query then shows up as coming from the router, so you lose per-device stats.

▶ Watch this step (8:08)

Option C: Pi-hole as the DHCP server. If the router can’t change DNS at all, turn off DHCP on the router, then enable it in Pi-hole under Settings → DHCP (set the address range and the router’s IP as the gateway). Only ever run one DHCP server on a network.

Once devices switch over, their IP addresses start appearing in the Query Log.

Step 7: Local DNS Records for Your Home Lab

▶ Watch this step (8:20)

Stop memorizing IP addresses: Local DNS → DNS Records, enter a Domain and the device’s IP, and click Add.

# from any device that uses Pi-hole
ping ubuntu-server.home.arpa
ssh haven@ubuntu-server.home.arpa

Managing Blocklists, Allowlists and Updates

• Add a blocklist: Lists (v5: Adlists) → paste the list URL → Add, then update gravity so it downloads. Start with the default list; adding many aggressive lists blocks more but breaks more sites.
• A site broke? Open the Query Log, find the blocked domain from your device around that time, and click Allow. Or add it under Domains.
• Block one extra domain: Domains → add it to the denylist.
• Pause blocking for troubleshooting from the dashboard menu, or from the command line below.

Update Debian itself regularly too:

sudo apt update && sudo apt upgrade -y

Security and Optional Extras

• Never expose port 53 to the internet. An open DNS resolver gets abused in DDoS attacks. Keep Pi-hole on your LAN, or reach it remotely over a VPN such as Tailscale, which can push Pi-hole as the DNS server for all your devices away from home.
• Back up your settings: Settings → Teleporter exports and import all lists and records. For Docker, back up the etc-pihole folder.
• Redundancy: run a second Pi-hole on another device and set it as the secondary DNS, so blocking keeps working if one goes down.
• Unbound (optional): instead of forwarding to Cloudflare or Google, Pi-hole can use a local Unbound recursive resolver that asks the root servers directly, so no single upstream provider sees all your lookups. See the official “Pi-hole as All-Around DNS Solution” guide.

Troubleshooting

Choosing a RAID Level

Use disks of the same size. The array treats every member as the size of the smallest one.

Homelab Build: A Host-Owned Mirror on Proxmox

This is the setup running in the homelab. The Proxmox host owns the RAID: it assembles the mdadm mirror, formats it ext4 and mounts it at /mnt/raid. VM 100 (Ubuntu) receives that folder through virtiofs and shares it on the network with Samba. Proxmox writes its backups straight to the RAID, so backups no longer depend on VM 100 being up.

The steps start from two blank 20 TB drives and an existing Ubuntu VM (VM 100). Part 1 builds the RAID and Part 2 shares it; backing up to it and email alerts are in the Backups section. If you’re running Ubuntu directly on the hardware with no Proxmox, use Standalone Server below instead.

Golden rules (each one comes from a real problem in Troubleshooting):

• One owner per disk. Each disk or array is assembled and mounted by exactly one system: here, the host.
• Never give a VM a RAID’s member disks. If a VM sees the raw drives, it can assemble its own copy of the array, and two RAID drivers end up managing the same disks.
• Never mount one filesystem in two places at once. Share folders with virtiofs or Samba instead.
• Refer to disks by /dev/disk/by-id/..., never /dev/sdX, which can change between boots.
• Run long commands in tmux and paste one code block at a time.
• Never put a password inside a command you paste into a chat, ticket or screenshot. Use the read -s prompt shown in Email Notifications, run on its own line.

Before You Start

About an hour of hands-on work; the new mirror then syncs in the background for about a day while it is already usable.

• ☐ Two identical 20 TB drives installed in the server. Everything on them will be erased.
• ☐ Proxmox VE 8.4 or newer (check with pveversion); virtiofs needs it.
• ☐ VM 100 running Ubuntu 24.04, with a DHCP reservation in your router so its LAN IP never changes.
• ☐ Work from the local network or the console, not over Tailscale through VM 100.
• ☐ tmux and gdisk installed on the host: apt install -y tmux gdisk, then start a session with tmux (reattach later with tmux attach).

Identify the two drives

lsblk -d -o NAME,SIZE,MODEL,SERIAL
ls -l /dev/disk/by-id/ | grep -E "ata-.*sd[a-z]$"

Match each 18.2T drive to its ata-... name, then save both names in variables. Re-run these two lines in every new shell:

D1=/dev/disk/by-id/ata-ST20000NE000-3G5101_SERIAL01
D2=/dev/disk/by-id/ata-ST20000NE000-3G5101_SERIAL02

Part 1: Build the RAID on the Proxmox Host

The host wipes both drives, creates one partition on each, mirrors them as /dev/md0, formats it ext4 and mounts it at /mnt/raid. Run everything as root on the Proxmox host, inside tmux, with D1 and D2 set.

1. Confirm the drives are the right ones and unused

lsblk -o NAME,SIZE,FSTYPE,MOUNTPOINT $D1 $D2
wipefs -n $D1 $D2

Both should be 18.2T with nothing mounted. wipefs -n only lists old signatures; it changes nothing.

2. Erase and partition both drives

wipefs -a $D1 $D2
sgdisk --zap-all $D1
sgdisk --zap-all $D2
sgdisk -n 1:0:-100M -t 1:FD00 -c 1:raid $D1
sgdisk -n 1:0:-100M -t 1:FD00 -c 1:raid $D2
partprobe; udevadm settle
ls -l ${D1}-part1 ${D2}-part1

3. Create the mirror

mdadm --create /dev/md0 --level=1 --raid-devices=2 --metadata=1.2 \
  --bitmap=internal --name=raid ${D1}-part1 ${D2}-part1
cat /proc/mdstat

/proc/mdstat shows resync with a progress bar. It takes about a day on 20 TB drives; you can use the array right away. The internal bitmap makes a resync after a crash or a briefly missing disk take minutes instead of a day.

4. Format it

mkfs.ext4 -L raid -m 0 /dev/md0

-m 0 skips the 5% root reserve, which would waste about 900 GB on a data-only disk.

5. Make the host assemble it at every boot

sed -i -e '/^AUTO -all/d' -e '/^ARRAY/d' /etc/mdadm/mdadm.conf
mdadm --detail --scan >> /etc/mdadm/mdadm.conf
grep -E "^(ARRAY|AUTO)" /etc/mdadm/mdadm.conf
update-initramfs -u -k all

grep should show one ARRAY /dev/md0 ... name=...:raid line and no AUTO -all. Wait for update-initramfs to return to the prompt before doing anything else; do not reboot while it runs.

6. Mount it permanently

mkdir -p /mnt/raid
chattr +i /mnt/raid
echo "UUID=$(blkid -s UUID -o value /dev/md0) /mnt/raid ext4 defaults,nofail 0 2" >> /etc/fstab
systemctl daemon-reload
mount -a
findmnt /mnt/raid
df -h /mnt/raid

chattr +i locks the empty mount folder, so nothing can write to the boot disk if the RAID ever fails to mount. findmnt should show /dev/md0 as ext4, and df about 18T.

Part 2: Give the RAID to VM 100 and Share It with Samba

virtiofs hands VM 100 the host’s /mnt/raid folder directly: no disks are passed to the VM, so it can never build its own copy of the array. Samba in the VM then shares that folder on your network.

1. On the host: create the folder mapping and attach it

pvesh create /cluster/mapping/dir --id raid --map node=pve,path=/mnt/raid
qm shutdown 100 --timeout 300
qm status 100
qm set 100 --virtiofs0 dirid=raid
qm start 100

Run qm set only after qm status says stopped. Replace pve with your node name if it’s different. In the web UI this is Datacenter → Directory Mappings → Add, then VM 100 → Hardware → Add → Virtiofs.

2. Inside VM 100: mount it

sudo mkdir -p /mnt/raid
echo "raid /mnt/raid virtiofs defaults,nofail 0 0" | sudo tee -a /etc/fstab
sudo systemctl daemon-reload
sudo mount -a
findmnt /mnt/raid

raid is the mapping name from step 1. findmnt should show source raid, type virtiofs.

3. Inside VM 100: create the share group and set permissions

sudo groupadd raidusers
sudo usermod -aG raidusers haven
sudo chown haven:raidusers /mnt/raid
sudo chmod 2775 /mnt/raid

For each extra person (for example alex), run sudo adduser alex and sudo usermod -aG raidusers alex. The 2 in 2775 makes new folders inherit the group.

4. Inside VM 100: install Samba and add the share

sudo apt update && sudo apt install -y samba
sudo tee -a /etc/samba/smb.conf > /dev/null <<'EOF'

[RAID]
   path = /mnt/raid
   valid users = @raidusers
   force group = raidusers
   read only = no
   create mask = 0664
   directory mask = 2775
   veto files = /proxmox-backups/
EOF
sudo testparm -s > /dev/null && echo "config OK"

veto files hides the Proxmox backup folder from network users, which keeps ransomware on a PC away from your backups.

5. Inside VM 100: give each user a Samba password and start Samba

sudo smbpasswd -a haven
sudo systemctl enable --now smbd
sudo systemctl restart smbd
sudo ufw status

The Samba password is separate from the Linux login password. Repeat smbpasswd -a for each user. If ufw is active, also run sudo ufw allow Samba.

6. Test the share

On Windows, open \\192.168.1.51\RAID in File Explorer. From the Proxmox host:

apt install -y smbclient
smbclient //192.168.1.51/RAID -U haven -m SMB3 -c 'ls'

Verification

Run these after the build and again after the first host reboot; every row should match. Backup and email checks are in Backups → Verification.

Standalone Server: Setting Up a RAID Array over SSH

Use this when Ubuntu runs directly on the hardware with no Proxmox. On Proxmox, follow the Homelab Build above instead.

The examples below use the disks /dev/sdb, /dev/sdc, /dev/sdd and /dev/sde, the array name /dev/md0, and the mount point /mnt/raid. Replace the disk names with your own from Step 3.

