Brandon's Blog

It’s been over a year and a half since I posted about my unRAID server and in that post I talked about rebuilding my aging Windows-based media server. Since then, my mind has been expanded by the ease at which I can spin up containerized self-hosted open-source services to use wherever and whenever I please.

I continue experimenting with this unRAID server and used it as a kicking off point, diving into some projects to increase my skills for both my personal and professional life. This includes planning and building out a proper backup system, as well as dipping my toes into virtualization with XCP-NG, but I’ll save that for a future post.

The unRAID Server, continued #

The following is not an exhaustive list of things I’m self-hosting/serving to my internal network, and is more of a continuation of my last post. Since I wrote it, I have added the following containers and services to my infrastructure:

• Cloudflareddns for Dynamic DNS. I stopped using a custom script I wrote that was running on my Raspberry Pi 4 for DDNS which used DuckDNS and manually updated a record in my previous DNS host through their “API”. This was incredibly janky and I knew I wanted to switch over to something a bit more reliable. I now host my DNS in Cloudflare so this made for an easy transition using well-supported tooling readily available.
• Immich for my moderately sized photo collection I’ve amassed over my life.
  • iCloud photo archiving runs to backup my spouse’s rather large iCloud photo library which is read into Immich as an external library. We can easily share our photo libraries with each other without involving Apple and iCloud. Even though Immich is not publicly accessible, we can share photos with friends who are not on iOS or using iCloud by passing the sharing URL through immich-public-proxy into a Cloudflare Tunnel out to the internet without having to expose the whole Immich service (which can be a can of worms and is not recommended).
• Syncthing to replace my Sync.com cloud file-sharing/syncing subscription that I barely used and was paying for yearly.
• Radicale to remove my reliance on Google Contacts and Calendar, and take back control of my contacts/calendar experience. I use macOS/iOS Calendar app with it and it works great!
• Linkding for bookmark storage and to stop using Chrome’s built-in bookmark manager when I switched to using Safari almost exclusively.
• Kometa for syncing Plex playlists from sources like Trakt.tv. This one was a game changer for me because I can now offload the mental effort required to continually update some playlists when new shows/movies come out in a series or franchise.
• Tdarr for distributed transcoding. I primarily use this for adding 2ch audio to video files that only have 5-7.1ch audio streams.
• Lidarr, Soularr, Soulseek, and Navidrome to replace my reliance on Spotify. Though the iOS app ecosystem for Navidrome is less than appealing, I still use Spotify quite a bit when I’m driving around.
• Pinepods for podcast listening and archiving some of my favourite shows. As much as I love and have paid for Overcast over the years, I just don’t use it enough any more to warrant paying for it. This is primarily because I no-longer commute for work and only listen to a small handful of podcasts.
• Audiobookshelf to host my small collection of eBooks I’ve collected.
• Kavita for electronic comic book reading.
• Kapowarr for building my digital comic collection
• db-backup because I run several databases for my containers and this makes backups for them a breeze.
• Grafana for dashboards and metrics visualization.
  • Prometheus and several Prometheus exporters for some of the apps mentioned previously.
• Backblaze Personal Backup for backing up irreplaceable data, and I pay a yearly license for this.

For all of the above to work I rely heavily on my Wireguard VPN server, which is baked into the Unifi Network application on my UDM-Pro, for external network access. This means every allowed device that can access the services above either has to be physically attached to my network behind the firewall, or be a provisioned client of the Wireguard VPN using an external connection. This grants me a very limited attack surface area externally and prevents the plethora of bad things that could happen if these services were exposed to the internet while still being able to use them anywhere I have access to the internet; it feels quite magical once it is setup and I am grateful for that.

Backup unRAID Server #

I built a backup unRAID server in June 2025 using the remains of the original Windows-based media server that started this whole saga into unRAID. I repurposed some harddrives (10/8/6TB drives respectively) that were pulled out of the main unRAID server when they were all upgraded to 20TB drives across the backplane (as an aside, 80TB of usable space in such a small form factor is wild let me tell you). This backup machine is primarily for backing up important data along with storing backups of the apps, their configuration, and the server USB flash data from the original unRAID server.

The backup process is done using a UserScripts script to trigger a bunch of rsync commands to an NFS share on the backup server whenever it is detected as being online on the network. The script then shuts down the server to be started by using a Kasa smart plug at a later time.

At the time of writing I’m still testing out this setup before I decide to install it at a family members house as an offsite backup system that’ll be connected to my Wireguard VPN as if it was a local machine.