Raspberry Pi 4/5 setup for a minimalist personal local cloud

I don't like GAFAM's way of eating my personal data. So I decided to self-host my personal cloud to protect my privacy and have full powers on my data instead of Google.

Warning: picfg is a reduced version of rrpi that just provides file synchronization with Syncthing instead of Nextcloud.

This page describes a basic Raspberry Pi installation:

• Hardware setup: personal data center based on a Raspberry Pi 4 or 5 and an SSD
• Software setup: configurable and semi-automated setup script from a regular Linux PC
  • preparation and installation of a RaspiOS image
  • configuration of the OS
  • remote access configuration (ssh)
  • basic software installation and network configuration (shell, git, tmux, syncthing, forgejo...)
  • UPnp media server

All being run on a small pretty Raspberry Pi ;-)

Hardware setup

The server will run 24/7 so running on a regular desktop PC is no good idea. We are going to install it on a Rapsberry Pi connected to the local network.

For this you will need:

• a Raspberry Pi (ideally a Raspberry Pi 4 or 5 with at least 4 Gb or RAM)
• an external USB HD or SSD to avoid SD card issues
• a Raspberry Pi power supply
• an Ethernet cable if you don't want to use the Raspberry Pi WiFi connection.

Just plug everything and let's continue with the software setup.

Software setup

The software setup is completely made from a Linux PC connected to the same local network than the Raspberry Pi (Ethernet or WiFi).

The whole installation is scripted. My script is available here: picfg.

picfg connects to the Raspberry Pi with ssh. The Raspberry Pi hostname shall be given on the command line. The default host name is raspberrypi.local. The script shows a menu for a step-by-step installation.

WARNING: This script is provided for free and with no guaranty. Please read it before using it. It may fail and you may have to fix issues that are not described here.

picfg expects an optional argument to define the Raspberry Pi host and user names. The default hostname is raspberrypi.local and the default username is pi.

• picfg HOST: HOST is the new hostname.
• picfg USER@HOST: HOST is the new hostname and USER the new user name.

Installation of RaspiIO on the external SSD.

RaspiOS image download and configuration

1. Run picfg and select Prepare.
2. Wait for RaspiOS being downloaded (it is saved to ~/raspios).
3. An admin password may be asked to mount and configure the image.
4. Enter your WiFi SSID (leave it empty if you want to connect the Raspberry Pi to an Ethernet network).
   1. Enter your WiFi password.
   2. Enter your WiFi country (a two-letter country code).

Installation to the external SSD

1. Run picfg and select Flash.
2. Plug the SSD to the Linux PC (picfg should auto-detect it).
3. Check the partition has been correctly detected and confirm (be sure the detected partition is actually the SSD or you may overwrite important data).
4. Wait for the image to be completely written to the SSD.
5. Unplug the SSD from the Linux PC and plug it to the Raspberry Pi.

First configuration of RaspiOS

We will start by configuring the Raspberry Pi with raspi-config.

1. Run picfg and select Configure
2. In the Raspberry Pi Configuration Tool some parameters can be changed:
   1. System Options / Password: change the pi user password and choose a strong password.
   2. System Options / Hostname: choose a different hostname (this hostname will be a parameter of picfg in the next steps, e.g. mypi).
   3. Interface Options / SSH: Enable SSH.
   4. Localisation Options / Locale.
   5. Localisation Options / Timezone.
   6. Advanced Options / Network Interface Names: Enable predictable network i/f names.

SSH configuration

To connect with SSH keys instead of password, you need to push your keys to the Raspberry Pi.

1. Run ssh-keygen to create your SSH keys if you don't have one.
2. Run picfg and select Keys to push your public key to the Raspberry Pi.
3. Select Ssh to try your SSH configuration. You should now be connected to the Raspberry Pi.
4. Run sudo reboot to reboot with the new configuration (hostname, ...).

From now on you shall start picfg with the right hostname (e.g. picfg mypi.local).

