Home server · the build

Home Linux Server

From the box on the porch to movies that land in Plex on their own.

Bought Oct 7 and 9, 2026 · VPN Oct 10 · Build day Fri, Oct 16

✦
Where you are. Parts ordered, VPN bought, tower ready, installer stick made, cabinet checked, router login works. Next: nothing to buy. The 1TB drive arrives Sun, Oct 11, and the short list left is on the Inventory tab. You do the hands and the installer screens. Claude does the rest over SSH and stops to ask before it wipes the two drives.
WhenYour part
Now to Oct 15Two step login on Proton and Plex. Nothing to buy (tape only if needed)
Sun, Oct 11The 1TB drive arrives. Tick it
Thu, Oct 15The RAM arrives. Read its label
Fri, Oct 16Stops 1 and 2, about 1.5 hours. Then tell Claude "the NAS is up"
Oct 16 to 18Plug in the two drives. Claude tests them for about 1.5 days
About Oct 18Shuck the drives, then say "wipe ok"
After thatClaim Plex, sign in on the TV, then the first movie
How a movie or show gets there. Add it to your Plex Watchlist on any phone or TV and it lands in Plex on its own, like a personal shopper working from your list. Seerr reads the list every 3 minutes, Radarr (movies) or Sonarr (TV) finds a copy, qBittorrent downloads it through a VPN, the same app shelves it, and Plex and Jellyfin show it. A show on the Watchlist asks for every season; for just one season, ask in Seerr instead.

Plex Watchlist → Seerr → Radarr or Sonarr → Prowlarr → qBittorrent (VPN only) → Plex + Jellyfin

Example: when Avengers: Doomsday could land on its own

Add it to your Watchlist any time. Seerr files it within 3 minutes, then Radarr waits: it only takes a movie once it is out to buy or rent at home (its Released setting), or up to 14 days before that date, since good copies often show up a few days early. Nothing downloads before that unless you press Search in Radarr or ask for it a second time in Seerr.

WhenWhat happens
NowOn your Watchlist. Radarr lists it as wanted. Nothing downloads
Fri, Dec 18, 2026In theaters. Radarr still waits
About Tue, Feb 2 to 9, 2027 (estimate)Radarr starts looking, 14 days early. It reads new uploads every 30 minutes and takes the first good copy
About Tue, Feb 16 to 23, 2027 (estimate)Out to buy or rent
About Mar 31 to Apr 14, 2027 (estimate)On Disney+

Radarr on its own only reads new uploads, so a copy that went up before it counted the movie as out is never seen. The NAS covers that. Every 4 hours it asks Radarr and Sonarr to search again for anything wanted, out and still missing, and it clears a download stuck for a day so the app picks another copy. You do nothing.

Why those dates: the last four Marvel Studios films went to buy or rent 60 to 67 days after theaters, and to Disney+ 103 to 117 days after. December films have run later (both Avatar films took 102 days, which here would be Mar 30). If no home release date is ever listed, Radarr falls back to 90 days after the first theater date, Mar 16, and starts looking 14 days before that, Mar 2. Dates from Marvel and TMDB; the rule from Radarr's own code. Read Oct 10, 2026.


Open for you: Plex Pass. Start free; if you buy, buy in Black Friday week (about Nov 23 to 30, estimate). A daily watch pings your Discord the day a sale shows up. Before Oct 16, read the UPS model off its label. In week one, two accounts and a spare USB drive.

Build: unboxing to Plex

Seven stops. You rows are yours. Claude rows run over SSH from the tower while you watch, or while you sleep. Tick rows as you go; this page remembers per device.

Stop 0Before build day

Stop 1Unbox and install the parts Fri, Oct 16, 30 minutes

Stop 2BIOS and Debian Oct 16, about 1 hour

Stop 3Test both drives before opening them Oct 16 to 18, it runs alone

Stop 4Shuck, mirror, copy about Oct 18

Stop 5Plex and Jellyfin while the copy runs

Stop 6Movies that add themselves

ReferenceEverything else

The software, and what lost

Picked Oct 9, 2026 from Reddit, GitHub and each project's own pages. Every version was read from its image registry that night.

