3 ms·

This argument has been going since the Pi came out. I'd agree most people shouldn't. They should just get a NUC and save themselves the headaches. If you kno

This argument has been going since the Pi came out. I'd agree most people shouldn't. They should just get a NUC and save themselves the headaches. If you know what you're getting into, though, and build to it's lack of strength you can go pretty far. Current inflated prices are a hard no from me. Minecraft servers are likely the heaviest of the ~15 services I run at home. You chose a service that I wouldn't have expected to work. My Pi 4 4GB runs an MPD server that outputs to a HiFiBerry DAC, Zabbix and Grafana. It's done so smoothly for about a year now. At one time it acceptably ran Nextcloud, Gitea, Matrix Synapse, Vaultwarden and a file server in systemd containers. At another time, it replaced an old AMD e350 machine I was using for backups - the Pi 4 was faster than that old desktop. The bottleneck was the CPU load when transferring data over SSH.

LinuxBender 4y ago
Just my own preference, but I was going the route of NUC and instead landed on Protectli routers. They are meant to be routers/firewalls but work as general purpose PC's and at least at the time costed less than a NUC and have more interface options. They are air cooled and generally run cool unless doing heavy workloads but not a problem in my case. I just set them next to my HEPA filter. One can chose between CoreBoot and AMI bios and many different CPU options. [1] - https://protectli.com/ https://protectli.com/
- atmosx 4y ago
  These are rather expensive for SoHo. I would go with a carambola2 or another module from 8-devices running OpenWRT.
  - LinuxBender 4y ago
    Those are also good options for routers/firewalls. I think Protectli is aiming for devices that can handle VPN encryption/decryption at a decent rate on their Core i5/i7 models. I only mention the Protectli devices because for me at least they were a decent alternative to NUC's and for general computing whereas some of the SoHo devices are less apt for general computing in my experience.
    - atmosx 4y ago
      Right, makes sense.
72deluxe 4y ago
I run a Pi 8GB booting from a USB3 NVMe. It runs a PiHole, plus acts as a WireGuard server so I can VPN into it permanently on my phone and actually get useful adblocking on the go. I also run a Navidrome instance on it and use Subtracks on Android so I can get all my music whilst out and about. It also runs a Mopidy server so I can play music at home over the proper speakers using Mopidy Mobile. It also acts as a DDNS informer so that I can always get home when my ISP decides to change my public IP. It also acts as a SSH gateway and runs a RDP instance on it. I did used to use it as a desktop device and a Moonlight/Steam desktop streamer but now the PC is in the same room, and a Pi400 is downstairs with the TV. That runs much cooler. All in all a great useful device and not sure how I'd live without it.
- rythmshifter 4y ago
  hi there, I plan to do this pihole + wireguard setup in the very near future, do you have any advice or reference material you used in setting it up? Would be incredibly helpful. Thank you!
  - 72deluxe 4y ago
    I use the Pi4 passively cooled using an aluminium enclosure. If the form factor is not important to you, the Pi400 runs far far cooler (and faster) because it has a large heat spreader inside it. For the NVMe, I got an Icybox NVMe enclosure because the other enclosures were problematic. I was using a "SSK Aluminum M.2 NVME SSD Enclosure Adapter, USB 3.1 Gen 2 (10 Gbps) to NVME PCI-E M-Key Solid State Drive External Enclosure (Fits only NVMe PCIe 2242/2260/2280)" - https://www.amazon.co.uk/gp/product/B07MNFH1PX https://www.amazon.co.uk/gp/product/B07MNFH1PX I ended up replacing it with a "ICY BOX M.2 NVMe Enclosure for M.2 NVMe PCIe SSD, USB 3.1 (Gen 2, 10 Gpbs), USB-C & USB-A Cable, Aluminum, Black" - https://www.amazon.co.uk/gp/product/B07JJXCSC4 https://www.amazon.co.uk/gp/product/B07JJXCSC4 The ICY BOX actually supports booting from it unlike the SSK so I managed to ditch the microSD card too. Here was my enquiry on the forum about it: https://forums.raspberrypi.com/viewtopic.php?t=307291 https://forums.raspberrypi.com/viewtopic.php?t=307291 Once you're set up with Pihole running on it and can SSH into it, installing Navidrome is easy - just follow the installation guide at https://www.navidrome.org/docs/installation/linux/ https://www.navidrome.org/docs/installation/linux/. For Wireguard installation, I used https://github.com/pivpn/pivpn https://github.com/pivpn/pivpn I also use a Wireguard UI (which stores its configuration in a different place to the "stock" Wireguard installation in the pivpn above): https://github.com/ngoduykhanh/wireguard-ui https://github.com/ngoduykhanh/wireguard-ui There are some rules to permit incoming traffic on Wireguard in and out: Post up: iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE Post down: iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE For DDNS, I just run a cron job that connects to a free plan on https://freedns.afraid.org/ https://freedns.afraid.org/. They have a bash script to use - very simple. I run Wireguard on my phone as an "always on" VPN which connects to the domain registered at the DDNS service, so I know that mydomain will also go home. To get DNS working over the Wireguard, you may have to change the Pihole settings to "permit all origins" for DNS requests. For incoming traffic at my home, the router port forwards the appropriate Wireguard port to the Pi (on its static address). The Pi is not set as a DMZ or anything. Enjoy!

