The Beginner’s Homelab: What to Buy First, What to Skip

Part of Sovereign Builder Protocol

The cheapest new server worth owning costs $339.00. That is the Beelink Mini S12 Pro, an Intel N100 mini PC with 16GB of RAM and a 512GB SSD, and it idles at 8 to 9 watts according to third party measurements. At the U.S. residential average of 18.31 cents per kWh, running it every hour of every month costs $1.20. Your cheapest streaming subscription costs more than that.

That $1.20 is the entire recurring cost. There is no licence fee, no per device charge, and no company that can switch off your file server because you missed a payment. The sticker price is the price. After that, the only bill is electricity, and electricity is measured in pennies.

This guide gives you a buy order in three stages, the software stack with current versions, a backup plan that survives a dead drive, and remote access that never touches your router’s port forwarding table. If you want the philosophy first, read What Is the Sovereign Builder Protocol?. If you want a shopping list, keep reading.

What a Homelab Actually Is

A homelab is a computer in your house that runs services for you, instead of you renting those services from someone else’s data center. That is the entire definition. Your photo backup uploads to a machine you own. Your movies stream from your own drive. Your ad blocking happens inside your own network. No rack, no server closet, no noise complaints from downstairs.

A starter setup runs a short list of things:

• Photo backup from your phone, automatic, with no storage tier to upgrade
• A media server for files you actually own
• Network wide ad and tracker blocking for every device in the house
• File sync, so your working documents live at home first
• Home automation that keeps working when the internet does not

The difference between this and the cloud versions is custody. When your files sit on someone else’s servers, their terms of service are your property rights, and those terms change without asking you. Providers lock people out of their own accounts with no appeal process, which is exactly what happened to the manga artist I covered in the Google Drive backup piece. A homelab removes that single point of failure from your life.

It also pairs naturally with the wider privacy approach I laid out in The 2026 Sovereign Stack. You decide who gets to see what, because the default answer becomes nobody.

Later, the same box can run local language models, which is its own project with its own hardware math. I cover that separately in the beginner’s guide to local LLMs. Do not buy hardware for it yet.

Stage One: The First 0

You do not buy a NAS first. You buy a small computer, put an operating system on it, and find out what you actually use. Two paths fit a first budget.

The used business desktop. A refurbished Dell OptiPlex 3070 Micro with a Core i5-9500T, 16GB of RAM, and a 256GB NVMe drive lists at $226.34. It is a hair over $200 and worth every dollar of the overage. Full x86 compatibility means every Docker image just works, 16GB of memory is real headroom, and the storage swaps out when you outgrow it.

The Raspberry Pi route. A CanaKit Raspberry Pi 5 starter kit in the 4GB version runs $204.95 and includes the board, a 128GB microSD card with Raspberry Pi OS preloaded, a case, a heatsink, a fan, the power supply, and two micro HDMI cables. If you already own the accessories, boards alone run from $130 for 4GB to $350 for 16GB at Adafruit, with the 8GB board in between.

Buy the used OptiPlex. A used business micro desktop lands roughly one third cheaper than an equivalent new N100 mini PC while giving you more RAM headroom and swappable storage. The Pi is a fine learning machine, but 4GB gets tight fast once you stack three or four containers, and ARM occasionally means a Docker image has no build for it.

Whoever you pick, the power bill is a non issue. The new N100 mini PCs idle at 8 to 9 watts, which is the difference between a server and a space heater. That is why this hobby never shows up on your electricity statement.

Stage Two: Up to 0 Total

Stage two turns a computer into infrastructure. Three additions, in this order.

A switch, $35.99. The TP-Link TL-SG105 is a five port gigabit switch in a fanless metal case, and it is the cheapest way to stop fighting your router for ports. The 2.5 gigabit version is $39.99, about four dollars more, and the easy smart managed version is $38.60. Buy the gigabit one. Your internet connection is not the bottleneck. The machines talking to each other inside your house are.

A UPS, $98.99. The APC Back-UPS BE600M1 is rated 600VA / 330 watts with seven outlets. Power flickers corrupt writes and kill snapshots mid run, and a $99 box ends that risk. Compare the 330 watt rating against your rack’s total draw before you buy anything bigger.

