You have an old laptop gathering dust in a drawer. Maybe it was your work machine a few years back, maybe you bought it with good intentions and then replaced it. Either way, there’s still enough power inside it to become something far more useful: your private server.
In this series of articles we’ll teach you how to build one from scratch — with open-source tools, an architecture designed for security, and enough simplicity that you can manage it even without an advanced technical background. Before we write a single line of configuration, though, we need to understand what we’re building and why.
Why self-host in 2026
The short answer is: because your data doesn’t belong to Google, Microsoft or Dropbox.
Every time you use a free cloud service, you’re paying with something more valuable than money: your files, your emails, your passwords, your habits. Cloud service providers know when you wake up, what you search for, who you talk to and how much you spend. It’s not science fiction — it’s the business model that props up billions of dollars in advertising revenue.
Self-hosting is the practical answer to this problem. Instead of relying on a server in California that you’ve never seen and can’t control, you run your services on a computer that sits in your own home. You own the data. You’re the administrator. No third party has access, no one can read your emails, no one can sell your profile.
Sure, it takes a bit of work up front. But far less than you might think — and this series is designed precisely to walk you through it step by step.
The architecture: two zones, two levels of access
Before choosing which software to install, we need to think about architecture. A badly configured server is worse than no server at all: it exposes sensitive data to anyone who knows where to look.
Our setup is split into two clearly separated zones.
The private zone is only reachable through the VPN. This is where the services that must never be reachable from the internet live: the password manager, the Docker control panel, SSH access, the monitoring dashboards. No ports open to the internet, an attack surface that’s practically zero. If you’re not connected to the VPN, those services simply don’t exist for the outside world.
The public zone is the part the world can see. Here you can host your website, your mail server, your webmail. Traffic passes through a reverse proxy that handles HTTPS automatically — no certificates to renew by hand, no arcane configuration.
The practical rule is simple: turn on the VPN and everything works. Turn off the VPN and your password manager becomes invisible again. It’s a security model that works even if you’re an ordinary user, not a systems administrator.
The stack: what we’ll install and why
All open-source, all verifiable, all controlled by you.
WireGuard + wg-easy is our VPN. WireGuard is the most modern and secure VPN protocol available today — simple codebase, excellent cryptography, high performance. wg-easy adds a straightforward web interface and the ability to generate QR codes so you can connect your devices in thirty seconds. It’s the first thing we’ll install, because from that point on every administration task will go through the VPN.
Vaultwarden is the self-hosted password manager, 100% compatible with Bitwarden. It lives in the private zone, is never reachable without the VPN, and lets you stop trusting LastPass or 1Password. If you don’t know where to keep your passwords, the answer is right here.
Nginx Proxy Manager is our reverse proxy for the public zone. It has a graphical interface, handles HTTPS certificates automatically via Let’s Encrypt, and lets you expose services to the internet with the right security configuration — without touching config files by hand.
Mailcow is the complete mail server. It’s the most delicate part of the whole setup (let’s be clear: self-hosted email requires care), but Mailcow is the most solid choice if you want something you can administer without losing your mind. It includes a web interface, multi-domain management, antispam and everything you need to correctly configure SPF, DKIM and DMARC.
The installation order matters
Get the order wrong and you’ll make life harder for yourself. This is the path we’ll follow throughout the series:
- WireGuard — first of all. From this moment on, server administration goes through the VPN.
- Vaultwarden — right after. Immediate value, immediate security, and the satisfaction of seeing your first service up and running.
- Nginx Proxy Manager — the gateway to the internet. DNS, HTTPS, websites.
- Mailcow — once the foundation is solid. Mail, SPF/DKIM/DMARC, backups.
In the upcoming instalments we’ll tackle each step in detail: from installing Ubuntu Server on the laptop to configuring DNS, from the first Docker commands to managing SSL certificates.
Conclusion
An old laptop, an internet connection and a few hours of work: that’s all it takes to stop entrusting your data to someone else. This isn’t a project for experts — it’s a path designed for anyone who wants to take back control, one step at a time. In the next article we start from the beginning: choosing the right hardware and installing Ubuntu Server. Welcome to self-hosting.
Further reading and tools mentioned: