Raspberry Pi Home Server: NAS, Pi-hole, VPN & Media Server

1. Pengenalan Raspberry Pi Home Server

Raspberry Pi Home Server adalah setup di mana Raspberry Pi digunakan sebagai server pribadi di rumah untuk berbagai layanan: penyimpanan file (NAS), pemblokir iklan (Pi-hole), VPN pribadi, media streaming, dan banyak lagi. Dengan daya listrik yang sangat rendah (~5-10W), Raspberry Pi bisa berjalan 24/7 tanpa tagihan listrik yang besar.

Menggunakan Raspberry Pi sebagai home server adalah langkah pertama menuju self-hosting — mengendalikan data dan layanan Anda sendiri tanpa bergantung pada layanan cloud berbayar. Anda belajar Linux system administration, networking, dan DevOps secara praktis.

Layanan yang Akan Dibangun

Keuntungan Self-Hosting

2. Persiapan Hardware

Daftar Komponen

Setup Awal Raspberry Pi

# ============================================
# Setup Raspberry Pi OS untuk Home Server
# Gunakan Raspberry Pi OS Lite (64-bit, headless)
# ============================================

# 1. Flash OS menggunakan Raspberry Pi Imager
#    Pilih: Raspberry Pi OS Lite (64-bit)
#    Advanced options: set hostname, enable SSH, set user

# 2. Boot dan SSH masuk
ssh pi@raspberrypi.local

# 3. Update sistem
sudo apt update && sudo apt upgrade -y

# 4. Set static IP (edit /etc/dhcpcd.conf)
sudo tee -a /etc/dhcpcd.conf <<'EOF'
interface eth0
static ip_address=192.168.1.10/24
static routers=192.168.1.1
static domain_name_servers=1.1.1.1 8.8.8.8
EOF
sudo systemctl restart dhcpcd

# 5. Mount SSD external
# Cek nama device SSD
lsblk
# Misal: /dev/sda

# Format SSD (sekali saja!)
sudo mkfs.ext4 /dev/sda1

# Buat mount point
sudo mkdir -p /mnt/storage

# Mount SSD
sudo mount /dev/sda1 /mnt/storage

# Set permission
sudo chown -R pi:pi /mnt/storage

# Auto-mount saat boot (tambahkan ke /etc/fstab)
echo '/dev/sda1 /mnt/storage ext4 defaults,noatime 0 2' | sudo tee -a /etc/fstab

# 6. Install utilitas dasar
sudo apt install -y htop curl wget git tmux \
  net-tools unattended-upgrades

# 7. Enable automatic security updates
sudo dpkg-reconfigure -plow unattended-upgrades

# 8. Konfigurasi firewall dasar
sudo apt install ufw -y
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow from 192.168.1.0/24
sudo ufw enable
sudo ufw status

3. Docker & Docker Compose

Docker adalah platform containerization yang memungkinkan kita menjalankan aplikasi dalam container yang terisolasi. Docker Compose memudahkan deploy beberapa layanan sekaligus dengan satu file konfigurasi.

# ============================================
# Install Docker dan Docker Compose
# ============================================

# Install Docker
curl -fsSL https://get.docker.com | sh

# Tambahkan user pi ke grup docker
sudo usermod -aG docker pi

# Aktifkan Docker
sudo systemctl enable docker
sudo systemctl start docker

# Verifikasi
docker --version
docker compose version

# Install Portainer (Docker management UI)
docker volume create portainer_data

docker run -d \
  --name portainer \
  --restart=always \
  -p 9000:9000 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v portainer_data:/data \
  portainer/portainer-ce:latest

# Akses Portainer: http://192.168.1.10:9000

# ============================================
# Docker Compose untuk semua layanan
# ============================================

# Buat direktori untuk konfigurasi
mkdir -p ~/home-server
cd ~/home-server

# Buat file docker-compose.yml
cat <<'EOF' > docker-compose.yml
version: '3.8'

services:
  # ===== Pi-hole DNS Ad Blocker =====
  pihole:
    image: pihole/pihole:latest
    container_name: pihole
    restart: unless-stopped
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "8053:80/tcp"
    environment:
      TZ: 'Asia/Jakarta'
      WEBPASSWORD: 'ubah-password-ini'
      DNSMASQ_LISTENING: 'all'
    volumes:
      - ./pihole/etc-pihole:/etc/pihole
      - ./pihole/etc-dnsmasq.d:/etc/dnsmasq.d
    cap_add:
      - NET_ADMIN
    networks:
      - server-net

