Reclaiming Your Digital Homestead: Why Your Corner of the Internet Should Be Your Own

Part 1: The Vision - Reclaiming Your Digital Homestead

The following is one implementation of an idea that would take your social media posts off corporate media and into your own control. It would guard your presence on the internet as you browse and collaborate. You would be allowed to post what you want, remove what you don't want, and not have to worry that your data is being sold or stolen. You would have full control over who sees each thing you post.

For the last two decades, we’ve been living in someone else’s house. We decorated our rooms on Facebook, stored our memories in Google Photos, and built our professional networks on LinkedIn. We were given these digital spaces for free, and in return, we handed over the blueprints to our lives—our data, our connections, our attention. The landlord, we discovered, was not just renting us a room; they were fundamentally reshaping the building around us based on what they learned.

But a quiet, powerful movement is growing. It’s a movement of digital homesteading, of building your own corner of the internet where you set the rules, own the property, and control the front door. It’s about moving from being a digital tenant to a digital sovereign. This isn't just a technical exercise for hobbyists; it's a fundamental shift in how we relate to technology and to each other.

Here’s why taking control of your own social media, content, and projects is more than just a good idea—it’s becoming essential.

1. You Own Your Data, Truly.
   When you post on a commercial social media platform, you grant them a license to use your content in ways you’ll likely never read in their terms of service. Your photos are used to train their AI models, your posts are analyzed to build sophisticated advertising profiles, and your data is packaged and sold. When you host your own platform, the equation is simple: your data resides on your hardware. It’s the difference between storing your diary in a public library and keeping it in a locked safe in your own home.

2. You Escape the Tyranny of the Algorithm
   Commercial platforms are not optimized for your well-being; they are optimized for engagement. Algorithms have learned that outrage and controversy are powerful drivers of clicks. When you control the platform, you escape this manipulation. Your feed can be what you want it to be: a chronological list of updates from people you genuinely care about.

3. You Build for Permanence, Not Passing Fads
   The internet is littered with the digital graveyards of platforms that were shut down. By self-hosting, you build on a foundation you control. Your blog, your photo archive, your project portfolio—they exist as long as you choose to maintain them. You are building a personal archive that can last a lifetime, not just until the next funding round.

4. You Can Offer True Privacy as a Feature
   In a world of pervasive surveillance, the ability to offer a truly private space for communication is a radical act. When you run your own services, especially when combined with privacy technologies like Tor, you can create enclaves of trust. You can give friends and collaborators not just a platform, but a promise: "Here, in this space I have built, you are safe."

5. You Reclaim Your Focus and Creativity
   Commercial platforms are creativity sinks. A self-hosted environment is different. A personal project server has one purpose: to help you build things. A personal cloud has one purpose: to help you organize your life. There are no ads, no trending topics, no manufactured drama. It is a workspace, not a casino.

6. Block ads, trackers and cache the Internet.
   Using free open source tools we can block all ads, trackers and intelligently cache the internet to restore the speed you lost to tor routing. Not just in your web browser, but for any application on your phone or pad computer that is connected to the secure wireless wifi of the access point.

The Path Forward Is Personal

Taking this step may seem daunting. But projects like the "Sovereign GatewayPi" are lowering the barrier to entry, creating automated, all-in-one solutions that can transform a tiny computer into a private fortress and creative studio. It’s time to stop renting and start building. It’s time to come home.

---

Part 2: The Project Plan - Building the Sovereign GatewayPi

1. Vision & Executive Summary

The Sovereign GatewayPi is a single, Raspberry Pi 5-based device that acts as a comprehensive security and privacy gateway while simultaneously hosting a suite of private, self-hosted services.

• The Privacy Fortress: It physically sits between the ISP router and a designated "Secure Zone," transparently forcing all outgoing traffic from that zone through a hardened firewall and the Tor anonymity network.

• The Sovereign Hub: It hosts a suite of personal cloud and collaboration applications. Access is provided securely and anonymously to trusted friends via a novel, invite-only system where each user receives their own unique and revocable .onion address.