AppJobVersionWhy this one
PlexPlays the library on every TV and phone1.43.4Best apps everywhere. Runs from the LinuxServer.io image
JellyfinThe same library, free, no account12.2Quick Sync with no subscription, and a fallback if Plex changes its terms
PlexampPlays the Music library on your phone, car and desktopphone appPlex's own music player, free since Jul 18, 2023 (some extras need Plex Pass)
AudiobookshelfAudiobooks and podcasts. Finds a podcast, then downloads new episodes on a schedule2.37.1Plex has no audiobook library and dropped podcasts Apr 15, 2022. Jellyfin's book library gets mixed reviews
SeerrReads your Plex Watchlist every 3 minutes and files the requests3.5.0Overseerr and Jellyseerr merged into it. Overseerr was archived Feb 15, 2026
RadarrFinds the movie, picks the best copy, files it under a clean name6.4.4The standard. Nothing close
SonarrThe same job for TV: finds each episode, files it by show and season4.0.20The standard for TV, and it works the same way as Radarr
ProwlarrOne list of search sources, shared with Radarr and Sonarr2.6.5Beats Jackett because it hands the list to both by itself
qBittorrentDownloads5.2.4Radarr's best supported client
gluetunThe VPN the downloader lives inside3.41.3No tunnel, no traffic, by design
Repeat search (the kit's own wanted_search.py)Every 4 hours: searches again for anything wanted that is out, and clears downloads stuck for a daykitRadarr and Sonarr never go back to search on their own. A small script with no web page and no open port. How it helps

Skip: Huntarr (a Feb 2026 flaw exposed its users' passwords and app keys), Watchtower (archived Dec 17, 2025, and auto updates fight pinned versions), Ombi (slow), Cleanuparr (three security flaws in 2026, fixed since; the kit's own repeat search clears stuck downloads).

Why downloads and the library share one folder

Downloads land in /data/torrents/movies, the library lives in /data/media/movies, and both sit on one ZFS dataset, tank/data. That lets Radarr and Sonarr make a hardlink instead of a copy. Two datasets would be two file systems, and in TRaSH Guides' words, "You CAN'T hardlink across separate file systems". Apps, backups and camera footage keep their own datasets.

How it stays private
  • Nothing on the EdgeRouter forwards to the NAS. That is the real wall.
  • The firewall allows your home network only. Docker skips that firewall for the ports it publishes, so each of those is tied to the NAS's home address.
  • The downloader shares the VPN container's network. No tunnel, no traffic.
  • Every app has a login, and every version is pinned and updated on purpose (the NAS app rules).
Fitting it in the cabinet

From your photo: EdgeRouter 4, a UniFi switch, a CAT6 patch panel, a CyberPower UPS and PDU, the Reolink NVR, and the Dish Hopper, in an enclosed cabinet with a thermostatic exhaust fan to the attic. The DXP4800 Pro is about 7 x 7 x 10 inches, smaller than the Hopper's footprint. One CAT6 to the UniFi switch, not the router.

Modem EdgeRouter 4 UniFi switch NEW: DXP4800 ProPlex, Jellyfin, scrapers Reolink NVR Dish Hopper <- one CAT6

Your access point hangs off port 17 of that switch, jack 19 on the patch panel. Pick a different port.

The kit Claude runs, on the tower

Every step Claude runs is written and tested ahead of time in C:\Users\Exterminator\Documents\Claude\Projects\HomeServer\nas_kit. Start with RUNBOOK.md: who does what, the two places Claude asks first, the proof for each step, and how to undo it.

FileDoes
nas_handoff.ps1Your one command after Debian's first boot
nas_run.pyClaude's remote control. Passwords travel hidden, never inside a command
bootstrap.shThe system, one step at a time: base, drive tests, ZFS, pool, share, Docker, apps
compose.ymlThe eight apps, versions pinned (Sonarr for TV added Oct 10)
configure_apps.pyWires the apps through each one's own API, then reads every setting back

Typing it by hand instead: every command is in C:\Users\Exterminator\Documents\Claude\Projects\HomeServer\BUILD_WALKTHROUGH.md

Inventory: what you have, what you need

Everything the build touches, in one list. Tick a row once it is in the house or done; this page remembers per device. Spent so far: $2,196.02 on parts, plus $71.76 and tax for two years of VPN. Space: the two 20TB drives hold the same files (a mirror), so you get about 18 TiB, and your movies use 6.2 TiB of it.