A better machine or your first real drive. If the 3070 feels cramped, a refurbished OptiPlex 7060 Micro with an i5-8500T, 16GB, and a 512GB SSD is $314.99, and the i7-8700T version with a 256GB NVMe is $281.65. Or skip the upgrade and add your first NAS grade hard drive: a Seagate IronWolf 4TB is $189.99, which works out to $47.50 per terabyte.

Sample build: the $226.34 OptiPlex from stage one, the $35.99 switch, and the $98.99 UPS. That is $361.32 all in, and it is already a complete homelab. Add the 4TB drive and you land at $551.31, which is what “about $500” honestly means once you touch retail prices.

Now check the running cost, because this is the part nobody believes. A 32 watt homelab, one mini PC, a two bay NAS, and a small switch, costs $4.28 per month at 18.31 cents per kWh. That is $51.33 a year. A 50 watt setup with a used desktop thrown in runs $6.69 per month. The electricity will never be the expensive part of this hobby.

Stage Three: ,500 Buys Storage, Not Speed

By this stage the bottleneck is not the computer. It is the drives. Two 4TB NAS drives cost $379.98, which is more than the $339.00 mini PC they attach to, and that ratio only gets worse as you grow. Plan for it now instead of pretending it away.

Your options at this tier:

• UGREEN NASync DXP2800, $389.99 diskless. Two bays, an Intel N100, 8GB of DDR5, 2.5GbE, and two M.2 slots for fast cache drives. More headroom than the Synology below.
• Synology DS223j, $211.99 diskless. The cheaper, quieter option, rated at 16.31 watts in use, 4 watts with drives hibernating, and 18.2 dB(A) of noise. Synology’s software is the most beginner friendly in the business, and it barely sips power.
• Drives, the real expense. A WD Red Plus 10TB is $404.99, which works out to $40.50 per terabyte against $47.50 per terabyte for the 4TB IronWolf. Buy the big drives once instead of buying small ones twice.
• More compute, only with a reason. The Beelink SER8, a Ryzen 7 8745HS with 32GB of DDR5 and a 1TB NVMe, is $859.00. Buy it when a workload demands it, not because it benchmarks better.

The $1,500 build: keep your OptiPlex, add the DXP2800 at $389.99, and drop in two WD Red Plus 10TB drives at $809.98. That is $1,199.97 of new spending on top of stage two, which puts the whole lab at $1,561 with the UPS included. If you would rather have one appliance do everything, Synology sells the DS223j bundled with 16TB of drives, assembled, at $1,349.09. That bundle tells you exactly where the money goes at this tier: into spinning rust, not silicon.

One warning about flash storage while you shop. The cheapest SATA SSD here costs about 5.9 times as much per terabyte as the cheapest 4TB NAS hard drive. Use a small SSD for the operating system and container data, and hard drives for bulk.

And if the SER8 caught your eye because you want to run large local models, read the honest hardware bill for running GLM-5.2 locally first. VRAM decides that game, not CPU, and the bill is higher than most people expect.

The Software Stack, With Current Versions

Everything in this section is free unless marked otherwise, and the versions are current as of late September 2026. One rule before the list: install one thing, use it for a week, then add the next. That layering discipline is the same one behind the Sovereign Builder Protocol, and it is the difference between a homelab and a shelf of abandoned SD cards.

The operating system: Proxmox VE 9.2

Proxmox VE 9.2 is a free type 1 hypervisor that runs virtual machines and LXC containers side by side on one box. The current ISO installer is 9.2-1, published 2026-05-21, a 1.71 GB download from the Proxmox site. The no subscription repository needs no subscription key, and Proxmox’s paid plans, 120 to 1,100 EUR per CPU socket per year, buy enterprise support you do not need at home. If you would rather have one plain server with no virtualization layer, install Debian 13, codename trixie, currently at point release 13.7, with full support until 2028 and LTS updates until 2030. Ubuntu 26.04.1 LTS is the other sane default.