Installation/configuration of some basic packages

The following steps use a configuration files that must be created on the Linux PC used to configure the Raspberry Pi:

• ~/conf.toml

This file is a Lua script that defines the following parameters:

[picfg]
caddy = [
    { server = "public host name", root = "path to the local files" },
    ...
]

CDSoft programs

picfg will install some CDSoft programs precompiled for Raspberry Pi:

• LuaX
• bang
• calculadoira
• lsvg
• panda
• tagref
• ypp

and also some great tools:

• pandoc
• typst
• PlantUML
• ditaa

Configuration

1. Run picfg mypi.local and select Install.

   This will install some Debian packages:

   • fd-find
   • mc
   • neofetch
   • neovim
   • ripgrep
   • sshfs
   • tmux
   • syncthing
   • ...

   and configure:

   • the shell (aliases, ...)
   • tmux
   • status

Forgejo

Forgejo can be used to host and manage Git repositories on the Raspberry Pi.

1. Run picfg mypi.local and select Forgejo.

Caddy web server

The Caddy web server can be used to host an HTTPS server on the Raspberry Pi.

1. Run picfg mypi.local and select Caddy.

UPnP

The Debian packet minidlna can be used to store and shared media files (music, video, ...). Shared files will be stored in /home/pi/dlna.

1. Run picfg mypi.local and select UPnP.

Git server

GitHub and GitLab are great but if you need private repositories, you may want better privacy and control over your data.

And Git can be installed locally on a Raspberry Pi.

Git installation

The procedure described here is a summary of Build your own Raspberry Pi Git Server.

1. Connect to the Raspberry Pi

   ssh pi@pi

2. Ensure git is installed

   sudo apt update
   sudo apt upgrade
   sudo apt install git

Create a repository on the Raspberry Pi

1. Create a directory

   mkdir -p /home/pi/git/hello
   cd /home/pi/git/hello

2. Initialize the Git repository

   git init --bare

Create the repository on your PC

1. Create the repository

   git init
   git remote add hello pi@git.example.com:/home/pi/git/hello

2. Push the first commit

   git add .
   git commit -m "Initial commit"
   git push hello master

3. Clone the repository on another PC

   git clone pi@git.example.com:/home/pi/git/hello

Example: Home Network Architecture

Overview

This document describes a home network that supports local web development and self-hosting, Git collaboration, and markdown-based note editing and sharing.

Network Topology

Devices and Roles

Internet

• External access point.
• Port 80 forwarded to Raspberry Pi 2 via the ISP Box for web hosting.
• Syncthing peer discovery and relay connections occur via Internet.

ISP Box

• Connects the home network to the Internet.
• Port 80 forwarded to Raspberry Pi 2 via the local router.

Local Router

• Internal LAN: 192.168.1.0/24.
• Distributes Ethernet and Wi-Fi connections.
• Port 80 forwarded to Raspberry Pi 2.

Device Descriptions

Desktop PC (Workstation)

• Connected via Ethernet.
• Roles:
  • Edits website files and markdown notes with Neovim.
  • Syncs notes and website content via Syncthing with Raspberry Pi 1 and 2.

Laptop

• Connects via Wi-Fi.
• Roles:
  • Markdown editing via Neovim.
  • Syncthing connection to Raspberry Pi 1.

Smartphone

• Connected via 4G/5G (mobile data) or Wi-Fi.
• Runs:
  • Syncthing to sync notes via Internet with Raspberry Pi 1.
  • Markor: mobile Markdown editor.

Raspberry Pi 1 (Local Server)

• Ethernet connected.
• Runs:
  • Syncthing: central sync node for notes and files.
  • Forgejo: Git server.
  • Hosts markdown notes directory synced with all devices.

Raspberry Pi 2 (Web Server)

• Ethernet connected.
• Runs:
  • lighttpd: serves static website.
  • Receives updated HTML via Syncthing from Desktop.
• Port 80 exposed to Internet.

File Synchronization (Files, textual notes, self-hosted website...)

Port Forwarding

• Port 80:
  • Internet → ISP Box → Local Router → Raspberry Pi 2 (192.168.100.5).

Security Notes

• Forgejo and Syncthing (except port-relay usage) are restricted to local access.
• Syncthing uses TLS by default for peer-to-peer transfers, even over Internet.
• Notes can be encrypted at rest if needed using external tools.

WORK IN PROGRESS...

This script is constantly updated and the documentation may be outdated. The best is always to read the sources and change them to fit your requirements.