If neededNothing left to buy

CheckBefore Oct 16

OrderedOn the way

HaveAlready yours

WhatIts job here
√Tower PCClaude runs the build from it. Its E: drive holds Movie Center 2 (6.2 TiB), copied to the NAS about Oct 18
√Network cabinetRouter, UniFi switch, patch panel and UPS are all in place. Where the NAS goes
√Installer stickDebian 13.7, written and read back by Claude Oct 10. The USB step
√Claude's side of the towerThe NAS login key, the ssh nas shortcut and the app passwords. Done Oct 10
√Proton VPN PlusTwo years, bought Oct 10. The NAS key is in your .env. Dates to watch
√Avira PrimeYour devices' VPN until about Thu, Jun 24, 2027 (257 days on Oct 10). Nothing renews. Proton takes over then; reminder on your calendar Jun 10, 2027
√Monitor, keyboard and mouseIn the cabinet already. Used on build night for the BIOS and the installer
√Cabinet hookupsChecked Oct 10: an HDMI cable, with the monitor set to its HDMI input; a free UniFi switch port (not 17, the access point's); a free UPS outlet for the NAS; Cat5e cables and a crimper. A cable you crimp gets a speed check on build night
√EdgeRouter loginWorks, checked Oct 10. Build night uses it once to reserve the NAS's address
√Guitar picksSet aside. They pop the drive cases open when you shuck them, about Oct 18
√BitwardenHolds the Proton and EdgeRouter logins
√Reolink camera recorderKeeps recording to its own 2TB drive, about 16 days that loop. It records only to a drive inside it or plugged into it. To keep more, Frigate can record the cameras onto the NAS later, capped (2TB is about 17 more days)
√TV and phoneThe Plex app, for the Watchlist and for watching

AccountsLock them down

Week oneWhen Claude asks

ReferenceHow the shopping went

Why shucking won after all

On Sep 13 a WD Elements 20TB cost $764.99, $38 per TB, and shucking looked dead. A Prime deal on Oct 7 put it at $549.99, $27.50 per TB, well under the 16TB NAS drives at $714.99, $44.69 per TB. The tradeoff: WD's warranty is at risk once a case is open, which is why both drives get the full test first.

The AI question, still settled: buy nothing
Buy nothing for AI right now. Your tower's RTX 3080 Ti 12GB already runs models on demand. Wake it over the network when you want one. The little server stays on 24/7 for Plex and scrapers, which is the job you actually have.
Why, in numbers, and what I would buy if the answer changes

September 2026 is the worst time in years to buy memory. AI datacenters are projected to take about 70% of the world's memory output, street prices are up about 89% year over year, and a card with a $1,999 list price sells for $5,000 and up. Sinking $2,000 to $4,700 into AI memory for AI you are not sure you want is the expensive mistake here.

The trap in the 128GB mini PCs: they read like they run huge models, and for one particular kind they do. Think of a library where you only ever need one shelf per question. Those boxes fetch a shelf fast. A dense model wants the whole library read for every single word, and there the memory speed puts a hard ceiling on it, roughly 6 to 7 words per second, which is slower than you can comfortably read.

OptionPriceWhat it actually does
Your RTX 3080 Ti, already owned$0Models up to about 34B on demand. Covers it
Used RTX 4090 24GB in a used tower$1,800 to 2,400If AI becomes a real yes, this is the value buy
128GB unified mini PC$1,899 to 2,299Fast on the models that load one shelf at a time, slow on the dense ones. Only if you know which you need
NVIDIA DGX Spark$3,999 to 4,699Same ceiling as above, triple the price
RTX 5090$5,000 to 5,800A 150% premium over list. No

Correction worth keeping: a lab reported 22 words per second on a dense 70B model on the DGX Spark. That is faster than its memory can physically feed the chip, so something else was going on. The honest number is 6 to 7.

