self-hosting

BitTorrent and private-tracker clients benefit from accepting inbound connections, but CGNAT prevents that. Your ISP places multiple subscribers behind one public IPv4 address, so there is no inbound mapping for the home server. Port forwarding on the home router does not help because the relevant NAT is upstream at the ISP.

A VPS with a public address and a WireGuard tunnel can relay the traffic. It receives torrent connections on a port range and forwards them through the tunnel to the home server. To peers, the home server is then reachable at the VPS's public address.

The Late 2012 Mac Mini Server makes a cheap Proxmox VE node and is the last fully upgradeable Mac Mini. Its two SO-DIMM slots support 16GB of RAM, and its two 2.5-inch SATA bays can hold a boot disk and a datastore. Apple soldered the RAM in 2014 and moved the line to ARM in 2020, so newer Minis either cannot take more memory or cannot run x86 virtualization.

Its quad-core mobile Ivy Bridge i7 keeps power use modest for four cores. The whole machine is a 19cm-square box that fits on a shelf.

The Linux OOM killer runs when the kernel can no longer reclaim memory. If anonymous memory exceeds RAM and has nowhere to go, the kernel scores processes and kills the one with the highest score. On a small VPS, that can be the application, database, or build job you meant to keep alive. A low-priority daemon with a large RSS can lose, but so can one large process when there is no swap.

Swap gives anonymous pages backing storage under memory pressure. The kernel can evict those pages instead of killing the owning process, at the cost of latency when it reads them back. On a VPS, that delay is often preferable to losing the process.

I run two inexpensive OranMe VPS instances: one has 0.1 CPU and 128MB RAM, the other 0.5 CPU and 512MB. They are only suitable for light self-hosted work, so I installed Debian without a desktop environment.

The 0.1 CPU box kept shutting down. In the OranMe control panel, its CPU usage hit the limit shortly before each crash. That looked like the provider's abuse protection killing the VM. /var/log/system.log showed that the spikes matched apt's periodic tasks.

Nginx is an event-driven web server. Its worker pool multiplexes I/O across many connections instead of assigning a thread to each one. It is commonly used for static sites, reverse proxies, and TLS termination.

Remote LAN access lets devices reach a private network from anywhere. ZeroTier uses a virtual L2 network with P2P paths. Tailscale builds on WireGuard with NAT traversal. Cloudflare Tunnel uses a reverse proxy model.

ACME is the protocol for automated certificate management. Let's Encrypt speaks ACME. Certbot is the official ACME client from EFF. This guide covers Certbot with Cloudflare DNS validation.

A container is not a virtual machine. VMs emulate hardware and run a full OS kernel. Containers share the host kernel and isolate processes using namespaces (which partition what a process sees: filesystem, network, PIDs, users) and cgroups (which cap what it uses: CPU, memory, I/O).

业精于勤荒于嬉，行成于思毁于随。
Achievements are reached by hard work rather than recreation. Actions are done after thorough consideration rather than casual decisions.