  # ===== WireGuard VPN =====
  wireguard:
    image: linuxserver/wireguard:latest
    container_name: wireguard
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    environment:
      TZ: 'Asia/Jakarta'
      SERVERURL: 'auto'
      SERVERPORT: '51820'
      PEERS: '3'
      PEERDNS: 'auto'
    volumes:
      - ./wireguard/config:/config
      - /lib/modules:/lib/modules
    ports:
      - "51820:51820/udp"
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
    networks:
      - server-net

  # ===== Jellyfin Media Server =====
  jellyfin:
    image: jellyfin/jellyfin:latest
    container_name: jellyfin
    restart: unless-stopped
    ports:
      - "8096:8096"
    environment:
      TZ: 'Asia/Jakarta'
    volumes:
      - ./jellyfin/config:/config
      - ./jellyfin/cache:/cache
      - /mnt/storage/media:/media:ro
    networks:
      - server-net

  # ===== Uptime Kuma (Monitoring) =====
  uptime-kuma:
    image: louislam/uptime-kuma:latest
    container_name: uptime-kuma
    restart: unless-stopped
    ports:
      - "3001:3001"
    volumes:
      - ./uptime-kuma/data:/app/data
    networks:
      - server-net

networks:
  server-net:
    driver: bridge
EOF

# Jalankan semua layanan
docker compose up -d

# Cek status
docker compose ps
docker compose logs -f

4. NAS dengan Samba

Network Attached Storage (NAS) memungkinkan Anda berbagi file ke semua perangkat di jaringan rumah (PC, laptop, smart TV, HP). Samba menggunakan protokol SMB/CIFS yang didukung oleh Windows, macOS, Linux, Android, dan iOS.

# ============================================
# Setup Samba NAS
# ============================================

# 1. Install Samba
sudo apt install samba samba-common-bin -y

# 2. Backup konfigurasi default
sudo cp /etc/samba/smb.conf /etc/samba/smb.conf.bak

# 3. Konfigurasi Samba
sudo tee /etc/samba/smb.conf <<'EOF'
[global]
   workgroup = HOMENET
   server string = Raspberry Pi NAS
   security = user
   map to guest = never
   dns proxy = no
   interfaces = eth0
   bind interfaces only = yes

   # Optimasi performa
   socket options = TCP_NODELAY IPTOS_LOWDELAY
   read raw = yes
   write raw = yes
   max xmit = 65535
   dead time = 15
   getwd cache = yes

[shared]
   comment = Shared Storage
   path = /mnt/storage/shared
   browseable = yes
   read only = no
   create mask = 0664
   directory mask = 0775
   valid users = @nasusers

[media]
   comment = Media Files
   path = /mnt/storage/media
   browseable = yes
   read only = no
   create mask = 0664
   directory mask = 0775
   valid users = @nasusers

[backup]
   comment = Backup Folder
   path = /mnt/storage/backup
   browseable = yes
   read only = no
   create mask = 0664
   directory mask = 0775
   valid users = @nasusers
EOF

# 4. Buat direktori
sudo mkdir -p /mnt/storage/{shared,media,backup}
sudo chown -R pi:pi /mnt/storage

# 5. Buat user Samba
sudo groupadd nasusers
sudo usermod -aG nasusers pi
sudo smbpasswd -a pi
# Masukkan password untuk akses Samba

# 6. Restart Samba
sudo systemctl restart smbd nmbd
sudo systemctl enable smbd nmbd

# 7. Test dari Windows:
#    Buka File Explorer → ketik: \192.168.1.10shared
#    Atau map network drive

# 8. Test dari Linux/Mac:
#    smbclient //192.168.1.10/shared -U pi

# 9. Mount otomatis di Windows:
#    File Explorer → This PC → Map Network Drive
#    Drive: Z:
#    Folder: 192.168.1.10shared
#    Centang "Reconnect at sign-in"

# 10. Mount otomatis di Linux:
#     Tambahkan ke /etc/fstab:
# //192.168.1.10/shared /mnt/nas cifs credentials=/home/pi/.smbcreds,uid=1000,gid=1000 0 0

# File ~/.smbcreds:
# username=pi
# password=your-samba-password

5. Pi-hole DNS Ad Blocker

Pi-hole adalah DNS sinkhole yang berfungsi sebagai ad blocker untuk seluruh jaringan. Cukup set Pi-hole sebagai DNS server di router, dan semua perangkat di rumah (termasuk smart TV dan HP) akan terbebas dari iklan tanpa perlu install aplikasi apapun.

Cara Kerja Pi-hole

PI-HOLE: How It Works
═════════════════════

  Perangkat (HP/Laptop/TV)        Internet
         │                            │
         │ 1. DNS request:             │
         │ "ads.google.com"            │
         │                             │
         ▼                             │
  ┌──────────────┐                     │
  │   Pi-hole    │ 2. Cek blocklist    │
  │   (DNS)      │                     │
  │              │                     │
  │ Blocked?     │                     │
  │ ┌───┐        │                     │
  │ │YES│→ Return │                     │
  │ │   │  0.0.0.0│ ← Iklan diblokir!  │
  │ └───┘        │                     │
  │ ┌───┐        │                     │
  │ │ NO│→ Forward│────────────────────→│ 3. Forward
  │ │   │  request│                     │    ke upstream
  │ └───┘        │←────────────────────│ 4. Balas IP
  └──────────────│                     │
         │                             │
         │ 5. Return IP (legit)        │
         ▼                             │
     Perangkat menerima website        │
     tanpa iklan! 🎉                  │

  Statistik: Biasanya 20-40% traffic
  adalah iklan/tracker → dihemat!

# ============================================
# Konfigurasi Pi-hole (setelah Docker deploy)
# ============================================

# 1. Akses Pi-hole web interface
#    Buka: http://192.168.1.10:8053/admin
#    Login dengan password yang di-set di docker-compose

# 2. Tambahkan blocklist tambahan
#    Settings → DNS → Upstream DNS Servers
#    Pilih: Custom
#    Tambahkan:
#    - 1.1.1.1 (Cloudflare)
#    - 8.8.8.8 (Google)
#    - 9.9.9.9 (Quad9)

# 3. Tambahkan adlist (blocklist tambahan)
#    Adlists → paste URL berikut:
# https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
# https://raw.githubusercontent.com/AdAway/adaway.android/master/hosts.txt
# https://www.github.developerdan.com/hosts/lists/ads-and-tracking-extended.txt
#    Klik "Add" lalu "Update Gravity"

# 4. Set Pi-hole sebagai DNS di Router
#    Login ke router (biasanya 192.168.1.1)
#    Network Settings → DHCP → DNS Server
#    Set Primary DNS: 192.168.1.10 (IP Pi-hole)
#    Set Secondary DNS: 1.1.1.1 (fallback)

# 5. Atau set manual per perangkat:
#    Windows: Settings → Network → DNS → 192.168.1.10
#    Android: WiFi → Advanced → DNS → 192.168.1.10
#    iPhone: WiFi → Configure DNS → Manual → 192.168.1.10

# 6. Whitelist domain yang salah terblokir
#    Pi-hole Admin → Whitelist
#    Tambahkan domain yang dibutuhkan:
#    - play.google.com
#    - android.clients.google.com
#    - connectivitycheck.gstatic.com

# 7. Statistik via CLI
docker exec pihole pihole -c    # Summary
docker exec pihole pihole -q    # Query log

6. WireGuard VPN Server

WireGuard adalah VPN modern yang sangat cepat dan ringan. Dengan WireGuard di Raspberry Pi, Anda bisa mengakses jaringan rumah (NAS, Pi-hole, CCTV) dari mana saja di internet secara aman.