Step 1: Connect to the server

From your computer, open a terminal (PowerShell on Windows) and connect:

ssh username@server-ip

Step 2: Update the system and install mdadm

sudo apt update
sudo apt upgrade -y
sudo apt install mdadm -y

If the installer shows a mail configuration screen (Postfix), choose No configuration unless you already run a mail server.

Step 3: Identify the disks

List every disk with its size and whether it is already in use:

lsblk -o NAME,SIZE,FSTYPE,TYPE,MOUNTPOINTS

For more detail, including the model of each disk:

sudo fdisk -l

The new, empty disks usually show no partitions and no mount point. Write down their names (for example sdb, sdc).

Step 4: Wipe old data from the disks

Remove any old partition tables or filesystem signatures (list every disk you will use):

sudo wipefs -a /dev/sdb /dev/sdc

If a disk was ever part of another RAID array, also clear its old RAID metadata. An error saying “Unrecognised md component device” just means there was nothing to clear.

sudo mdadm --zero-superblock /dev/sdb /dev/sdc

Step 5: Create the array

Run only the one command for the RAID level you chose. When asked Continue creating array?, type y and press Enter.

RAID 1 (2 disks):

sudo mdadm --create --verbose /dev/md0 --level=1 --raid-devices=2 /dev/sdb /dev/sdc

RAID 5 (3 disks):

sudo mdadm --create --verbose /dev/md0 --level=5 --raid-devices=3 /dev/sdb /dev/sdc /dev/sdd

RAID 6 (4 disks):

sudo mdadm --create --verbose /dev/md0 --level=6 --raid-devices=4 /dev/sdb /dev/sdc /dev/sdd /dev/sde

RAID 10 (4 disks):

sudo mdadm --create --verbose /dev/md0 --level=10 --raid-devices=4 /dev/sdb /dev/sdc /dev/sdd /dev/sde

RAID 0 (2 disks, no redundancy):

sudo mdadm --create --verbose /dev/md0 --level=0 --raid-devices=2 /dev/sdb /dev/sdc

Step 6: Watch the initial sync

RAID 1, 5, 6 and 10 now sync the disks in the background. This can take hours on large drives. Check progress:

cat /proc/mdstat

Or refresh it every 5 seconds (press Ctrl + C to stop watching):

watch -n 5 cat /proc/mdstat

You can keep going with the next steps while it syncs. The array is usable right away, just slower until the sync finishes.

Step 7: Create a filesystem

sudo mkfs.ext4 -F /dev/md0

Step 8: Mount the array

sudo mkdir -p /mnt/raid
sudo mount /dev/md0 /mnt/raid

Confirm it is mounted and shows the expected size:

df -h /mnt/raid

Step 9: Make the array survive a reboot

Save the array layout so Ubuntu reassembles it at boot:

sudo mdadm --detail --scan | sudo tee -a /etc/mdadm/mdadm.conf
sudo update-initramfs -u

Add the array to /etc/fstab by its UUID so it mounts automatically. nofail lets the server still boot if the array has a problem:

echo "UUID=$(sudo blkid -s UUID -o value /dev/md0) /mnt/raid ext4 defaults,nofail 0 2" | sudo tee -a /etc/fstab

Test the fstab entry without rebooting. No output from mount -a means it worked:

sudo umount /mnt/raid
sudo mount -a
findmnt /mnt/raid

Step 10: Give your user access

The new filesystem is owned by root. Let your own account read and write to it:

sudo chown -R $USER:$USER /mnt/raid

Step 11: Reboot and verify

sudo reboot

Wait a minute, reconnect with SSH, then check the array:

ssh username@server-ip

cat /proc/mdstat
sudo mdadm --detail /dev/md0
df -h /mnt/raid

In the mdadm --detail output, look for State : clean (or active) and every disk listed as active sync.

Checking Health and Replacing a Failed Disk

Check array health

cat /proc/mdstat
sudo mdadm --detail /dev/md0

In /proc/mdstat, [UU] means every disk is up. An underscore, such as [U_], means a disk has failed or is missing and the array is running degraded.

Check a single disk’s own health report (install the tools first):

sudo apt install smartmontools -y
sudo smartctl -H /dev/sdb

Replace a failed disk

1. Find which disk failed (it is marked faulty or removed):

sudo mdadm --detail /dev/md0

2. Mark the disk as failed and remove it from the array (replace /dev/sdc with the failed disk):

sudo mdadm /dev/md0 --fail /dev/sdc
sudo mdadm /dev/md0 --remove /dev/sdc

3. Note the failed disk’s serial number so you pull the right physical drive, then shut down and swap it:

sudo smartctl -i /dev/sdc | grep -i serial
sudo shutdown now

4. After booting back up and reconnecting over SSH, find the new disk’s name with lsblk, then add it to the array (here the new disk is /dev/sdf):

lsblk -o NAME,SIZE,FSTYPE,TYPE,MOUNTPOINTS
sudo wipefs -a /dev/sdf
sudo mdadm /dev/md0 --add /dev/sdf

5. Watch the rebuild until it reaches 100%:

watch -n 5 cat /proc/mdstat

Troubleshooting

For how the original homelab setup differed from this build and why it failed, see Troubleshoots → What Was Wrong with the Original Homelab Setup.

Problems hit during the homelab build

General mdadm problems

The array shows up as /dev/md127 after a reboot

The layout was not saved in Step 9. Stop the array, reassemble it under the right name, and save the config:

sudo umount /mnt/raid
sudo mdadm --stop /dev/md127
sudo mdadm --assemble --scan
sudo mdadm --detail --scan | sudo tee -a /etc/mdadm/mdadm.conf
sudo update-initramfs -u
sudo mount -a

The array is inactive or not mounted after a reboot

sudo mdadm --assemble --scan
sudo mount -a
cat /proc/mdstat

“Device or resource busy” when creating or stopping the array

Something is still using the disk. Check for mount points, then unmount before trying again:

lsblk -o NAME,MOUNTPOINTS
sudo umount /dev/sdb1

Deleting an array completely

sudo umount /mnt/raid
sudo mdadm --stop /dev/md0
sudo mdadm --zero-superblock /dev/sdb /dev/sdc

Then remove the /dev/md0 line from /etc/mdadm/mdadm.conf and the /mnt/raid line from /etc/fstab (sudo nano each file), and run sudo update-initramfs -u.

Example Values Used in the Commands

Every command on this page uses the same example setup as the video, so you can see exactly what goes where. If yours are different, change only these values before pasting:

Choosing the Hardware

▶ Watch this step (0:37)

The video uses a 2013 HP Pavilion 500-a60 bought for about $15: a quad-core AMD A6-5200 (2 GHz), 8 GB RAM and a 65 W external power supply. Its 128 GB SSD was swapped for a used 2 TB hard drive (about $15–20) for more storage.

• Low power draw matters most for a machine that runs 24/7. Look for small or “low-power” desktops, laptops or mini PCs.
• RAM: 4 GB is enough for file sharing; 8 GB+ if you’ll also run Plex, Home Assistant and Docker containers.
• Storage: boot from a small SSD if you can, and store data on larger hard drives. Speed matters little for a home server.
• Network: use wired gigabit Ethernet. The Pavilion’s built-in port was only 100 Mb/s, so the video switched to a cheap USB 3 gigabit adapter.

Step 1: Install Ubuntu

▶ Watch this step (2:28)

1. Download the LTS (long-term support) release of Ubuntu from ubuntu.com. The video uses Ubuntu Desktop to keep things simple; Ubuntu Server (no desktop) is lighter and better once you’re comfortable with the command line.
2. Create a bootable USB drive with Rufus (Windows): select the USB drive, select the Ubuntu .iso, click Start, and accept the prompts. The default settings are fine.
3. Boot the server from the USB drive and choose Install Ubuntu.
4. Skip Wi-Fi (use wired Ethernet), choose Minimal installation, and tick download updates and install third-party drivers (set a Secure Boot password if asked).
5. On Installation type, choose Erase disk and install Ubuntu (this wipes the drive), then set your time zone, computer name, username and password.

Step 2: Static IP and SSH

▶ Watch this step (4:25)

Give the server a fixed address so the share, Plex and Home Assistant are always in the same place. In Ubuntu Desktop: Settings → Network → (gear icon) → IPv4 → Manual, then enter an unused address (the video uses 192.168.1.51), netmask 255.255.255.0, your router as the gateway (often 192.168.1.1) and a DNS server. Turn the connection off and on to apply it. On Ubuntu Server use Netplan; see Static IP. A DHCP reservation on your router works too.

▶ Watch this step (5:05)

Install the SSH server so you can manage the machine from another computer and put it away without a monitor (see SSH):

sudo apt update
sudo apt install -y openssh-server
sudo systemctl status ssh

Now connect from your Windows PC. Open PowerShell and type ssh, then your username, @ and the server’s IP. Type yes the first time, then your password. From now on you can paste every “on the server” command into this window:

ssh haven@192.168.1.51

Step 3: Share a Folder with Samba

▶ Watch this step (6:17)

Install Samba and check it worked:

sudo apt update
sudo apt install -y samba
samba --version

▶ Watch this step (6:38)

Create the folder to share. ~ means your home folder, so this makes /home/haven/haven-share:

mkdir ~/haven-share

▶ Watch this step (6:51)

Open Samba’s settings file in the nano text editor:

sudo nano /etc/samba/smb.conf

Use the arrow keys to scroll to the very bottom of the file and paste these lines. Save and exit with Ctrl+X, then Y, then Enter:

[haven-share]
   comment = Haven's network share
   path = /home/haven/haven-share
   browseable = yes
   read only = no

▶ Watch this step (7:17)

Restart Samba so it loads the new share, and allow it through the firewall:

sudo systemctl restart smbd
sudo ufw allow samba

▶ Watch this step (7:25)

Give your user a Samba password. This is the password you’ll type when connecting from other computers (it can be the same as your login password). Type it twice when asked:

sudo smbpasswd -a haven

Step 4: Connect from Your Computers

▶ Watch this step (7:41)

Windows: File Explorer → This PC → Map network drive, pick a drive letter, enter the folder path below, tick Connect using different credentials and click Finish. When asked, sign in with username haven and the Samba password from Step 3. The share now shows up under This PC like any other drive.