The Sep 13 research, superseded by the Oct 7 order

Kept for the record. The pick then was the DXP4800 Plus. On Oct 7 the Pro won: the same box with a faster chip (Core i3-1315U instead of the Pentium Gold 8505) for about $116 more.

The Sep 13 buy list

Prices and ratings fetched Sep 13, 2026, 12:03 AM Denver from organic Amazon listings, sponsored results dropped. Amazon began blocking automated price reads on Sep 19, 2026, so treat every number here as "check it in the cart" rather than live.

ItemPriceOwner ratingWhy this one
UGREEN NASync DXP4800 Plus (diskless) $619.994.6 stars, 618 ratings, 4% one star Passes every requirement. Quick Sync, 64GB ceiling, 4 bays, fits the cabinet, and people have run Proxmox on this exact model for months
Seagate IronWolf 8TB x2 $289.99 ea4.2 stars, 315 ratings CMR, which is what you want in a mirror. Best cost per terabyte found at $36
Crucial P310 1TB NVMe $179.004.7 stars, 11 ratings Only if you wipe to Debian or Rocky. A 500GB is cheaper and plenty
Total with the mirror~$1,200 $910 if you start with one drive

Do not buy a BarraCuda 8TB for this. It is $249.99 and looks like a deal, but it is SMR and will crawl in a mirror.

Why the Plus, and what lost

UGREEN NASync DXP4800 Plus THE PICK

Pentium Gold 8505, Quick Sync with 48 execution units, 8GB in one of two DDR5 slots and a 64GB ceiling per Intel's own spec page, four 3.5 inch bays plus two M.2, about 7 x 7 x 10 inches. In stock at two sellers when this was verified.

The full ranking, and why each one lost

From a 13 agent research run on Sep 13, 2026: six sweepers, six verifiers, one critic, 349 tool calls across 77 websites. Sponsored listings, "Amazon's Choice" badges and affiliate "best of" articles were excluded as evidence on purpose.

#BoxRatingVerdict
1UGREEN DXP4800 Plus4.6 (618, 4%)BUY. Passes every gate
2UGREEN DXP2800, $369.994.5 (916, 6%)Budget alt. Its N100 chip is capped at 16GB of RAM forever, so it can never grow. Fine for Plex plus two or three scrapers
3TerraMaster F4-424 Pro4.1 (61)Too few reviews and a history of security holes in its own OS. You would wipe it immediately
4Synology DS225+ / DS423+4.5 (224)Locked to their own OS, so your Linux never goes on it
5QNAP TS-4644.4 (254)Ransomware hit their systems in 2021, 2022 and 2024
6Asustor Lockerstor 4 Gen24.3 (122)Below the rating bar, 4GB of RAM to start
7Used Lenovo Tiny + external drive boxDAS 4.2 (373)Cheapest, and your comfort zone, but it is two boxes and a USB bridge. You ruled that out
8Aoostar WTR Pro / Minisforum N5 Pro3.8 (28) / 4.6 (9)The AMD versions cannot hardware transcode Plex on Linux, the Intel version is out of stock, and the ratings are too thin to trust
9HPE MicroServer Gen10 Plus v2n/aIts server firmware switches Quick Sync off on every chip option
10Build it yourself, Jonsbo case + N100n/aHours of work, same 16GB ceiling, and owners complain about cooling
xBeelink ME Pro3.9, 16% one starYou rejected this on Sep 12, 2026, and you were right
What the reviewing agent caught and changed
  • Blocking. The cheaper DXP2800 was ranked first with an empty box next to the RAM requirement. Intel's spec page caps its N100 chip at 16GB, so it fails. Demoted to budget alternative, the 4800 Plus promoted. I reread Intel's page myself to confirm.
  • The Aoostar was scored with the AMD model's memory and the Intel model's video chip, which no single box actually has. Fixed.
  • One verifier marked dimensions and power "verified" against a vendor page that does not list them. Downgraded.
  • Note: the two retailer rule for ratings could not be met by any box on the market, since Newegg has single digit review counts. The 4.6 with 4% one star is what separates the winner.

