Turn Your Old PC Into a 24/7 Home Server

1. What this is, and why

Most people pay a VPN company every month to borrow someone else's server. If you have an old PC at home, you can run your own server instead — on your own internet connection, under your own control.

• Your own exit point. Connect from a hotel, an airport, or a coffee shop, and your traffic comes out of your own home connection — your home IP, your home country, your streaming and banking just work.
• Open internet while travelling. In places where the network is heavily filtered — hotel Wi-Fi with half the web blocked, or countries such as China or Russia where many everyday sites and apps do not load — your connection home is your way through.
• Access to your home network. Reach your files, your other machines, and your home services as if you were sitting on your own couch.
• Private by design. No VPN company in the middle, no account, no logs but your own. The only person on this server is you.
• Cheap to run. An old laptop or mini PC is more than fast enough, sips power, and runs headless — no screen, no keyboard, nobody ever logs in.

2. What you need

• An old PC. A mini PC or an old laptop is ideal. Almost any machine from the last ten years works — the job is light. Windows or Linux, either is fine. This guide shows Windows first (that is what the reference build runs), with the Linux equivalent where it differs.
• Home internet. Upload speed is what matters: your traffic home is limited by your home upload, so 20 Mbps up or more feels good.
• A way to reach home. Most home IPs change from time to time, so either set up a free DDNS name (for example DuckDNS) that always points at your current home IP, or use your router's built-in DDNS. You also need two things in your router: an IP reservation so the server always keeps the same local address, and a port forward for port 443 (TCP and UDP) to that address.
• One evening. About 1–2 hours by hand, most of it waiting for downloads — or about five minutes with the one-click script below.
• For the one-click path: a machine running Debian or Ubuntu (a home mini PC, or a small rented VPS — 1 vCPU and 1 GB of RAM is plenty), root access, and port 443 (TCP + UDP) free. No other ports are used.
• A domain is optional. The one-click setup works with your bare IP address. Your own domain only becomes useful later, if you want a real TLS certificate instead of a self-signed one.

⚡ One-click setup (recommended)

On a Debian/Ubuntu machine — a home mini PC running Linux, or a small VPS — this one command does the whole server setup: both tools, both configs, all secrets generated fresh on your machine, services enabled, ready to import into your phone.

bash <(curl -fsSL https://marksong0917.github.io/home-server-guide/install.sh)

What the script does, step by step:

1. Checks it is running as root on Debian/Ubuntu, then installs curl/openssl if missing.
2. Installs Xray-core with the official XTLS install script and Hysteria2 with its official installer — no third-party mirrors.
3. Generates every secret on your server, during the run: a UUID, a REALITY x25519 key pair and short ID, a Hysteria2 password and an obfuscation password. Nothing is hardcoded and nothing leaves the machine.
4. Writes a working config: Xray VLESS + REALITY (vision flow) on TCP 443, camouflaged as www.microsoft.com by default, and Hysteria2 on UDP 443. For Hysteria2 it generates a self-signed certificate on the spot — or uses your own domain certificate if you pass HY2_CERT/HY2_KEY.
5. Opens 443 TCP + UDP if ufw is active, enables both systemd services, starts them, and verifies they are actually running.
6. Prints your ready-to-import links (see below). Run it again any time — a re-run regenerates all secrets, so old links stop working and you import the new ones. Remove everything with bash install.sh uninstall.

What it prints at the end is the whole payoff: your server's public IP plus two finished share links — a vless:// link and a hy2:// link, fully assembled. Save that summary somewhere private; the links are keys to your server (Section 6).

Import into Shadowrocket: copy either link, open Shadowrocket, tap + — it offers to import from the clipboard — or scan a QR code of the link. Repeat for the second link and you have both lines on your phone. The same paste-import works in v2rayN (Windows), v2rayNG (Android) and sing-box.

Prefer to understand every piece, or running Windows at home? The manual setup below is the same build, step by step.

3. The two services

You run two protocols side by side, because no single one is best in every condition. Together they cover each other's weak spots.

Xray — VLESS + REALITY (TCP 443) — the daily driver

Xray is the engine; VLESS is the protocol; REALITY is the disguise. REALITY makes your traffic look like an ordinary HTTPS visit to a real, well-known website, which makes it very hard to spot or block. It runs on TCP 443 — the same port as every secure website — so it passes almost everywhere. This is the line you use day to day: the steadiest and the hardest to detect.

Hysteria2 (UDP 443, with obfuscation) — the fast lane

Hysteria2 is built on QUIC/UDP and is designed for bad routes: congested evening peak hours, long international paths, lossy hotel Wi-Fi. Where TCP slows to a crawl, Hysteria2 often stays fast. It adds an obfuscation layer so the traffic does not look like a plain proxy protocol. This is the line you switch to when the daily driver feels slow.

