Home Media Server Setup Guide

My personal rebuild guide for my home media server and homelab. It covers a Synology NAS running the *arr media stack, Plex and backups, plus a Raspberry Pi running Home Assistant, a Glance dashboard and the Cloudflare Tunnel. If I ever lose everything (a dead NAS, a dead SD card, a house fire), I can follow this to rebuild my exact setup from scratch. The format borrows from TRaSH Guides.

Placeholders, not real values

Every IP, hostname, domain, key and password here is a placeholder (see Conventions). The real secrets are in my password manager and in root-only 600 files on the devices, never in this repo. Security-sensitive specifics (exact schedules, thresholds, exposure, versions) are kept out of this public guide; where a page says see private runbook, the real value is in my private ops runbook on the NAS.

Rebuild order (the short version)

1. Buy or reuse the hardware, and sign up for the accounts.
2. NAS base setup: DSM, shares, the /volume1/data hardlink layout, users/PUID, Container Manager, Portainer.
3. Restore first, configure second. If a restic backup exists, restore /volume1/docker before you deploy any stack. Every app then comes back with its settings.
4. Deploy the NAS stacks in this order: gluetun + qBittorrent → Prowlarr + FlareSolverr → Sonarr/Radarr → Bazarr → Plex → Seerr → Tautulli → restic → Mosquitto.
5. Raspberry Pi: Raspberry Pi OS, Docker, Portainer, Home Assistant, cloudflared, Tailscale, Glance.
6. Networking & remote access: Cloudflare Tunnel + Access, Tailscale, the Plex port forward, the DSM firewall.
7. Backups & snapshots and monitoring. Do this last, but do it.

Conventions

Placeholder	Meaning	Example
<NAS_IP> / ${NAS_IP}	NAS LAN address (DHCP reservation)	192.168.1.10
<PI_IP> / ${PI_IP}	Pi LAN address (DHCP reservation)	192.168.1.20
${LAN_SUBNET}	Home LAN	192.168.1.0/24
example.com	Your Cloudflare domain	sonarr.example.com
${PUID} / ${PGID}	Media user ID / users group	<uid> / 100
${PLEX_PUID}	Separate Plex user ID	<uid>
${TZ}	Time zone	America/<Your_City>
${...} in caps	Secret: set it in Portainer stack env or a root-600 .env	${WG_PRIVATE_KEY}

Compose files are kept in the compose/ folder of this repo and pulled into the pages, so each one lives in one place.