The drive market, Sep 13, 2026

On Sep 13, shucking looked dead. Buying a cheap external drive and pulling the disk out used to beat buying a bare drive. That day a WD Elements 20TB runs $764.99, which is $38 per terabyte, worse than the NAS drives.

DrivePricePer TBNote
Seagate IronWolf 8TB CMR$289.99$36Best cost per terabyte for a real NAS drive that day
WD Red Plus 12TB$459.99$384.0 stars, 373 ratings
Seagate One Touch 16TB$509.99$32Cheapest per terabyte, but it is not built for a NAS
WD Elements 20TB external$764.99$38$549.99 on Oct 7, and that is what you bought

NAS day extras

For the day the NAS is on the network and Plex works. Ranked: your data first, then the safety rule, then moving the tower's jobs, then new features, then two leads. Tick a row when it is done. The steps stay closed until you want them. From the GitHub sweep, rechecked Sep 28, 2026, 10:22 PM Denver. What was and was not checked is in the Honesty log.

NAS app rules. Every app below follows these, so the rows point here instead of repeating them.
  • Pin an exact version. Never stable or latest, and no auto updater.
  • Update on purpose. Read the release notes first, and back up the app's config before every upgrade.
  • LAN only, the app and any share it uses.

Honesty log

What was checked and what was not, newest first.