\\192.168.1.51\haven-share

macOS: Finder → Go → Connect to Server, enter smb://192.168.1.51/haven-share, click Connect and sign in the same way.

Linux: there are two ways to connect; see Linux: Two Ways to Connect below.

Phones and TVs: most file-manager and media apps have an “SMB” or “network share” option. Use the same IP, share name, username and password.

Linux: Two Ways to Connect

Both routes do the same thing in the end: the haven-share folder on the server shows up as a folder on your Linux computer, and you log in with the same username (haven) and the same Samba password. The difference is who types the password, and when.

First, it helps to know the two password pieces involved, because they’re easy to mix up:

Route A: Sign In with Your Samba Password (Recommended)

1. Make sure the Samba password is set. You already did this in Step 3; run it again any time to reset the password:

sudo smbpasswd -a haven

2. Connect from the Linux computer. Open Files → Other Locations, type the address below in Connect to Server and click Connect. Choose Registered User, enter username haven and the Samba password, and pick Remember forever so next time it’s one click. Right-click the share in the sidebar and Add Bookmark to keep it handy.

smb://192.168.1.51/haven-share

Prefer the terminal? This mounts the share at /mnt/haven-share and asks for the Samba password (nothing shows while you type). It stays connected until you restart the computer:

sudo apt install -y cifs-utils
sudo mkdir -p /mnt/haven-share
sudo mount -t cifs //192.168.1.51/haven-share /mnt/haven-share -o username=haven,uid=$(id -u),gid=$(id -g)

To disconnect: sudo umount /mnt/haven-share.

Route B: Auto-Mount at Boot with fstab

Use this on a Linux computer (not the server) that should always have the share at /mnt/haven-share, even before anyone signs in. On Windows, ticking Reconnect at sign-in in Map network drive is the equivalent. The example assumes your username on that computer is also haven, and that the Samba password is already set on the server with sudo smbpasswd -a haven.

1. Install the tools for mounting Windows/Samba shares:

sudo apt install -y cifs-utils

2. Create the folder the share will appear in (the “mount point”):

sudo mkdir -p /mnt/haven-share

3. Save a copy of the Samba password on this computer in ~/.smbcredentials. This is the “note by the door”: the same password you set with smbpasswd, kept here so the computer can log in at startup. Pick either way:

Option 1 (easiest): one command. It asks for the password and hides it as you type, then writes the file and makes it readable only by you:

read -rsp "Samba password for haven: " SMBPASS; echo
printf 'username=haven\npassword=%s\n' "$SMBPASS" > ~/.smbcredentials
unset SMBPASS
chmod 600 ~/.smbcredentials

Option 2: write it in a text editor. Open a new file:

nano ~/.smbcredentials

Paste these two lines, replacing the password with your Samba password, then save with Ctrl+X, Y, Enter:

username=haven
password=YourSambaPassword

Make the file readable only by you:

chmod 600 ~/.smbcredentials

Either way, check it with cat ~/.smbcredentials. If you ever change the password with smbpasswd on the server, update this file too.

4. Find your user and group ID numbers (so the files show up as yours). On most single-user systems both are 1000:

id -u
id -g

5. Add the share to /etc/fstab, the file Linux reads at startup to know what to mount:

sudo nano /etc/fstab

Go to the bottom of the file and paste this as one line. If step 4 showed numbers other than 1000, change them. Save and exit:

//192.168.1.51/haven-share  /mnt/haven-share  cifs  credentials=/home/haven/.smbcredentials,uid=1000,gid=1000,_netdev,nofail  0  0

6. Test it without rebooting. mount -a mounts everything in /etc/fstab; if it prints no errors and ls shows your files, it will also work at boot:

sudo systemctl daemon-reload
sudo mount -a
ls /mnt/haven-share

Storage, Protection and Next Steps

• One drive means no redundancy. The video stores everything on a single 2 TB disk; if it fails, the data is gone. Add a second drive and mirror them with RAID 1, or use a NAS OS that handles redundancy for you.
• RAID is not a backup. Follow the 3-2-1 rule: 3 copies of important data, on 2 different types of storage, with 1 copy off-site (see Backups).
• Folder layout: keep media in one place, e.g. ~/haven-share/plex/movies and ~/haven-share/plex/shows, so Plex and the share use the same folders.
• Keep it on the LAN: don’t forward Samba (port 445) through your router. For access away from home, use a VPN such as Tailscale.
• Check disk health now and then: sudo apt install smartmontools, then sudo smartctl -H /dev/sda.
• Dedicated NAS systems: if you’d rather click than type, TrueNAS, OpenMediaVault and Unraid are operating systems built just for NAS boxes, with web dashboards, RAID and app support.

Troubleshooting

Before You Start

• An Ubuntu server you can reach over SSH (see SSH). The video starts from a freshly cloned Ubuntu VM.
• Docker Engine installed from Docker’s official apt repository (see Docker).
• A domain name whose DNS is managed by Cloudflare (other DNS providers work too; the steps are similar).

▶ Watch this step (0:51)

Confirm Docker and the Compose plugin are installed:

sudo docker --version
sudo docker compose version

Install Nginx Proxy Manager

▶ Watch this step (1:22)

Step 1: Create a folder for your Docker apps

Keep every app in its own folder under ~/docker:

mkdir -p ~/docker/npm
cd ~/docker/npm

Step 2: Create the Compose file

nano docker-compose.yml

Paste the following. NPM runs in host network mode, so it listens directly on the server’s ports 80, 443 and 81 and can reach other apps at 127.0.0.1:

services:
  npm:
    image: 'jc21/nginx-proxy-manager:latest'
    container_name: npm
    restart: unless-stopped
    network_mode: host
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt

Save with Ctrl + O, Enter, and exit with Ctrl + X.

  goaccess:
    image: xavierh/goaccess-for-nginxproxymanager:latest
    container_name: goaccess
    restart: unless-stopped
    ports:
      - '7880:7880'
    environment:
      - TZ=America/New_York
      - SKIP_ARCHIVED_LOGS=False
      - LOG_TYPE=NPM
    volumes:
      - ./data/logs:/opt/log

Step 3: Start it

sudo docker compose up -d
sudo docker compose ps

The first start pulls the images, then the status shows running.

Step 4: Log in and create your admin account

▶ Watch this step (3:55)

Open http://localhost:81 on the server, or http://192.168.1.51:81 (your server’s IP) from another computer on your network.

• Log in with the default Email: admin@example.com and Password: changeme.
• NPM immediately asks you to change the name, email and password. Use your real email and a strong password.
• Newer versions of NPM skip the default login and ask you to create the admin account on the first visit instead.

Get a Wildcard SSL Certificate (Cloudflare DNS Challenge)

Because the apps will only be reachable over Tailscale, Let’s Encrypt cannot reach the server to verify it. Instead, NPM proves you own the domain by creating a DNS record through Cloudflare’s API (a DNS challenge). One wildcard certificate for *.tail.example.com then covers every private app: vault.tail.example.com, and anything you add later.

Step 1: Create a Cloudflare API token

▶ Watch this step (6:41)

1. Log in to dash.cloudflare.com.
2. Go to My Profile → API Tokens → Create Token.
3. Next to Edit zone DNS, click Use template.
4. Under Zone Resources, choose Include → Specific zone → your domain.
5. Click Continue to summary, then Create Token.
6. Copy the token and keep it somewhere safe for the next step. Cloudflare only shows it once.

Step 2: Request the certificate in NPM

▶ Watch this step (6:06)

In NPM, go to SSL Certificates → Add SSL Certificate → Let’s Encrypt and fill in:

The Credentials File Content box should contain exactly one line with your token:

dns_cloudflare_api_token = PASTE-YOUR-CLOUDFLARE-TOKEN-HERE

Click Save. After a minute the certificate appears in the list with an expiry date. NPM renews it automatically.

Add a Proxy Host

Each app gets its own proxy host. The Vault Warden section shows the exact values for Vaultwarden.

1. Go to Hosts → Proxy Hosts → Add Proxy Host.
2. Details tab: enter the full domain (e.g. app.tail.example.com), Scheme http, Forward Hostname 127.0.0.1 (NPM is in host mode), and the port the app is published on.
3. SSL tab: choose the *.tail.example.com wildcard certificate, and turn on Force SSL, HTTP/2 Support and HSTS Enabled.
4. Click Save.

Updating and Troubleshooting

Update Nginx Proxy Manager

cd ~/docker/npm
sudo docker compose pull
sudo docker compose up -d
sudo docker image prune -f

View the logs

Follow the logs live (press Ctrl + C to stop):

cd ~/docker/npm
sudo docker compose logs -f

NPM will not start: “address already in use”

Something else (often Apache or a regular NGINX install) is already using port 80 or 443. Find it and turn it off:

sudo ss -tulpn | grep -E ":80 |:443 "

sudo systemctl disable --now apache2
sudo systemctl disable --now nginx

The certificate request fails

• Check the API token was created from the Edit zone DNS template and includes your domain.
• Check the credentials line has no extra spaces or quotes around the token.
• Wait a few minutes and try again; Let’s Encrypt limits repeated failed attempts.

502 Bad Gateway

NPM cannot reach the app. Check the app is running and published on the port you entered:

sudo docker ps

Before You Start

• Docker installed (see Docker).
• Nginx Proxy Manager installed and the wildcard certificate issued.

Connect the Server to Tailscale

▶ Watch this step (4:33)

Tailscale puts your server and your devices on a private, encrypted WireGuard network (your tailnet) so you can reach the vault from anywhere without opening any ports.