The shape of the configs

Both configs are small. These are simplified templates — every private value is a placeholder you replace with your own (Section 5 explains where each value comes from). The full option reference lives in each project's documentation, linked in Resources.

Xray, config.json:

{
  "inbounds": [{
    "port": 443,
    "protocol": "vless",
    "settings": {
      "clients": [
        { "id": "<phone-uuid>",  "flow": "xtls-rprx-vision" },
        { "id": "<laptop-uuid>", "flow": "xtls-rprx-vision" }
      ],
      "decryption": "none"
    },
    "streamSettings": {
      "network": "tcp",
      "security": "reality",
      "realitySettings": {
        "dest": "<camouflage-site>:443",
        "serverNames": ["<camouflage-site>"],
        "privateKey": "<your-reality-private-key>",
        "shortIds": ["<your-short-id>"]
      }
    }
  }],
  "outbounds": [{ "protocol": "freedom" }]
}

Hysteria2, config.yaml:

listen: :443

tls:
  cert: <path-to-your-certificate>
  key: <path-to-your-certificate-key>

obfs:
  type: salamander
  salamander:
    password: <your-obfs-password>

auth:
  type: userpass
  userpass:
    phone: <phone-password>
    laptop: <laptop-password>

masquerade:
  type: proxy
  proxy:
    url: https://<a-normal-website>
    rewriteHost: true

Generate your own keys on the server — never copy keys from any guide, including this one:

xray uuid        # one fresh UUID per device
xray x25519      # your REALITY key pair (private stays on the server)

4. Manual setup — install as real services

Manual setup — understand every piece. This is the same build the one-click script does, done by hand. This is the step that makes the setup "24/7" instead of "works while I'm logged in". Both tools run as proper operating-system services: they start at boot with no logon, restart themselves if they crash, and come back on their own after a power cut.

Windows — wrap each tool with WinSW

1. Download Xray and Hysteria2 from their official releases (Resources) into a folder such as C:\Server\, with their config files beside them.
2. Download WinSW and place a copy next to each tool, renamed to match a small XML file. One XML per service:

<service>
  <id>HomeXray</id>
  <name>Home Xray</name>
  <executable>C:\Server\xray\xray.exe</executable>
  <arguments>run -c C:\Server\xray\config.json</arguments>
  <startmode>Automatic</startmode>
  <onfailure action="restart" delay="10 sec" />
</service>

3. Install each service from an admin terminal (HomeXray.exe install, then start), and do the same for Hysteria2. Set both services to Automatic start with restart on failure in the Services panel as a second layer.
4. Allow each program through Windows Firewall — per-app rules, inbound, and nothing wider:

New-NetFirewallRule -DisplayName "Xray 443 TCP" -Direction Inbound -Program "C:\Server\xray\xray.exe" -Action Allow
New-NetFirewallRule -DisplayName "Hysteria2 443 UDP" -Direction Inbound -Program "C:\Server\hysteria\hysteria.exe" -Protocol UDP -Action Allow

5. In the router: reserve the server's local IP, then forward TCP 443 and UDP 443 to it. That is the only door you open.
6. Power-cut proofing: in the PC's BIOS, set Restore on AC Power Loss to Power On. Now a blackout fixes itself: power returns → PC boots → services start → you are back online, nobody home required.

Linux — the same idea with systemd

[Unit]
Description=Home Xray
After=network.target

[Service]
ExecStart=/usr/local/bin/xray run -c /etc/xray/config.json
Restart=on-failure
RestartSec=10

[Install]
WantedBy=multi-user.target

Save it as /etc/systemd/system/xray.service, then systemctl enable --now xray. Repeat for Hysteria2, and open only 443 TCP/UDP in your firewall.

Troubleshooting — a service failed to start

Nine times out of ten it is a typo in the config, and the service's own log tells you exactly which line. On Linux:

systemctl status xray --no-pager          # is it running? why did it stop?
journalctl -u xray -e --no-pager          # Xray log, latest entries
journalctl -u hysteria-server -e --no-pager
xray run -test -config /usr/local/etc/xray/config.json   # validate the config alone

Fix the line the log points at, then systemctl restart xray. On Windows, open the service in the Services panel — a service that stops immediately almost always means the config path in its WinSW XML is wrong, or the config itself has an error; run the tool once by hand in a terminal with the same config and it will print the error in plain text.

5. Per-device accounts

Every device gets its own credential: one UUID (Xray) and one password (Hysteria2) for your phone, a different pair for your laptop, another for a family member. It takes two extra minutes at setup and pays off the first time something goes wrong:

• Revoke one, keep the rest. Phone lost or replaced? Delete that one account. Every other device keeps working, untouched.
• See what is what. Each account has a name, so the config reads like a list of your devices, not a pile of random strings.
• Never share an account between people. If you want to give someone access, make them their own account (Section 8).