Containers: Docker Engine 29.8.1

Almost everything below ships as a container. Docker Engine is at 29.8.1, released 2026-09-15, and Docker Compose is at v5.5.1, released 2026-09-03. Compose lets you define your whole stack in one file, which means rebuilding everything after a failure is one command instead of one weekend. Learn the file format once and it pays you back forever.

Media: Jellyfin 12.1 versus Plex

Jellyfin 12.1 is free, open source, needs no account, and has no paid tier. Plex, currently at build 1.43.4, streams freely inside your home network with no subscription, but remote streaming and hardware transcoding sit behind Plex Pass at $6.99 per month, $69.99 per year, or $749.99 lifetime, per the Plex Pass page. There is also a remote streaming only tier, Plex Remote Watch Pass, at $2.99 per month. Start with Jellyfin. Pay Plex only if you hit a wall it fixes.

Ad blocking: Pi-hole v6.4.3 or AdGuard Home v0.107.79

Pi-hole core is at v6.4.3, with web interface v6.6 and FTL v6.7.1. AdGuard Home is at v0.107.79, with a friendlier interface and built in encrypted DNS. Both filter ads and trackers for every device on your network, including the ones that cannot install extensions. Install one, not both, and point your router’s DHCP settings at it.

Photos and home automation: Immich v3.2.4 and Home Assistant 2026.9.4

Immich v3.2.4 is the self hosted Google Photos replacement, with mobile app auto upload that actually works. Home Assistant Core is at 2026.9.4, and the appliance style Home Assistant OS 18.3 image is the easy install on a Pi or a spare mini PC. Both run fine in a container or a small virtual machine on the Proxmox box.

Monitoring: Uptime Kuma 2.5.5

Uptime Kuma 2.5.5 watches every service you run and alerts you when one dies, which is how you find out before your family does. Once that feels comfortable, add real automation with self hosted n8n agents, and the box stops being a file server and starts being a worker.

Local AI fits here too, once the rest is stable. The private AI workflows guide shows how to keep client secrets off someone else’s GPU. And the Venice AI piece explains why private AI is becoming a developer edge in 2026. Both assume you already have a machine humming, which by now you do.

Backups and the 3-2-1 Rule

A homelab without a backup plan is a single point of failure that you built yourself. The minimum bar is the 3-2-1 rule as Backblaze defines it: three copies of your data, on two different types of media, with one copy off site. Notice what is not on that list. Your server’s drive array is not a backup. It is the original.

Here is what the rule looks like in practice:

• Copy one: the live data on your server. This is the working copy everything else protects.
• Copy two: a second drive or a second machine. Another 4TB IronWolf is $189.99. Proxmox users can add Proxmox Backup Server 4.2, which deduplicates guest backups so the second snapshot costs a fraction of the first.
• Copy three: off site. Cloud storage, or a machine at a relative’s house that syncs while they sleep.

For file level backups, use restic v0.19.1 or BorgBackup 1.4.5. Both are free, both encrypt before anything leaves the machine, and both deduplicate, so snapshot one hundred costs almost nothing. Schedule them and walk away. A backup you have to remember to run is a backup that does not exist.

Do not skip the offsite copy because the first two feel like enough. You already saw what happens when a provider decides your files are their problem, and one copy in a different building is the cheapest insurance in this entire hobby. The second and third copies cost real money, which is exactly why most beginners skip them right up until the day they need them.

Two habits separate people who never lose data from people who eventually do. Test a restore every few months, because an untested backup is a hope, not a backup. And budget for the copies up front, at purchase time, not after the first scare.

Remote Access Without Opening Ports

Do not forward ports. Every open port on your router is a door the entire internet can knock on, and exposed login pages get scanned constantly by bots that never sleep. You do not need a static IP, you do not need port forwarding, and you do not need to expose a single service to reach your files from anywhere.

Install Tailscale. The current release is v1.102.4, it is a WireGuard based mesh VPN, and it needs no port forwarding at all. The Personal plan is free forever, with unlimited user devices, up to 6 users, up to 3 ACL groups, and up to 50 tagged resources. Your phone, your laptop, and your server join one private network, and your services are reachable from anywhere as if you were sitting at home. If you outgrow it, Standard runs $8 per user per month.