1. Create a free account at tailscale.com.
2. In the admin console, click Add device → Linux server.
3. Set the auth key expiry to 1 day (it is only used now), then click Generate install script and copy it.
4. Paste the script into the server’s terminal and run it. It looks like the commands below.

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

Back in the Tailscale admin console under Machines, the server now appears with a Tailscale IP address starting with 100.. You can also print it on the server:

tailscale ip -4

Copy this IP. The DNS record in the next step points to it.

Point the Domain at Your Tailscale IP

▶ Watch this step (7:52)

This public DNS record points to a private Tailscale address, so it only leads anywhere for devices that are on your tailnet. Everyone else gets nowhere.

1. In Cloudflare, open your domain and go to DNS → Records → Add record.
2. Fill in the record using the table below, then click Save.

Deploy Vaultwarden

▶ Watch this step (8:30)

Step 1: Create a folder

mkdir -p ~/docker/vault
cd ~/docker/vault

Step 2: Create the Compose file

This is the Compose example from the Vaultwarden GitHub page, with two changes: the port is mapped to 1776 (NPM already uses 80), and DOMAIN is set to your vault address.

nano docker-compose.yml

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      DOMAIN: "https://vault.tail.example.com"
    volumes:
      - ./vw-data/:/data/
    ports:
      - 1776:80

Step 3: Start it

sudo docker compose up -d
sudo docker compose ps

Create the Proxy Host in NPM

▶ Watch this step (9:52)

In Nginx Proxy Manager go to Hosts → Proxy Hosts → Add Proxy Host:

Click Save, then browse to https://vault.tail.example.com from the server. You should see the Vaultwarden login page with a padlock.

Create Your Account and Turn On Two-Step Login

Step 1: Create your account

▶ Watch this step (11:06)

On the login page click Create account, enter your email, name and a strong master password, then log in.

Step 2: Two-step login with an authenticator app

▶ Watch this step (11:30)

1. Go to Settings → Security → Two-step login.
2. Next to Authenticator app, click Manage and enter your master password.
3. Scan the QR code with an authenticator app (Microsoft Authenticator, Google Authenticator, etc.).
4. Type the 6-digit code from the app and click Turn on.
5. Click View recovery code, write it down, and keep it somewhere safe. It is the only way back in if you lose your phone.

Step 3: Test it from another computer

▶ Watch this step (12:41)

1. On your PC, disconnect from Tailscale and open https://vault.tail.example.com. It should not load. This is what anyone outside your tailnet sees.
2. Connect to Tailscale and reload. The login page appears.
3. Log in with your master password and the authenticator code.

Using the Vault

Add a login

▶ Watch this step (13:49)

1. Click New item → Login.
2. Enter a Name (e.g. your bank), Username, and click the generate icon to create a strong Password.
3. Add the website under URI (e.g. https://www.chase.com) so the browser extension can autofill it.
4. Click Save. The site’s logo appears next to the item.

Set password generator rules

▶ Watch this step (15:28)

Go to Tools → Generator, set the length (e.g. 20) and turn on special characters. New passwords use these settings.

Organize with folders

▶ Watch this step (15:52)

Click New → Folder (e.g. Finance), then edit an item and choose the folder.

Share passwords with an Organization

▶ Watch this step (19:00)

1. Click New organization and name it (e.g. Family).
2. Invite family members; each needs their own account on your Vaultwarden server.
3. When creating an item, set Owner to the organization. Everyone in it can see that item (e.g. a shared Netflix login), while your personal items stay private.

Mobile App and Chrome Extension

Both use the official Bitwarden apps. The device must be connected to Tailscale to reach your server.

Mobile app

▶ Watch this step (16:13)

1. Install the Tailscale app on your phone and connect to your tailnet.
2. Install Bitwarden from the App Store or Google Play.
3. On the login screen, change the server (region) option to Self-hosted.
4. Enter https://vault.tail.example.com as the Server URL and tap Save.
5. Log in with your email, master password and authenticator code.

Chrome extension

▶ Watch this step (17:13)

1. Install Bitwarden Password Manager from the Chrome Web Store and pin it to the toolbar.
2. Choose Self-hosted, enter https://vault.tail.example.com, and save.
3. Log in with your email, master password and authenticator code.
4. Visit a saved site to autofill your login, or create a login on a new site and let Bitwarden offer to save it.

Enable the Server Admin Page

▶ Watch this step (20:00)

The admin page at /admin manages the whole server: view and delete users, and reset a user’s two-step login if they lose their phone. It is off until you give it a password.

Step 1: Generate a hashed admin token

With Vaultwarden running, run the hash tool inside the container and type a strong admin password twice:

cd ~/docker/vault
sudo docker exec -it vaultwarden /vaultwarden hash

It prints a line starting with ADMIN_TOKEN=. Copy the whole line.

Step 2: Save it in a .env file

nano .env

Paste the line. It looks like this (yours will be longer), including the single quotes:

ADMIN_TOKEN='$argon2id$v=19$m=65540,t=3,p=4$PASTE-YOUR-HASH-HERE'

Save, exit, and make the file private:

chmod 600 .env

Step 3: Add it to the Compose file

nano docker-compose.yml

Add the ADMIN_TOKEN line inside the environment: block, so it reads:

    environment:
      DOMAIN: "https://vault.tail.example.com"
      ADMIN_TOKEN: ${ADMIN_TOKEN}

Step 4: Restart and log in

sudo docker compose down
sudo docker compose up -d

Go to https://vault.tail.example.com/admin and enter the admin password you typed in Step 1 (the plain password, not the hash).

Backups and Updates

Back up the vault

Everything lives in vw-data. Stop the container briefly so the database is consistent, archive the folder, then start it again:

cd ~/docker/vault
sudo docker compose stop
sudo tar -czf ~/vaultwarden-backup-$(date +%F).tar.gz -C ~/docker/vault vw-data .env docker-compose.yml
sudo docker compose start
ls -lh ~/vaultwarden-backup-*.tar.gz

Restore from a backup

cd ~/docker/vault
sudo docker compose down
sudo tar -xzf ~/vaultwarden-backup-YYYY-MM-DD.tar.gz -C ~/docker/vault
sudo docker compose up -d

Update Vaultwarden

cd ~/docker/vault
sudo docker compose pull
sudo docker compose up -d
sudo docker image prune -f

Troubleshooting

• The site does not load anywhere: check the device is connected to Tailscale, and that the *.tail A record points to the server’s current Tailscale IP (tailscale ip -4).
• Certificate warning in the browser: the proxy host is not using the wildcard certificate, or the domain is not under tail.example.com.
• 502 Bad Gateway: Vaultwarden is not running or not on port 1776. Run sudo docker ps.
• Admin page says the token is invalid: make sure the whole ADMIN_TOKEN='...' line is in .env with its single quotes, then run sudo docker compose down and sudo docker compose up -d.
• Devices do not sync instantly: turn on Websockets Support on the proxy host in NPM.

Step 1: Install Plex in Docker

The video installs Plex directly on Ubuntu; on the homelab server it runs in a Docker container instead, using the linuxserver.io Plex image. The Compose file below is the one the server actually runs: media comes straight from the RAID, an NVIDIA GPU does the transcoding, and transcodes are written to RAM.

1. Make the media folders and the Plex folder

Media lives on the RAID, which is also the RAID Samba share, so you can drag files into \\192.168.1.51\RAID\Plex from any PC. Create the folders (if they don’t exist yet) and a folder for the Compose file:

mkdir -p /mnt/raid/Plex/movies /mnt/raid/Plex/shows
mkdir -p ~/docker/plex
cd ~/docker/plex
id

id shows your user and group numbers, usually uid=1000 and gid=1000. Plex runs as that user, which is in the raidusers group, so it can read the RAID without any extra permissions.

2. GPU prerequisites (NVIDIA)

runtime: nvidia needs the NVIDIA driver and the NVIDIA Container Toolkit on the machine running Docker (for a VM, pass the GPU through to it in Proxmox first; see Troubleshoots → Plex Crashes: NVIDIA GPU Passthrough for the full steps and why it matters). Check the driver, then register the runtime with Docker:

nvidia-smi
sudo nvidia-ctk runtime configure --runtime=docker
sudo systemctl restart docker

nvidia-smi should list the GPU. If nvidia-ctk isn’t found, install the toolkit by following NVIDIA’s install guide. Hardware transcoding also needs Plex Pass. No NVIDIA GPU? Delete the runtime line and the two NVIDIA_ lines.

3. Create the Compose file

nano docker-compose.yml

Paste this, changing PUID/PGID if id showed different numbers and the memory limits to suit your machine. Save with Ctrl+O, Enter, Ctrl+X.

services:
  plex:
    image: lscr.io/linuxserver/plex:latest
    container_name: plex
    network_mode: host

    mem_limit: 16g
    mem_reservation: 12g

    runtime: nvidia
    environment:
      - PUID=1000
      - PGID=1000
      - NVIDIA_VISIBLE_DEVICES=all
      - NVIDIA_DRIVER_CAPABILITIES=compute,video,utility

    volumes:
      - /var/lib/plexmediaserver:/config
      - /mnt/raid:/mnt/raid
      - /dev/shm/plex-transcode:/transcode

    security_opt:
      - apparmor:unconfined

    restart: unless-stopped

4. Start Plex

sudo docker compose up -d
sudo docker compose ps
sudo docker compose logs --tail 30 plex

ps should show plex as running. If the firewall is on, allow Plex’s port:

sudo ufw allow 32400/tcp

Step 2: First-Time Setup

▶ Watch this step (8:41)

1. From a computer on the same network, open http://192.168.1.51:32400/web in a browser (the address must end in /web).
2. Sign in or create a free Plex account. A server you moved from a non-Docker install, or claimed with PLEX_CLAIM, is already linked to your account; otherwise this step “claims” it.
3. Give the server a name. Leave Allow me to access my media outside my home on if you want remote streaming.
4. Skip adding libraries for now; you’ll add them in Step 4 once the folders exist.
5. Under Settings → Transcoder, set Transcoder temporary directory to /transcode and, with Plex Pass, tick Use hardware acceleration when available (and hardware-accelerated video encoding). Save.