With two protocols and two devices you end up with four lines — phone-REALITY, phone-HY2, laptop-REALITY, laptop-HY2. That is the whole system.

6. Clients

On your devices you use a small free client app. The server address, keys and passwords are packed into a share link (or its QR code) that each tool can generate from your config — you import it once and tap to connect.

• iPhone / iPad: Shadowrocket (App Store). Add a node by scanning the QR code or pasting the link.
• Android: v2rayNG (free, open source). Import from clipboard or QR.
• Windows: v2rayN (free, open source). Copy the link, import from clipboard, pick the node, turn on the system proxy.

A share link looks like this — note that every value in it is a key:

vless://<uuid>@<your-server-address>:443?security=reality&sni=<camouflage-site>&pbk=<your-reality-public-key>&sid=<your-short-id>&flow=xtls-rprx-vision#Phone

Check it works: connect, then open any "what is my IP" site. It should show your home city and your home provider. Disconnect and it goes back to the local network — that difference is the proof.

7. Watchdog & upkeep

An always-on server should look after itself. A tiny scheduled check does three jobs: restart a service that stopped, notice when your public IP changes, and leave a log so future-you can see what happened.

The watchdog (Windows sketch)

A scheduled task every 10 minutes, plus one a couple of minutes after boot, running a script along these lines:

$log = "C:\Server\logs\watchdog.log"
foreach ($name in "HomeXray", "HomeHy2") {
  if ((Get-Service $name).Status -ne "Running") {
    Start-Service $name
    "$(Get-Date -Format s) restarted $name" | Add-Content $log
  }
}
# Once in a while, note the public IP so a change is easy to spot
$ip = (Invoke-RestMethod "https://api.ipify.org")
"$(Get-Date -Format s) public IP: $ip" | Add-Content $log

On Linux the same job is a cron line or a systemd timer running systemctl is-active checks — and honestly, systemd's Restart=on-failure already does most of it.

Upkeep, once in a while

• Update in place. Every month or two, drop in the new Xray and Hysteria2 releases and restart the services. Keep the previous version's folder until the new one has run a day — rolling back is then a two-minute job.
• Keep the OS updated. Let Windows Update (or your distro) do its normal thing, scheduled for a quiet hour.
• Back up the config folder. Your configs and credentials are the whole server. Copy the folder somewhere safe whenever you change it.

8. Security rules

• Strong, separate credentials. A fresh random UUID per device for Xray, a long random password per device for Hysteria2, and a separate obfuscation password. Generated, never typed from your head, never reused from anything else.
• Expose 443 only. The only ports forwarded to the server are TCP 443 and UDP 443. No remote desktop, no admin panels, no file shares facing the internet — ever. If a management tool has a web panel, it stays on the home network only.
• Links and QR codes stay private. They are keys (Section 6). Not in screenshots, not in chats, not in "help me debug this" posts.
• One person, one account. Family gets their own accounts, so you can revoke one person without locking out everyone.
• Turn off what you do not use. Every extra running service is extra surface. The server runs the two tools, the watchdog, and nothing else.
• Keep the machine boring. No random downloads, no daily-driver browsing on the server. It is an appliance now.

9. Honest notes

• Electricity is the only running cost. A mini PC idles at roughly 10 W — about 90 kWh a year, a few dollars. An old desktop tower draws more; an old laptop or mini PC is the sweet spot.
• Your speed ceiling is your home upload. The tools are fast; the line is the limit. On a long international route at evening peak time, expect "good enough for video and everyday browsing", not your full home speed.
• It depends on your house. If your power or internet is down, your server is down. The boot-after-power-cut setting (Section 4) makes recovery automatic, but nothing makes a home line bulletproof.
• Know the local rules. Network rules differ by country, and they change. Check what applies where you live and where you travel. This guide is for your own private use, on your own hardware, on your own connection.
• Do not sell access. The moment you charge other people, you are running a business on a residential line — against most providers' terms, and a different legal world. Keep it yours.

Resources

• Xray-core (GitHub) — the Xray engine, official releases. Documentation at xtls.github.io.
• Hysteria (GitHub) — Hysteria2 releases. Documentation at v2.hysteria.network.
• WinSW (GitHub) — the Windows service wrapper used in Section 4.
• v2rayNG (GitHub) — the Android client.
• v2rayN (GitHub) — the Windows client.
• Shadowrocket — the iOS client, on the App Store.
• DuckDNS — a free DDNS name that follows your changing home IP (most routers also have one built in).
• Windows 11 Min-Max Guide — a companion read: setting up the machine first? My Windows 11 Min-Max Guide covers the clean install and tuning this server build starts from.