Cara Kerja VPN

WIREGUARD VPN: Remote Access
═══════════════════════════

  Di Kafe/WiFi Publik               Di Rumah
  ┌──────────┐                     ┌──────────────┐
  │  Laptop  │    Encrypted        │ RPi +        │
  │  + WG    │═══tunnel═══════════│ WireGuard    │
  │  Client  │    (UDP 51820)      │ Server       │
  └──────────┘                     └──────┬───────┘
       │                                  │
       │  Akses seolah di rumah:          │ LAN 192.168.1.x
       │  • NAS files (192.168.1.10)      │
       │  • Pi-hole DNS                   │
       │  • CCTV cameras                  │
       │  • Printer                       │
       │                                  │
       │  IP publik:                      │
       │  10.66.66.1 ←→ 10.66.66.2      │
       │  (tunnel addresses)              │

  Keuntungan WireGuard:
  • Sangat cepat (kernel-level encryption)
  • Konfigurasi sederhana (public/private key)
  • Battery-friendly di mobile
  • Codebase kecil (~4000 lines vs OpenVPN 100K+)

# ============================================
# Konfigurasi WireGuard VPN
# ============================================

# 1. WireGuard sudah di-deploy via Docker Compose
#    Cek peers yang sudah dibuat:
docker exec wireguard wg

# 2. Ambil konfigurasi client
#    File ada di ./wireguard/config/peer1/peer1.conf
cat ./wireguard/config/peer1/peer1.conf

# Contoh output:
# [Interface]
# Address = 10.66.66.2/32
# PrivateKey = 
# DNS = 10.66.66.1
#
# [Peer]
# PublicKey = 
# Endpoint = your-public-ip:51820
# AllowedIPs = 0.0.0.0/0

# 3. Dapatkan IP publik rumah
curl ifconfig.me
# Contoh: 103.xxx.xxx.xxx

# 4. Setup port forwarding di router:
#    External Port: 51820/UDP
#    Internal IP: 192.168.1.10
#    Internal Port: 51820/UDP

# 5. Install WireGuard client:
#    - Windows: https://www.wireguard.com/install/
#    - Android: WireGuard dari Play Store
#    - iPhone: WireGuard dari App Store
#    - Linux: sudo apt install wireguard

# 6. Import konfigurasi ke client:
#    - Scan QR code (ada di docker logs)
docker logs wireguard 2>&1 | grep -A 20 "QR"
#    - Atau import file .conf langsung

# 7. Dynamic DNS (jika IP publik berubah)
#    Gunakan No-IP atau DuckDNS:
#    Daftar di https://www.duckdns.org
#    Buat cron job update IP:
crontab -e
# Tambahkan:
*/5 * * * * curl -s "https://www.duckdns.org/update?domains=MYDOMAIN&token=MYTOKEN&ip=" > /dev/null

# 8. Test VPN:
#    Aktifkan VPN di client
#    Buka: http://192.168.1.10:8053 (Pi-hole)
#    Harus bisa diakses dari luar!

7. Media Server (Jellyfin)

Jellyfin adalah media server open source (alternatif Plex/Emby) yang memungkinkan streaming film, musik, dan foto dari Raspberry Pi ke semua perangkat: smart TV, HP, tablet, laptop. Jellyfin 100% gratis tanpa fitur terkunci.

# ============================================
# Konfigurasi Jellyfin Media Server
# ============================================

# 1. Jellyfin sudah di-deploy via Docker Compose
#    Akses: http://192.168.1.10:8096

# 2. Setup wizard:
#    - Bahasa: Indonesia
#    - Buat akun admin
#    - Tambahkan media library:
#      Movies: /media/movies
#      TV Shows: /media/tvshows
#      Music: /media/music
#      Photos: /media/photos

# 3. Struktur folder media yang benar:
# /mnt/storage/media/
# ├── movies/
# │   ├── Movie Name (2024)/
# │   │   └── Movie Name (2024).mkv
# │   └── Another Movie (2023)/
# │       └── Another Movie (2023).mp4
# ├── tvshows/
# │   ├── Show Name/
# │   │   ├── Season 01/
# │   │   │   ├── S01E01.mkv
# │   │   │   └── S01E02.mkv
# │   │   └── Season 02/
# │   └── Another Show/
# ├── music/
# │   ├── Artist/
# │   │   ├── Album/
# │   │   │   └── track.mp3
# └── photos/
#     ├── 2024/
#     └── vacation/

# 4. Install client apps:
#    - Smart TV: Cari "Jellyfin" di app store
#    - Android: Jellyfin dari Play Store
#    - iPhone: Jellyfin dari App Store
#    - Browser: langsung buka http://192.168.1.10:8096
#    - Desktop: Jellyfin Media Player