Safety nets, sudo lend and app guards, Oct 11, 2026
  • Tested on a throwaway Debian 13 box (systemd 257) with a fake Discord and a fake Radarr and Sonarr: the alarms, the snapshot plan (sanoid 2.2.0), the Docker guard and both timers, 80 checks; 23 bugs planted on purpose, each caught by the check meant for it. The sudo lend: 57 checks and two reboots; 12 planted bugs caught.
  • Tested on the tower: the system script's dry run, 28 cases, 13 planted bugs caught; the Radarr and Sonarr guards against a fake copy of both apps, 24 checks, 12 planted bugs; the Fail Downloads keeper, 18 checks, 10 planted bugs.
  • Read in Radarr's and Sonarr's source code: each settings page saves whole, so the script sends every field back; both apps show the Discord address in plain text to anyone with the app's key, so the script never prints it; Sonarr's Import Complete posts once per download, not once per episode.
  • Plex's away from home rule, read Oct 11 in Plex's support article and its Smart TV notice (both quoted on the Plex Pass row).
  • One outside review, Oct 11: nothing blocking. Its three fixes are in: the job alarm tries again while Discord is down, both timers start only after the keeper's first run works, and the keeper gets 10 minutes a run instead of 5.
  • Not run yet: the real NAS, real drives, the real pool, the real apps and the real Discord. Build day is the real test.
Build tab and software stack, Oct 9 to 10, 2026
  • Verified from primary sources, Oct 9, 2026: every app version exists on its image registry (Sonarr's on Oct 10); Overseerr's archive date and the Seerr merge (GitHub); Plex Pass prices (the rendered plex.tv page, Oct 10; the lifetime price history from Plex's blog); the hardlink rule (TRaSH Guides, quoted); gluetun's port forwarding list (gluetun wiki); the Internet Archive search source (Prowlarr's own definitions).
  • Read in each project's source code, Oct 9 to 10: every setting Claude's setup script changes in Radarr, Sonarr 4.0.20 (added Oct 10), Prowlarr, qBittorrent, Plex, Jellyfin 12.2 and Seerr 3.5.0, including Seerr's Watchlist sync for movies and TV, and that a show on the Watchlist asks for every season.
  • Tested on the tower, without the NAS: the system script ran every step as a dry run against fake Linux tools, 17 of 17. The app setup script ran three times against a fake copy of all seven apps, the last run created nothing new, and the fake caught every bug planted in it on purpose (five so far, three of them for TV). Passwords were confirmed to travel without showing in any command.
  • Not run on the real box. Nothing has touched real hardware yet. The fakes prove the scripts' logic, not that the real apps answer the same way. Build day is the real test.
  • Inferred: the Pro's BIOS menu names (the Debian wiki tested the DXP4800, not the Pro by name); Plex's hardware conversion switch is set by hand because its setting name is undocumented; that the test movie's name parses cleanly in Radarr.
  • Verified Oct 10: Proton prices on its live checkout, the NAS key in .env (read back, never shown), and the key's Oct 10, 2027 expiry on Proton's page.
  • Inventory, checked Oct 10: each WD Elements Desktop ships with its own AC adapter and USB cable (retailer kit lists; a 3.5 inch drive needs 12 volts, which USB cannot supply); the DXP4800 Pro box holds two CAT7 network cables, the power brick, a screwdriver and two thermal pads, and the NAS has one HDMI port and four USB A ports (IT-Connect review; the Plus's box matches, per this review), with tool free, lockable trays (NASCompares). Avira's end date is your own reading of 257 days left on Oct 10.
  • Not checked: how the box sounds inside the cabinet, how long the Pro's network cables are, and whether its bays need the Kapton fix at all (no reports either way).
Sep 13 box research: verified at send time
  • DXP4800 Plus: 4.6 stars, 618 ratings, 4% one star, $619.99, in stock at Amazon and Newegg.
  • Intel's spec pages for both chips: the 8505 reaches 64GB and has Quick Sync, the N100 stops at 16GB.
  • Every buy list price and rating, read off organic listings with sponsored cards dropped.
  • The Dish Hopper's dimensions, used as the cabinet fit test.
Sep 13: verified by a research agent, not rerun by me
  • A Proxmox forum thread describing this exact model running for months.
  • The physical dimensions, the 8GB of installed memory, and the Newegg review counts.
  • That HPE's firmware blocks Quick Sync, from two independent forums.
Sep 13: not verified
  • Idle power. Sources range from 24 to 45 watts. Noise is not published at all.
  • Whether installing your own Linux keeps the hardware warranty. UGREEN said yes through a reviewer, said something different in 2024, and their warranty page is silent. Keeping UGOS on the internal storage sidesteps it.
  • The claim that UGOS phones home. Community reports only.
  • Micro Center Denver stock, and price history. Both sites block automated reads.
Sep 13: not checked at all
  • The text of the one and two star reviews. Amazon requires a login to read them.
  • Used prices on eBay, and how the fan behaves inside a sealed cabinet.
NAS day extras, checked Sep 28, 2026, 10:22 to 11:39 PM Denver
  • Verified from GitHub, Sep 28, 2026, 10:22 PM Denver: the three picks and OpenMuse exist, and the licenses match (Kopia Apache 2.0, Frigate MIT, Jellyfin GPL 2.0). Kopia v0.23.1 is the latest release and ships a signed checksums file. A critic reviewed the sweep report before this section was written.
  • Checked against the live pages, Sep 28, 2026, 10:45 to 11:11 PM Denver: every link in the section opens, and each step that cites one of these pages matches it: Docker's WSL page, Kopia's sync docs, Jellyfin's Intel guide, Frigate's detector docs and the Compose spec. The link checker opened every link on this page again at 11:39 PM Denver.
  • Checked against OpenMuse's code, Sep 28, 2026, 11:10 PM Denver, in its sandbox file. The box's limits match it. Two differences are on purpose: the template runs as nobody, not user 1000, and it mounts nothing. The OSV exception is the sweep's plan for your NAS. OpenMuse has no such robot.
  • Not verified: Beszel and NetAlertX. Their rows carry the lead tag.
  • Not tested. Nothing in the section was installed or run.
  • Claude's own extras, not sweep findings. For Kopia: its own NAS user, the restore test, upgrading on purpose and LAN only. For Frigate: its own NVR login, the version pin, the config backup, LAN only, no privileged mode and the recording cap. The video chip rule, the robot box's user 65534, digest pin and no swap line, and the NetAlertX rules are Claude's too. So are keeping the browser scrapers out of the robot box, Beszel's "or any other agent", the paper copy of the Kopia password, and the one NAS app rules list.