LinuxBender 4y ago

Just my own preference, but I was going the route of NUC and instead landed on Protectli routers. They are meant to be routers/firewalls but work as general purpose PC's and at least at the time costed less than a NUC and have more interface options. They are air cooled and generally run cool unless doing heavy workloads but not a problem in my case. I just set them next to my HEPA filter. One can chose between CoreBoot and AMI bios and many different CPU options. [1] - https://protectli.com/ https://protectli.com/

atmosx 4y ago
These are rather expensive for SoHo. I would go with a carambola2 or another module from 8-devices running OpenWRT.
- LinuxBender 4y ago
  Those are also good options for routers/firewalls. I think Protectli is aiming for devices that can handle VPN encryption/decryption at a decent rate on their Core i5/i7 models. I only mention the Protectli devices because for me at least they were a decent alternative to NUC's and for general computing whereas some of the SoHo devices are less apt for general computing in my experience.
  - atmosx 4y ago
    Right, makes sense.

72deluxe 4y ago

I run a Pi 8GB booting from a USB3 NVMe. It runs a PiHole, plus acts as a WireGuard server so I can VPN into it permanently on my phone and actually get useful adblocking on the go. I also run a Navidrome instance on it and use Subtracks on Android so I can get all my music whilst out and about. It also runs a Mopidy server so I can play music at home over the proper speakers using Mopidy Mobile. It also acts as a DDNS informer so that I can always get home when my ISP decides to change my public IP. It also acts as a SSH gateway and runs a RDP instance on it. I did used to use it as a desktop device and a Moonlight/Steam desktop streamer but now the PC is in the same room, and a Pi400 is downstairs with the TV. That runs much cooler. All in all a great useful device and not sure how I'd live without it.

rythmshifter 4y ago
hi there, I plan to do this pihole + wireguard setup in the very near future, do you have any advice or reference material you used in setting it up? Would be incredibly helpful. Thank you!
- 72deluxe 4y ago
  I use the Pi4 passively cooled using an aluminium enclosure. If the form factor is not important to you, the Pi400 runs far far cooler (and faster) because it has a large heat spreader inside it. For the NVMe, I got an Icybox NVMe enclosure because the other enclosures were problematic. I was using a "SSK Aluminum M.2 NVME SSD Enclosure Adapter, USB 3.1 Gen 2 (10 Gbps) to NVME PCI-E M-Key Solid State Drive External Enclosure (Fits only NVMe PCIe 2242/2260/2280)" - https://www.amazon.co.uk/gp/product/B07MNFH1PX https://www.amazon.co.uk/gp/product/B07MNFH1PX I ended up replacing it with a "ICY BOX M.2 NVMe Enclosure for M.2 NVMe PCIe SSD, USB 3.1 (Gen 2, 10 Gpbs), USB-C & USB-A Cable, Aluminum, Black" - https://www.amazon.co.uk/gp/product/B07JJXCSC4 https://www.amazon.co.uk/gp/product/B07JJXCSC4 The ICY BOX actually supports booting from it unlike the SSK so I managed to ditch the microSD card too. Here was my enquiry on the forum about it: https://forums.raspberrypi.com/viewtopic.php?t=307291 https://forums.raspberrypi.com/viewtopic.php?t=307291 Once you're set up with Pihole running on it and can SSH into it, installing Navidrome is easy - just follow the installation guide at https://www.navidrome.org/docs/installation/linux/ https://www.navidrome.org/docs/installation/linux/. For Wireguard installation, I used https://github.com/pivpn/pivpn https://github.com/pivpn/pivpn I also use a Wireguard UI (which stores its configuration in a different place to the "stock" Wireguard installation in the pivpn above): https://github.com/ngoduykhanh/wireguard-ui https://github.com/ngoduykhanh/wireguard-ui There are some rules to permit incoming traffic on Wireguard in and out: Post up: iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE Post down: iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE For DDNS, I just run a cron job that connects to a free plan on https://freedns.afraid.org/ https://freedns.afraid.org/. They have a bash script to use - very simple. I run Wireguard on my phone as an "always on" VPN which connects to the domain registered at the DDNS service, so I know that mydomain will also go home. To get DNS working over the Wireguard, you may have to change the Pihole settings to "permit all origins" for DNS requests. For incoming traffic at my home, the router port forwards the appropriate Wireguard port to the Pi (on its static address). The Pi is not set as a DMZ or anything. Enjoy!