# 5. Hardware transcoding (opsional, untuk performa):
#    Raspberry Pi 4 mendukung hardware decoding H.264
#    Tambahkan di docker-compose.yml untuk jellyfin:
#    devices:
#      - /dev/video10:/dev/video10  # H264 decoder
#      - /dev/video11:/dev/video11  # H264 encoder
#      - /dev/video12:/dev/video12  # ISP

# 6. Download media dengan yt-dlp (opsional):
sudo apt install yt-dlp -y
yt-dlp -o "/mnt/storage/media/movies/%(title)s.%(ext)s" \
  "URL_VIDEO"

# 7. Remote access via VPN:
#    Setelah WireGuard aktif, akses Jellyfin dari mana saja
#    via http://192.168.1.10:8096

8. Self-Hosted Services Lainnya

Selain layanan utama di atas, berikut beberapa layanan self-hosted bermanfaat lain yang bisa dijalankan di Raspberry Pi:

Tambahan ke Docker Compose

# ============================================
# Tambahkan ke docker-compose.yml
# ============================================

  # ===== Nextcloud (Cloud Storage Pribadi) =====
  nextcloud:
    image: nextcloud:latest
    container_name: nextcloud
    restart: unless-stopped
    ports:
      - "8080:80"
    environment:
      TZ: 'Asia/Jakarta'
      MYSQL_HOST: nextcloud-db
      MYSQL_DATABASE: nextcloud
      MYSQL_USER: nextcloud
      MYSQL_PASSWORD: 'securepassword'
    volumes:
      - ./nextcloud/html:/var/www/html
      - /mnt/storage/nextcloud-data:/var/www/html/data
    networks:
      - server-net

  nextcloud-db:
    image: mariadb:10
    container_name: nextcloud-db
    restart: unless-stopped
    environment:
      MYSQL_ROOT_PASSWORD: 'rootpassword'
      MYSQL_DATABASE: nextcloud
      MYSQL_USER: nextcloud
      MYSQL_PASSWORD: 'securepassword'
    volumes:
      - ./nextcloud/db:/var/lib/mysql
    networks:
      - server-net

  # ===== Home Assistant (Smart Home) =====
  homeassistant:
    image: ghcr.io/home-assistant/home-assistant:stable
    container_name: homeassistant
    restart: unless-stopped
    network_mode: host
    environment:
      TZ: 'Asia/Jakarta'
    volumes:
      - ./homeassistant:/config
    privileged: true

Layanan Lain yang Direkomendasikan

9. Keamanan & Maintenance

Checklist Keamanan

# ============================================
# Setup Fail2ban
# ============================================

sudo apt install fail2ban -y

# Konfigurasi
sudo tee /etc/fail2ban/jail.local <<'EOF'
[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600
findtime = 600
EOF

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

# Cek banned IP
sudo fail2ban-client status sshd

# ============================================
# Backup Script Otomatis
# ============================================

cat <<'EOF' > ~/backup.sh
#!/bin/bash
BACKUP_DIR="/mnt/storage/backup/home-server"
DATE=$(date +%Y%m%d_%H%M%S)

mkdir -p $BACKUP_DIR/$DATE

# Backup Docker configs
cp -r ~/home-server $BACKUP_DIR/$DATE/

# Backup Pi-hole custom lists
cp -r ~/home-server/pihole $BACKUP_DIR/$DATE/

# Backup WireGuard configs
cp -r ~/home-server/wireguard $BACKUP_DIR/$DATE/

# Hapus backup lama (>30 hari)
find $BACKUP_DIR -maxdepth 1 -mtime +30 -exec rm -rf {} \;

echo "Backup completed: $DATE"
EOF

chmod +x ~/backup.sh

# Jadwalkan backup setiap hari jam 3 pagi
(crontab -l 2>/dev/null; echo "0 3 * * * ~/backup.sh >> /var/log/backup.log 2>&1") | crontab -

10. Quiz: Uji Pemahamanmu!

Setelah membaca tutorial di atas, jawablah 5 pertanyaan berikut untuk menguji pemahamanmu tentang Raspberry Pi Home Server: