Guide
Recipes designed to stay on the local network: what they give up by not being published, and why that is usually the safer trade.
Not publishing a service is not a compromise. It removes the certificate, the domain, the reverse proxy, the brute-force attempts on the login form and most of what a recipe would otherwise have to defend against. When the people who use a service are all inside one home, the network boundary does the work that authentication would have to do alone on a public address.
The practical version of “private” is a VPN back into the house rather than a port forwarded on the router. WireGuard on the router or on the server gives every phone the same view of the network it has at home, and the services on this page stop needing to know that anything changed. A forwarded port, by contrast, turns each application into something that has to survive the open internet on its own.
Where this stops being enough is sharing with people outside the household: a link a relative can open, a status page for someone else. That is the moment to read the VPS installation level on the application’s page, which lists precisely what the recipe still needs — a domain, HTTPS through a reverse proxy and a backup that leaves the server.
Sets
The sum of the minimums the recipes below declare. It is a floor, not a recommendation: leave room for the operating system, backups and growth.
Why it is here: A resolver is the clearest case of all: it exists to answer devices on your own network, and a DNS server reachable from the internet is an open resolver someone will use for amplification attacks.
Why it is here: Devices find each other directly, so there is nothing to publish. On a network you control it is the simplest thing here to keep private.
Why it is here: A music library on the local network needs no certificate and no domain, and the mobile clients keep working over a VPN when you are away.
Why it is here: Local playback is the case Jellyfin is best at. Publishing it means a domain, a certificate and an authentication story — a VPN gives you the same result with none of them.
Why it is here: The one service on this list that has to keep working when the internet does not. Local control is the point, and the recipe is written for exactly that.
Why it is here: Phone upload happens over the network you are on most nights anyway. Keeping the library private means a VPN when you travel, and it removes the largest piece of attack surface in the catalog.