Home Server Reference

Pi4 Patch Panel

Model
Pi 4B rev 1.1
OS
Debian 13 trixie
Ethernet
192.168.4.157
Wi-Fi (backup)
192.168.4.156

System Vitals

connecting…
Temp
—
Throttling
—
CPU
—
Memory
—
Disk
—
Uptime
—
load avg — — only reachable from the LAN or Tailscale, same as AdGuard/NetAlertX above
AdGuard Home :80 · :53
web uiadguard.home.ssswebd.com
on lan192.168.4.157
tailscalepi4.tail907ff3.ts.net
dns192.168.4.157:53
  • Login — user shash, password on file (native install, not Docker)
  • Upstream — Quad9 + Cloudflare + Google, parallel-race mode
  • Filters — AdGuard DNS + AdAway, Safe Browsing on
  • Runs as a systemd service at /opt/AdGuardHome
  • adguard.home.ssswebd.com only resolves for devices using AdGuard itself as DNS (LAN, or a Tailscale device with the subnet route) — no public record exists
NetAlertX :20211
web uinetalertx.home.ssswebd.com
on lan192.168.4.157:20211
tailscalepi4.tail907ff3.ts.net:20211
api / mcp127.0.0.1:20212
  • Login — password only, no username; password on file
  • API token — pinned in app.conf, won't rotate on restart
  • Discovery — via UniFi API only, local scanners disabled on purpose
  • Alerts — new devices only, via Telegram @shash_home_alerts_bot
  • Docker: /opt/netalertx/docker-compose.yml
UniFi Gateway Cloud GW Ultra
console192.168.4.1
  • Self-signed cert — browser warning on first visit is expected
  • API key — stored in NetAlertX's app.conf as UNIFIAPI_api_key
  • 3 wired LAN networks, see the VLAN map below
Tailscale subnet router
pi4100.78.9.108
tailnettail907ff3
  • Advertises 192.168.4.0/24 to the tailnet
  • Remote reach limited to 3 devices — phone, work laptop, stream-yt-setic
  • Everyone else on the tailnet can reach pi4 itself, not the LAN behind it

Network map

NetworkRangeVLANPurpose
Default 192.168.0.0/24 — General household devices, DNS via WAN chain
restricted network 192.168.3.0/24 2 App-category blocking + scheduled cutoffs, kid-safe devices
all unblocked 192.168.4.0/24 3 Pi4 lives here, along with IoT and main devices
MCP config
~/Downloads/.mcp.json
NetAlertX config
/opt/netalertx/config/app.conf
DNS fallback chain
eth → wifi → 1.1.1.1
Health check
Ask Claude for "the usual check"