Two alternatives, both free. The WireGuard tools, currently v1.0.20260223, let you run the VPN yourself if you enjoy configuration files. And cloudflared 2026.9.3, the Cloudflare Tunnel client, publishes a local service to the internet over an outbound only connection, so nothing on your router ever listens for inbound traffic. The tunnel client is free and open source.

The goal is simple. Your router’s port forwarding table stays empty, permanently. Anything that needs to reach the outside world goes through the mesh or the tunnel, and your attack surface drops to nearly nothing. If your threat model is stricter than average, the sovereign stack guide covers the privacy layer in depth.

What to Skip

Four things, and the first one is where beginners burn the most money.

• The $859 mini PC. The Beelink SER8 costs 2.5 times what the N100 box does, and the difference mostly buys transcoding and compute headroom you will not touch in year one. Your limiting factors are RAM and storage, and you already planned for both.
• Rack gear. Server chassis, enterprise switches, and 42U racks are loud, hot, and power hungry. Every watt costs about $0.13 per month forever, and none of it makes your photo backup faster.
• A GPU for local AI on day one. Big models live and die on VRAM, and the honest bill is in the GLM-5.2 hardware piece. Get the homelab running first, then decide.
• Port forwarding rules. Covered above, worth repeating: an empty forwarding table is a feature, not a limitation.

Skipping this list is not the same as skipping the hobby. It is sequencing. Buy the boring reliable core, run it for a month, and let your actual usage tell you what the next $200 is for. That discipline is the whole idea behind the Sovereign Builder Protocol: build in layers, and own each one before you add the next.

Questions Every Beginner Asks

Do I need a static IP or port forwarding?

No. Tailscale and Cloudflare Tunnel both work behind a normal home connection with no port forwarding at all. Your router’s forwarding table should stay empty permanently.

What does the whole thing cost per month to run?

A 9 watt mini PC costs $1.20 per month at the average U.S. rate of 18.31 cents per kWh. A 32 watt stack costs $4.28, and a 50 watt setup with a used desktop runs $6.69.

Is a two drive NAS the same as a backup?

No, it is one copy on one device. The 3-2-1 rule wants three copies on two types of media with one off site, and the offsite copy is the one everyone skips.

Can this hardware run local AI?

Small quantized models, yes. Anything serious is a VRAM question, so read the GLM-5.2 versus local Qwen versus Opus comparison before you spend money.

Which operating system should I install first?

Proxmox VE 9.2 if you want virtual machines and containers on one box, Debian 13 if you want one simple server. Both are free, and both run everything in this article.

Your First Weekend Checklist

Hardware ordered, software chosen. Here is the exact sequence for the first weekend.

1. Order the used OptiPlex, the TL-SG105 switch, and the APC UPS. About $361 all in.
2. Flash the Proxmox VE 9.2 ISO to a USB stick and install it.
3. Give the server a fixed IP address in your router’s DHCP settings.
4. Run every update, then create a non root user with a real password.
5. Install Docker Engine 29.8.1 and Docker Compose v5.5.1.
6. Deploy Jellyfin 12.1 and Pi-hole v6.4.3 as your first two containers.
7. Install Tailscale v1.102.4 on the server and your phone, then reach the dashboard over mobile data with wifi off.
8. Plug the server into the UPS and test a clean shutdown on battery.
9. Point restic v0.19.1 at a second drive and run your first encrypted snapshot.
10. Restore one file from that snapshot on purpose, so you know the restore path works.

That is a working homelab: ad blocking for the whole house, your own media server, remote access with zero open ports, and one tested backup. Live with it for a month before adding anything, then bring in n8n automation when the box has earned your trust.

When you start pointing the server at real work, my rundown of AI coding tools for developers shows what a home machine can carry in a daily workflow. Order the stage one parts today. Your electricity bill will not even notice.

Try it here: Venice AI private chat. If you try Venice through this link, TheThriftyDev may earn a referral benefit.