Step 3: Add Media and Name Files Correctly

Copy media into Plex\movies and Plex\shows on the RAID share from any PC (or into /mnt/raid/Plex/... on the server). Because Plex runs as your own user, no extra permissions are needed.

▶ Watch this step (9:47)

Copy media into the folders over the network share. Plex identifies movies and episodes from their names, so follow its naming scheme:

plex/
├── movies/
│   └── Over the Hedge (2006)/
│       └── Over the Hedge (2006).mkv
└── shows/
    └── The Office (US) (2005)/
        └── Season 03/
            ├── The Office (US) (2005) - s03e01 - Gay Witch Hunt.mkv
            └── The Office (US) (2005) - s03e02 - The Convention.mkv

Step 4: Add Libraries

▶ Watch this step (9:57)

1. In Plex, open Settings → Manage → Libraries → Add Library (or the + next to your server in the sidebar).
2. Choose Movies, click Browse for media folder and pick /mnt/raid/Plex/movies. Click Add Library.
3. Repeat with TV Shows and /mnt/raid/Plex/shows.
4. Plex scans the folders and downloads posters and descriptions. New files you copy in are picked up automatically, or use ⋯ → Scan Library Files.

Step 5: Watch Anywhere

• Apps: Plex has apps for smart TVs, Roku, Fire TV, Apple TV, game consoles, phones and tablets, or use app.plex.tv in a browser.
• Remote access: Settings → Remote Access. If it can’t connect automatically, forward TCP port 32400 on your router to the server, or skip port forwarding and watch over a VPN like Tailscale.
• Transcoding: if a device can’t play a file, Plex converts it on the fly, which is CPU-heavy on an old machine. Files in common formats (H.264 MP4/MKV) stream without converting. Hardware-accelerated transcoding requires Plex Pass; the homelab uses the NVIDIA GPU set up in Step 1.
• Share with family: Settings → Manage Library Access to invite other Plex accounts.

Updating Plex

In Docker, Plex is updated by pulling the newest image and recreating the container. Your settings and libraries stay in /var/lib/plexmediaserver:

cd ~/docker/plex
sudo docker compose pull
sudo docker compose up -d
sudo docker image prune -f

pull downloads the new image, up -d recreates the container only if the image changed, and image prune deletes the old image to free space. Check the version afterwards under Settings → General. Plex may show “update available” banners in its web app; ignore them and use these commands instead.

Troubleshooting

Ways to Install Home Assistant

Step 1: Install Docker

▶ Watch this step (11:13)

Install Docker Engine from Docker’s official repository (see Docker for the full steps), then confirm it works:

sudo docker run hello-world

Step 2: Run the Home Assistant Container

▶ Watch this step (11:49)

Create a folder to hold Home Assistant’s configuration, so it survives container updates:

mkdir ~/hass

▶ Watch this step (11:28)

Run the official image. Before pasting, change TZ to your time zone (the video uses America/Chicago) and haven to your username if yours is different. Everything else stays as is:

sudo docker run -d \
  --name homeassistant \
  --privileged \
  --restart=unless-stopped \
  -e TZ=America/Chicago \
  -v /home/haven/hass:/config \
  -v /run/dbus:/run/dbus:ro \
  --network=host \
  ghcr.io/home-assistant/home-assistant:stable

▶ Watch this step (12:24)

Check it’s running:

sudo docker ps

Prefer Docker Compose? Save this as ~/docker/homeassistant/docker-compose.yml and run sudo docker compose up -d in that folder:

services:
  homeassistant:
    image: ghcr.io/home-assistant/home-assistant:stable
    container_name: homeassistant
    privileged: true
    restart: unless-stopped
    network_mode: host
    environment:
      TZ: America/Chicago
    volumes:
      - /home/haven/hass:/config
      - /run/dbus:/run/dbus:ro

Step 3: First-Time Setup

▶ Watch this step (12:31)

1. In a browser on any computer at home, open http://192.168.1.51:8123 (the server’s IP, port 8123). The first start can take a few minutes.
2. Create your owner account (name, username, password).
3. Set your home location, time zone and units. These drive sunrise/sunset automations and weather.
4. Choose whether to share analytics, then finish. You land on the dashboard.
5. Optional: your profile (bottom-left) → Theme → Dark.

Step 4: Add Devices (Integrations)

▶ Watch this step (12:56)

Home Assistant automatically finds many devices on your network. Go to Settings → Devices & Services:

• Discovered devices appear at the top. Click Configure to add one, or Ignore to hide it.
• To add something not discovered, click + Add Integration and search for the brand.

▶ Watch this step (13:05)

The video adds LIFX smart bulbs: click Configure, pick the bulbs, and they appear on the dashboard, where you can change brightness and color.

Step 5: Your First Automation

Automations are “when this happens, if conditions are met, do that”. Example: turn the living-room lamp on at sunset.

1. Settings → Automations & Scenes → + Create Automation → Create new automation.
2. When (trigger): + Add Trigger → Sun → Sunset.
3. And if (optional condition): e.g. only when someone is home.
4. Then do (action): + Add Action → Light → Turn on and pick the lamp.
5. Click Save and give it a name. Use ⋯ → Run actions to test it.

Other popular ideas: lights on when motion is detected, notifications to your phone (install the Home Assistant Companion app), or turning everything off when the last person leaves.

Updates, Backups and Remote Access

Update the container by pulling the new image and recreating it (your settings in ~/hass are kept):

sudo docker pull ghcr.io/home-assistant/home-assistant:stable
sudo docker stop homeassistant
sudo docker rm homeassistant
# then run the same docker run command from Step 2 again

With Docker Compose: sudo docker compose pull && sudo docker compose up -d.

Back up by copying the config folder (stop the container first for a clean copy):

sudo docker stop homeassistant
sudo tar -czf ~/hass-backup-$(date +%F).tar.gz -C ~ hass
sudo docker start homeassistant

Remote access: don’t forward port 8123 straight to the internet. Use a VPN such as Tailscale, a reverse proxy with HTTPS (see NGINX), or the paid Home Assistant Cloud (Nabu Casa).

Troubleshooting

How It’s Set Up & Example Values

These notes follow the Hardware Haven AMP server guide, using CubeCoders’ own installer with Docker for the game servers, which is how the homelab runs it:

• The AMP panel (called ADS, normally the instance ADS01) is installed directly on the server and runs as a system user named amp.
• Each game server (an AMP “instance”) runs in its own Docker container built from CubeCoders’ cubecoders/ampbase image, named AMP_<instance name>. For example, a Minecraft server called Cobblemon01 shows up in docker ps as AMP_Cobblemon01 using cubecoders/ampbase:java.
• Containers keep game servers isolated from each other and from the rest of the server, while AMP creates, starts, updates and removes them for you. You never write a Compose file for AMP.

Before you start: an Ubuntu or Debian server with a static IP and SSH, Docker installed, and an AMP licence key. The guide installs Debian first; Ubuntu Server works the same way.

Step 1: Install AMP

Install curl, then run CubeCoders’ installer as root:

sudo apt update && sudo apt install -y curl
sudo su -
bash <(curl -fsSL getamp.sh)

Answer the installer’s questions:

When it finishes it prints the panel address (e.g. http://192.168.1.51:8080). Don’t press Ctrl+C while it’s still running, as that can stop the install part-way. Then leave the root shell:

exit

Step 2: Sign In and Activate

If the firewall is on, open the panel port first:

sudo ufw allow 8080/tcp

1. Open http://192.168.1.51:8080 in a browser on your network.
2. Sign in with the username and password you chose in the installer.
3. Paste your licence key and choose Standalone when asked how to set up.

Step 3: Create a Game Server

1. In AMP, open Instances → Create Instance, pick the game (e.g. Minecraft Java Edition) and give it a name such as Minecraft01.
2. AMP downloads the right cubecoders/ampbase image the first time and creates the container. Start the instance and accept the game’s EULA if asked.
3. Open the game’s port in the firewall, then connect from a PC on your network to 192.168.1.51:25565.

sudo ufw allow 25565
sudo docker ps --filter name=AMP_

docker ps should list AMP_Minecraft01 as Up. The instance’s ports are set in AMP (the instance’s Configuration → Network page) and AMP publishes them from the container for you.

Step 4: Let Friends Join with Playit (No Port Forwarding)

playit.gg gives your server a public address without opening ports on your router. Install it from Playit’s repository (check playit.gg/download/linux for the current commands):

curl -SsL https://playit-cloud.github.io/ppa/key.gpg | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/playit.gpg >/dev/null
echo "deb [signed-by=/etc/apt/trusted.gpg.d/playit.gpg] https://playit-cloud.github.io/ppa/data ./" | sudo tee /etc/apt/sources.list.d/playit-cloud.list
sudo apt update
sudo apt install -y playit

Run playit once and follow the link it prints to set up the agent in your Playit account. Create a tunnel for the game (e.g. Minecraft Java) pointing at 127.0.0.1:25565. Then run it in the background and start it at boot:

sudo systemctl enable --now playit
sudo systemctl status playit
sudo tail -f /var/log/playit/playit.log

Share the address Playit gives you (e.g. something.joinmc.link) with your friends.

Useful Commands

AMP is managed with ampinstmgr, run as the amp user (sudo -iu amp does that from your own account):

Updating

Back up, then update

Stop the servers, copy AMP’s data to the RAID (see Backups), update, then start them again:

sudo -iu amp ampinstmgr stopall
sudo mkdir -p /mnt/raid/amp-backups
sudo tar czf /mnt/raid/amp-backups/ampdata-$(date +%F).tar.gz -C /home/amp .ampdata
sudo apt update && sudo apt upgrade -y
sudo -iu amp ampinstmgr upgradeall
sudo -iu amp ampinstmgr startall

startall starts every instance; stop any you don’t want running from the panel afterwards. AMP also has its own scheduled backups per instance (the instance’s Backups tab), which are handy for rolling back a world.

Troubleshooting

How Kubernetes Works

A cluster has a control plane that decides where containers (grouped into pods) run, and worker nodes that run them. Kubernetes keeps the cluster in the state you describe: it restarts crashed containers, spreads the load and rolls out updates without downtime.

The pieces of a cluster:

The objects you’ll use:

Choosing a Distribution

A good path: start with Minikube to learn the commands, then build a 3-VM kubeadm cluster on Proxmox to understand every part. All three options below end with the same first deployment.

Option A: Minikube (Single Node)

What it is: Minikube runs a complete single-node Kubernetes cluster on one computer, inside a VM or container. It is built for learning and local testing rather than production.

Needs Docker installed (see Docker), 2 CPUs and 2 GB of free RAM. Minikube won’t run as root with the Docker driver, so add your user to the docker group first:

sudo usermod -aG docker $USER && newgrp docker
curl -LO https://storage.googleapis.com/minikube/releases/latest/minikube-linux-amd64
sudo install minikube-linux-amd64 /usr/local/bin/minikube && rm minikube-linux-amd64
minikube start --driver=docker

Minikube downloads a matching kubectl for you; make kubectl point at it and check the cluster:

echo 'alias kubectl="minikube kubectl --"' >> ~/.bashrc && source ~/.bashrc
kubectl get nodes
kubectl get pods -A

Option B: MicroK8s

What it is: MicroK8s is a lightweight Kubernetes distribution from Canonical, installed as a single snap package. It runs well on small servers and Raspberry Pis, can form multi-node clusters, and turns on common add-ons (DNS, dashboard, storage) with one command.

sudo snap install microk8s --classic
sudo usermod -aG microk8s $USER
mkdir -p ~/.kube && sudo chown -f -R $USER ~/.kube
newgrp microk8s
microk8s status --wait-ready
microk8s enable dns hostpath-storage
echo "alias kubectl='microk8s kubectl'" >> ~/.bashrc && source ~/.bashrc
kubectl get nodes

hostpath-storage gives the cluster a default StorageClass so PVCs work. Other useful add-ons: microk8s enable ingress, metrics-server, dashboard, and metallb (real LAN IPs for LoadBalancer services).

Add more nodes: on the first node run microk8s add-node; it prints a microk8s join ... command to run on the new node (add --worker to make it a worker only). Check with kubectl get nodes.

Option C: Kubeadm (Multi-Node Cluster on Proxmox)

What it is: Kubeadm is the official tool for building a real multi-node Kubernetes cluster from scratch. It sets up the control plane and joins the worker nodes, which gives hands-on experience with how production clusters are put together.

Before you start: three Ubuntu 24.04 VMs on Proxmox (one control plane, two workers), each with at least 2 vCPUs and 2 GB RAM, a static IP and a unique hostname. If you clone them from one template, give each a new machine ID (sudo rm /etc/machine-id && sudo systemd-machine-id-setup) and set the hostname (sudo hostnamectl set-hostname k8s-w1) before going on.

1. Prepare every node (control plane and workers)

Kubernetes needs swap off, two kernel modules, and IP forwarding:

sudo swapoff -a
sudo sed -i '/ swap / s/^/#/' /etc/fstab
cat <<EOF | sudo tee /etc/modules-load.d/k8s.conf
overlay
br_netfilter
EOF
sudo modprobe overlay
sudo modprobe br_netfilter
cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-iptables  = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward                 = 1
EOF
sudo sysctl --system

2. Install containerd (every node)

sudo apt update && sudo apt install -y containerd
sudo mkdir -p /etc/containerd
containerd config default | sudo tee /etc/containerd/config.toml > /dev/null
sudo sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
sudo systemctl restart containerd

SystemdCgroup = true makes containerd and the kubelet manage resources the same way; without it pods restart randomly. Check with grep SystemdCgroup /etc/containerd/config.toml.

3. Install kubeadm, kubelet and kubectl (every node)

Set K8S to the current minor version from kubernetes.io/releases (the example uses v1.34):

K8S=v1.34
sudo apt install -y apt-transport-https ca-certificates curl gpg
sudo mkdir -p -m 755 /etc/apt/keyrings
curl -fsSL https://pkgs.k8s.io/core:/stable:/$K8S/deb/Release.key | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg
echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/$K8S/deb/ /" | sudo tee /etc/apt/sources.list.d/kubernetes.list
sudo apt update
sudo apt install -y kubelet kubeadm kubectl
sudo apt-mark hold kubelet kubeadm kubectl

apt-mark hold stops a routine apt upgrade from changing the Kubernetes version under a running cluster (see Upgrading).

4. Create the cluster (control plane only)

sudo kubeadm init --pod-network-cidr=10.244.0.0/16 --apiserver-advertise-address=192.168.1.61
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

kubeadm init ends by printing a kubeadm join ... command. Copy it; the workers need it in step 6. The .kube/config lines let your user run kubectl.

5. Install the pod network (control plane only)

Nodes stay NotReady until a CNI plugin is installed. Flannel is the simplest and matches the 10.244.0.0/16 range above:

kubectl apply -f https://github.com/flannel-io/flannel/releases/latest/download/kube-flannel.yml
kubectl get pods -n kube-flannel
kubectl get nodes

6. Join the workers (each worker)

Paste the join command from step 4 on each worker, with sudo:

sudo kubeadm join 192.168.1.61:6443 --token <token> \
  --discovery-token-ca-cert-hash sha256:<hash>

Lost it, or it’s been more than 24 hours? Make a new one on the control plane with kubeadm token create --print-join-command. Then check from the control plane:

kubectl get nodes -o wide

All three nodes should be Ready within a minute or two.

Your First Deployment

This works on any of the three options. Create a file describing 3 copies of a web server and a service in front of them:

nano hello.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello
spec:
  replicas: 3
  selector:
    matchLabels:
      app: hello
  template:
    metadata:
      labels:
        app: hello
    spec:
      containers:
        - name: web
          image: nginx:1.27
          ports:
            - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: hello
spec:
  type: NodePort
  selector:
    app: hello
  ports:
    - port: 80
      targetPort: 80
      nodePort: 30080

kubectl apply -f hello.yaml
kubectl get pods -o wide
kubectl get service hello

Open http://192.168.1.61:30080 (any node’s IP works; on Minikube use minikube service hello --url). The -o wide output shows the pods spread across the workers.

See what Kubernetes does for you:

Storage, Config and Secrets

Pods are disposable, so anything that must survive (databases, uploads) goes on a PersistentVolumeClaim. Minikube and MicroK8s (hostpath-storage) include a default StorageClass. A kubeadm cluster has none; the simplest is Rancher’s local-path provisioner, which stores data in a folder on the node:

kubectl apply -f https://raw.githubusercontent.com/rancher/local-path-provisioner/master/deploy/local-path-storage.yaml
kubectl patch storageclass local-path -p '{"metadata":{"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'
kubectl get storageclass

A claim and a pod that uses it:

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: data
spec:
  accessModes: ["ReadWriteOnce"]
  resources:
    requests:
      storage: 1Gi
---
# in a Deployment's pod spec:
#   volumes:
#     - name: data
#       persistentVolumeClaim:
#         claimName: data
#   containers:
#     - name: app
#       volumeMounts:
#         - name: data
#           mountPath: /data

Settings and passwords: keep them out of the YAML with ConfigMaps and Secrets:

kubectl create configmap app-config --from-literal=TZ=America/Chicago
kubectl create secret generic app-secret --from-literal=DB_PASSWORD='change-me'
kubectl get secret app-secret -o yaml

Pods read them with envFrom: [{configMapRef: {name: app-config}}, {secretRef: {name: app-secret}}]. Secrets are only base64-encoded, not encrypted, so limit who can read them and don’t commit them to Git.

Helm (Package Manager)

Helm installs whole apps (a “chart”: deployments, services, storage and config together) with one command, much like apt for Kubernetes:

curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
helm version

Each chart’s page lists its settings; put your changes in a values.yaml file so upgrades are repeatable.

Upgrading a Kubeadm Cluster

Upgrade one minor version at a time (e.g. 1.34 → 1.35), control plane first, then each worker. In short:

1. On every node, point the apt source at the new version (change v1.34 to v1.35 in /etc/apt/sources.list.d/kubernetes.list) and run sudo apt update.
2. Control plane: sudo apt-mark unhold kubeadm && sudo apt install -y kubeadm=<new version> && sudo apt-mark hold kubeadm, then sudo kubeadm upgrade plan and sudo kubeadm upgrade apply v1.35.x.
3. Each node in turn: kubectl drain <node> --ignore-daemonsets, upgrade kubelet and kubectl the same way (workers also run sudo kubeadm upgrade node), sudo systemctl restart kubelet, then kubectl uncordon <node>.

Follow the official kubeadm upgrade guide for the exact package versions, and back up first (a Proxmox snapshot of each VM is the easy way in a lab).

kubectl Cheat Sheet

Troubleshooting

Configuration management tool

What it is: Configuration management tools such as Ansible, Puppet and Chef describe how servers should be set up (packages, users, files and services) in text files, then apply that configuration to any number of machines. Ansible is the most common starting point because it needs no agent on the servers and works over SSH.

How the Homelab Backups Work

Proxmox writes nightly backups of every VM straight to /mnt/raid/proxmox-backups on the host-owned mirror built in RAID → Homelab Build. It keeps 7 daily, 4 weekly and 3 monthly copies and deletes older ones automatically. Because the host reads and writes the RAID directly, backups and restores work even when VM 100 is off or broken.

1. Add the Backup Storage

mkdir -p /mnt/raid/proxmox-backups
chmod 700 /mnt/raid/proxmox-backups
pvesm add dir raid-backups --path /mnt/raid/proxmox-backups \
  --content backup --is_mountpoint /mnt/raid
pvesm status

raid-backups should show active with about 18 TB free. --is_mountpoint makes Proxmox refuse to write if the RAID is not mounted, instead of filling the boot disk.

2. Keep Physical Disks Out of VM Backups

Any real disk passed through to a VM is included in its backup by default. For example, VM 100’s 1 TB drive:

qm set 100 --scsi3 /dev/disk/by-id/ata-ST1000DM010-2DM162_SERIAL03,aio=native,cache=none,backup=0
qm config 100 | grep -E "^(scsi|virtio)"

Use your own drive’s by-id name and the same scsiN slot it already uses. Every passed-through disk should show backup=0. virtiofs folders are never included, so the RAID itself is not copied into its own backups.

3. Install the Guest Agent (Consistent Snapshots)

In VM 100 (and any other Linux VM):

sudo apt install -y qemu-guest-agent

Then on the host:

qm set 100 --agent enabled=1
qm shutdown 100 --timeout 300 && qm start 100

The agent lets Proxmox briefly pause writes inside the VM so each snapshot is clean. It only takes effect after a full shutdown and start, not a reboot from inside the VM.

4. Create the Nightly Job

pvesh create /cluster/backup --schedule "02:00" --storage raid-backups \
  --all 1 --mode snapshot --compress zstd --enabled 1 \
  --notification-mode notification-system \
  --prune-backups "keep-daily=7,keep-weekly=4,keep-monthly=3"
pvesh get /cluster/backup --output-format yaml

Keep --mode snapshot: VMs stay running while they are backed up. Each backup is a full copy, so plan on roughly 10 times your used VM space once retention fills up. In the web UI the job is under Datacenter → Backup.

5. Test a Backup and a Restore

A backup you’ve never restored isn’t a backup yet. Use a small VM (here VM 105, 32 GB):

vzdump 105 --storage raid-backups --mode snapshot --compress zstd
pvesm list raid-backups
lvs
qmrestore raid-backups:backup/<file-from-the-list> 999 --storage local-lvm
qm start 999

Replace <file-from-the-list> with the real name, without the angle brackets. Check lvs first: if local-lvm is overcommitted, restoring a large VM as a test can fill it. Once VM 999 boots, remove it with qm stop 999 && qm destroy 999.

6. Archive App Data (Vaultwarden Example)

VM backups capture whole machines. For a quick, portable copy of one app’s data, such as Vaultwarden, archive its folder onto the RAID from inside VM 100:

sudo mkdir -p /mnt/raid/vaultwarden-backups
sudo tar czf /mnt/raid/vaultwarden-backups/vault-$(date +%F).tar.gz -C /home/docker vault
ls -lh /mnt/raid/vaultwarden-backups

$(date +%F) stamps the file with today’s date (e.g. vault-2026-10-06.tar.gz), which sorts correctly. -C /home/docker vault stores clean relative paths. The archive holds every password in the vault, so encrypt it before it goes anywhere else:

sudo gpg --pinentry-mode loopback --symmetric --cipher-algo AES256 \
  /mnt/raid/vaultwarden-backups/vault-$(date +%F).tar.gz

That creates a .tar.gz.gpg next to it; delete the unencrypted .tar.gz once you’ve checked the encrypted copy opens (see GPG → Encrypt and Decrypt).

7. Email Notifications

Three senders cover everything: Proxmox reports backup results, mdadm warns when a RAID disk drops out, and smartd warns when a disk starts to fail. All three send through Gmail with an app password. This part is independent of the steps above; set it up whenever you like.

a. Create a Gmail app password

Google Account → Security → turn on 2-Step Verification → search App passwords → create one named Proxmox. Copy the 16 characters without spaces. Never paste it into a chat, ticket or screenshot; if it leaks, delete it there and make a new one.

b. Add Gmail as a Proxmox target

Paste this line by itself, press Enter, then paste the app password and press Enter (nothing shows as you type):

read -s -p "App password: " APPPW; echo

Then paste this block, with your own address in place of you@gmail.com. If the gmail target already exists, change create ... smtp --name gmail to set .../smtp/gmail and drop --name gmail.

pvesh create /cluster/notifications/endpoints/smtp --name gmail \
  --server smtp.gmail.com --port 587 --mode starttls \
  --username you@gmail.com --password "$APPPW" \
  --from-address you@gmail.com --mailto you@gmail.com
pvesh create /cluster/notifications/targets/gmail/test

Keep APPPW set for step d; it disappears when you close the shell.

c. Send backup results to Gmail

pvesh create /cluster/notifications/matchers --name backup-alerts \
  --target gmail --match-field exact:type=vzdump --match-severity error,warning,info

error,warning,info emails after every run; use error,warning for failures only. The nightly job already sends its results to the notification system (--notification-mode notification-system).

d. Let the host itself send mail (for mdadm and smartd)

Proxmox already runs postfix. Point it at Gmail:

apt install -y libsasl2-modules
echo "[smtp.gmail.com]:587 you@gmail.com:$APPPW" > /etc/postfix/sasl_passwd
unset APPPW
chmod 600 /etc/postfix/sasl_passwd
postmap hash:/etc/postfix/sasl_passwd
postconf -e "relayhost = [smtp.gmail.com]:587" \
  "smtp_tls_security_level = encrypt" \
  "smtp_sasl_auth_enable = yes" \
  "smtp_sasl_security_options = noanonymous" \
  "smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd" \
  "smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt"
systemctl restart postfix
printf "Subject: Postfix test from pve\n\nIt works.\n" | sendmail you@gmail.com

If APPPW is empty because you opened a new shell, run the read -s line from step b again first. If no email arrives, journalctl -u postfix -n 30 shows why.

e. RAID failure alerts (mdadm)

sed -i '/^MAILADDR/d' /etc/mdadm/mdadm.conf
echo "MAILADDR you@gmail.com" >> /etc/mdadm/mdadm.conf
systemctl restart mdmonitor
mdadm --monitor --scan --oneshot --test

The last line sends one TestMessage email per array. This only works once the host owns the RAID (RAID → Part 1).

f. Disk health alerts (smartd)

apt install -y smartmontools
sed -i 's/^DEVICESCAN/#DEVICESCAN/' /etc/smartd.conf
echo 'DEVICESCAN -a -o on -S on -n standby,q -s (S/../.././03|L/../01/./04) -m you@gmail.com -M test' >> /etc/smartd.conf
systemctl restart smartd

This runs a short self-test nightly at 3 AM and a long test on the 1st of each month at 4 AM, and emails on any warning. You get one test email per disk right away; then remove the test flag:

sed -i 's/ -M test//' /etc/smartd.conf
systemctl restart smartd

Verification

Troubleshooting

Every row below happened during the first build. For how the original backup design differed from this one, and why it failed, see Troubleshoots → What Was Wrong with the Original Homelab Setup.

Proxmox backups

Archive commands (Vaultwarden)

Email

Example Values Used in the Commands

Every command below uses the same example identity so you can see what goes where. Replace these with your own:

How GPG Works

GPG uses public-key cryptography. You create a key pair: a public key you hand out freely, and a private (secret) key that never leaves your control and is protected by a passphrase.

Step 1: Install GnuPG

Check it works and see the version (2.2 or newer is ideal):

gpg --version

Step 2: Create Your Key Pair

The guided way asks a few questions:

gpg --full-generate-key

Or create it in one line, with a separate encryption subkey:

gpg --quick-generate-key "Haven Example <haven@example.com>" ed25519 sign,cert 2y
# copy the fingerprint it prints, then add an encryption subkey:
gpg --quick-add-key A1B2C3D4E5F6A7B8C9D0E1F23AA5C34371567BD2 cv25519 encr 2y

List your keys (secret keys only) with long IDs:

gpg --list-secret-keys --keyid-format=long

Example output and how to read it:

sec   ed25519/3AA5C34371567BD2 2026-10-05 [SC] [expires: 2028-10-05]
      A1B2C3D4E5F6A7B8C9D0E1F23AA5C34371567BD2
uid                 [ultimate] Haven Example <haven@example.com>
ssb   cv25519/9F8E7D6C5B4A3921 2026-10-05 [E] [expires: 2028-10-05]

• sec = your secret primary key; ssb = secret subkey.
• ed25519/3AA5C34371567BD2 = algorithm / long key ID.
• [SC] = sign and certify; [E] = encrypt.
• The long hex line is the fingerprint; [ultimate] means it’s your own key.

Step 3: Back Up Your Key and Revocation Certificate

Do this right after creating the key. If you lose your private key you can’t decrypt anything sent to you, and without a revocation certificate you can’t tell people to stop using it.

GnuPG 2.1+ creates a revocation certificate automatically in ~/.gnupg/openpgp-revocs.d/. To make one yourself:

gpg --output haven-revoke.asc --gen-revoke haven@example.com

Export a backup of your private key (it stays protected by your passphrase):

gpg --armor --export-secret-keys haven@example.com > haven-private-key.asc

Restore the backup on a new computer:

gpg --import haven-private-key.asc
gpg --edit-key haven@example.com   # then type: trust, 5 (ultimate), y, save

Keep the keyring folder private (GPG warns about “unsafe permissions” otherwise):

chmod 700 ~/.gnupg
chmod 600 ~/.gnupg/*

Step 4: Share Your Public Key and Import Others’

Export your public key as text you can email, attach or publish:

gpg --armor --export haven@example.com > haven-public-key.asc

Or publish it to a keyserver so others can find it. keys.openpgp.org sends you an email to confirm your address before it’s searchable:

gpg --keyserver hkps://keys.openpgp.org --send-keys A1B2C3D4E5F6A7B8C9D0E1F23AA5C34371567BD2

Import someone else’s key from a file or a keyserver:

gpg --import alice-public-key.asc
# or
gpg --keyserver hkps://keys.openpgp.org --search-keys alice@example.com

Verify before you trust. Show the fingerprint and compare it with the owner over a separate channel (in person, a phone call, their official website):

gpg --fingerprint alice@example.com

If it matches, sign their key so GPG stops warning you. --lsign-key keeps the signature local (not shared with keyservers):

gpg --lsign-key alice@example.com

Step 5: Encrypt and Decrypt Files (Linux and Windows)

There are two ways to encrypt a file. Pick one based on who needs to open it:

Linux: Encrypt a File for Someone

1. Check that the recipient’s key is in your keyring:

gpg --list-keys alice@example.com

2. Encrypt the file. Add yourself as a second recipient so you can still open your own copy:

gpg --encrypt --recipient alice@example.com --recipient haven@example.com --output report.pdf.gpg report.pdf

3. Confirm the encrypted file exists, then send report.pdf.gpg. Optionally destroy the unencrypted original:

ls -l report.pdf.gpg
shred -u report.pdf    # optional: overwrite and delete the original

Linux: Decrypt a File

Run this on the computer that holds your private key. GPG detects which key the file was encrypted to and prompts for that key’s passphrase:

gpg --output report.pdf --decrypt report.pdf.gpg

It also prints who the file was encrypted to (and, if it was signed, a Good signature line). On a server over SSH where no passphrase box appears, enter it in the terminal instead:

export GPG_TTY=$(tty)
gpg --pinentry-mode loopback --output report.pdf --decrypt report.pdf.gpg

Linux: Encrypt and Decrypt with a Password

# encrypt (asks for a new passphrase twice) -> secrets.txt.gpg
gpg --symmetric --cipher-algo AES256 secrets.txt

# decrypt
gpg --output secrets.txt --decrypt secrets.txt.gpg

Linux: Encrypt a Whole Folder

GPG encrypts single files, so pack the folder into an archive first. This does both in one step without leaving an unencrypted archive on disk:

# encrypt the folder ~/Documents/taxes
tar czf - -C ~/Documents taxes | gpg --symmetric --cipher-algo AES256 --output taxes.tar.gz.gpg

# decrypt and unpack into the current folder
gpg --decrypt taxes.tar.gz.gpg | tar xzf -

Windows: Encrypt and Decrypt with Kleopatra (No Commands)

Install Gpg4win (Step 1). It adds Kleopatra and right-click menu entries in File Explorer.

Encrypt:

1. In File Explorer, right-click the file. On Windows 11, click Show more options first.
2. Choose More GpgEX options → Sign and encrypt. (Or open Kleopatra and click Sign/Encrypt…, then pick the file.)
3. For a person: tick Encrypt for others and choose their key. Leave Encrypt for me ticked so you can open it too. For a password instead: tick Encrypt with password and untick the others.
4. Untick Sign as if you only want encryption, check the output file name (it ends in .gpg), then click Encrypt.
5. Kleopatra shows “Encryption succeeded”. Send or store the .gpg file.

Decrypt:

1. Right-click the .gpg file → More GpgEX options → Decrypt and verify. (Or double-click it, or use Kleopatra’s Decrypt/Verify… button.)
2. Enter the passphrase for your key (or the file’s password) when asked.
3. Click Save All. The original file appears next to the encrypted one.

Windows: Encrypt and Decrypt in PowerShell

Gpg4win also installs the gpg command. Open a new PowerShell window after installing and check it works with gpg --version. Then cd to the folder with the file:

cd "$env:USERPROFILE\Documents"

Encrypt for someone (plus yourself):

gpg --encrypt --recipient alice@example.com --recipient haven@example.com --output report.pdf.gpg report.pdf

Decrypt (a passphrase window appears):

gpg --output report.pdf --decrypt report.pdf.gpg

Password-only encryption and decryption:

gpg --symmetric --cipher-algo AES256 secrets.txt
gpg --output secrets.txt --decrypt secrets.txt.gpg

A whole folder: zip it, encrypt the zip, then delete the unencrypted zip. To restore, decrypt and unzip:

# encrypt
Compress-Archive -Path .\Taxes -DestinationPath Taxes.zip
gpg --symmetric --cipher-algo AES256 --output Taxes.zip.gpg Taxes.zip
Remove-Item Taxes.zip

# decrypt and unzip
gpg --output Taxes.zip --decrypt Taxes.zip.gpg
Expand-Archive -Path Taxes.zip -DestinationPath .\Taxes-restored

Encrypt and Sign Together

Adding --sign proves the file came from you. The recipient sees Good signature from "Haven Example" when they decrypt. This works the same on Linux and in PowerShell; in Kleopatra, leave Sign as ticked.

gpg --sign --encrypt --recipient alice@example.com --recipient haven@example.com --output contract.pdf.gpg contract.pdf

Encrypt and Decrypt Problems

Step 6: Sign and Verify

Verify a detached signature (signature first, then the file):

gpg --verify setup.zip.asc setup.zip

Real-World Example: Verify a Downloaded ISO

Before installing an OS like Ubuntu, Debian or Proxmox, confirm the ISO is genuine. Projects publish a checksum file and a GPG signature of that file. Using Ubuntu as the example:

1. Download the ISO plus SHA256SUMS and SHA256SUMS.gpg from the same release folder.
2. Check the signature on the checksum file. The first time, it fails with “No public key” and shows the key ID it needs:

gpg --keyid-format long --verify SHA256SUMS.gpg SHA256SUMS

3. Fetch that key from the project’s keyserver and compare its fingerprint with the one on the project’s official website:

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys <KEY-ID-FROM-THE-MESSAGE>
gpg --fingerprint <KEY-ID-FROM-THE-MESSAGE>
gpg --keyid-format long --verify SHA256SUMS.gpg SHA256SUMS   # now: Good signature

4. Check the ISO against the now-trusted checksum list:

sha256sum -c SHA256SUMS --ignore-missing
# ubuntu-24.04-live-server-amd64.iso: OK

Real-World Example: Sign Git Commits (GitHub “Verified”)

1. Find your key ID: gpg --list-secret-keys --keyid-format=long (the part after ed25519/).
2. Tell Git to use it and sign every commit:

git config --global user.signingkey 3AA5C34371567BD2
git config --global commit.gpgsign true
git config --global tag.gpgsign true

3. Add your public key to GitHub: copy the output of the command below into Settings → SSH and GPG keys → New GPG key.

gpg --armor --export 3AA5C34371567BD2

4. Commit as usual. GitHub shows a Verified badge when the key’s email matches a verified email on your account. Check locally with git log --show-signature -1.

Managing Keys: Expiry, Editing, Revoking

Extend the expiry before it runs out (do the primary key and all subkeys), then re-share your public key:

gpg --quick-set-expire A1B2C3D4E5F6A7B8C9D0E1F23AA5C34371567BD2 2y
gpg --quick-set-expire A1B2C3D4E5F6A7B8C9D0E1F23AA5C34371567BD2 2y '*'

Interactive editing with gpg --edit-key haven@example.com, then:

Revoke a key that’s lost or compromised: import the revocation certificate, then publish the revoked key so others see it:

gpg --import haven-revoke.asc
gpg --keyserver hkps://keys.openpgp.org --send-keys A1B2C3D4E5F6A7B8C9D0E1F23AA5C34371567BD2

Delete a key from your keyring (secret part first):

gpg --delete-secret-keys alice@example.com
gpg --delete-keys alice@example.com

Passphrase caching: gpg-agent remembers your passphrase for a while. Clear it immediately with:

gpgconf --kill gpg-agent

To change how long it remembers (seconds), add to ~/.gnupg/gpg-agent.conf, then restart the agent:

default-cache-ttl 600
max-cache-ttl 7200

Command Cheat Sheet

Best Practices

• Protect the private key: strong passphrase, offline backup, never share or upload it.
• Set an expiry (1–2 years) and extend it on schedule; put a calendar reminder a month before.
• Create the revocation certificate now, not when you need it.
• Verify fingerprints through a second channel before trusting a key; never trust a key just because a keyserver returned it.
• Use modern algorithms: Ed25519/Cv25519, or RSA 4096 if compatibility requires it.
• Encrypt to yourself too (add your own --recipient) so you can read what you sent.
• Advanced: keep the primary key offline and use subkeys day-to-day, or store keys on a hardware token such as a YubiKey.

Troubleshooting

Before You Start

• A website made of HTML and CSS files on your computer. No website yet? Download the video’s sample site: open it on GitHub, click Code → Download ZIP, and unzip it.
• A free GitHub account.
• For Part 2 only: about $10–15 a year for a domain name.

Useful links:

• Namecheap: domain registrar used in the video
• MxToolbox DNS Lookup: shows which IP addresses a domain points to
• GitHub Docs: Managing a custom domain: GitHub’s own IP addresses and instructions for other registrars

Part 1: Put the Website on the Internet (GitHub Pages)

Opening an HTML file on your own computer only works for you. GitHub Pages copies your files to GitHub’s web servers so anyone can reach them.

▶ Watch this step (2:08)

Step 1: Sign in to GitHub

Go to github.com and sign in, or sign up for a new account and then sign in.

Step 2: Create a public repository

A repository is like a folder on GitHub that holds your website’s files.

1. Click your profile icon (top right) → Your repositories → New.
2. Repository name: anything that helps you recognize it, for example super-simple-website.
3. Select Public. GitHub Pages is only free for public repositories.
4. Leave the other options at their defaults and click Create repository.

Step 3: Upload your website’s files

▶ Watch this step (3:34)

1. In the new repository, click uploading an existing file. If you don’t see the link, add /upload to the end of the repository’s URL.
2. On your computer, open your website’s folder, select everything inside it, and drag the files into the upload box.
3. Wait for every file to finish uploading, scroll to the bottom and click Commit changes.

Step 4: Turn on GitHub Pages

▶ Watch this step (4:50)

1. In the repository, click Settings (top tab) → Pages (left menu).
2. Under Build and deployment, set the branch drop-down to main (it may say master; pick whichever isn’t None). Leave the folder as / (root).
3. Click Save.
4. Wait a couple of minutes, then refresh the page. It will say Your site is live at followed by the address.

Your site’s default address always follows this pattern:

https://YOUR-USERNAME.github.io/REPOSITORY-NAME/