This project's goal is to create a powerful, automated, and distributable platform for digital sovereignty.

2. Recommended Network Architecture: The Physical Segmentation Model

To ensure both maximum security and maximum performance, the project is designed around a physical segmentation model. This solves the classic trade-off between privacy and speed by creating two distinct zones in your home.

• The "Clearnet" Zone: For devices where performance and convenience are paramount and privacy is not a primary concern (gaming consoles, smart TVs, IoT). These devices connect directly to your main ISP router.

• The "Secure" Zone: For devices handling personal or sensitive data (laptops, phones). This zone is exclusively managed and protected by the Sovereign GatewayPi.

The Physical Topology:

Why This Model is Superior:

• Utmost Simplicity: The GatewayPi's configuration is dramatically simplified. It focuses on being a two-port, transparent Tor gateway.

• Absolute Isolation: The separation between the zones is a physical air gap, providing the highest possible level of security.

• Enhanced Resilience (Solves Single Point of Failure): If the Sovereign GatewayPi fails, it only affects the Secure Zone. The rest of the household's internet continues to function.

• Zero Performance Impact: The Clearnet devices get the full, native speed of the ISP connection, as they are not routed through the Pi.

3. Core Architectural Principles

• Gateway-First Design: The device is a mandatory network gateway for the Secure Zone.

• Security Through Isolation: The Sovereign Hub is never exposed to the public internet via a public IP. All access is exclusively handled by Tor Onion Services.

• Containerization is Mandatory: All hosted applications will be run in Docker containers managed by Docker Compose for isolation and reproducibility.

• Automation via Ansible: The entire setup process will be codified into an Ansible playbook to eliminate manual error.

• Per-User Network Access Control (NAC): The system provisions a unique .onion address for each user. Access can be revoked at the network layer.

4. Bill of Materials & Application Stack

• Hardware:

  • Raspberry Pi 5 (4GB+ recommended), official 5V/5A power supply, and a case with active cooling.

  • High-speed microSD card or a USB NVMe SSD.

  • See Appendix for specific networking hardware choices.

• Software & Applications:

  • OS: Raspberry Pi OS Lite (64-bit)

  • Core Tools: iptables, dnsmasq, tor, docker, docker-compose, ansible

  • Application Stack: Nginx Proxy Manager (Reverse Proxy), Nextcloud (Personal Cloud), Gitea (Project Collaboration), GoToSocial/WordPress (Social Feed/Blog).

5. Phased Implementation Plan

This project will be executed in distinct phases, which will ultimately be automated by the Ansible playbook.

• Phase 1: The Foundation - Basic Gateway Router

  • Configure the Pi with two network interfaces (WAN/LAN) and set up basic routing and DHCP/DNS services for the Secure Zone.

• Phase 2: The Privacy Fortress - Anonymity Layer

  • Install and configure Tor as a transparent proxy. Modify firewall rules to force all traffic from the Secure Zone LAN through Tor and implement a "kill switch."

• Phase 3: The Sovereign Hub - Application Stack Deployment

  • Install Docker and use Docker Compose to deploy the containerized application stack (Nextcloud, Gitea, etc.).

• Phase 4: Secure External Access - Admin Onion Service

  • Configure Tor to create a hidden service (.onion address) that points to the Nginx reverse proxy for secure administrative access.

• Phase 5: Advanced Access Control - Per-User Onion Invites

  • Develop create-invite.sh and revoke-invite.sh scripts that automate the creation and deletion of a unique .onion address for each user, tied to their application accounts.

• Phase 6: Productization - The Ansible Playbook

  • Codify all steps from Phases 1-5 into a modular Ansible playbook for a one-command deployment.

6. System Operations & Maintenance

• User Onboarding: Use the create-invite.sh script.

• User Offboarding: Use the revoke-invite.sh script.

• System Updates: Regularly run apt update && apt upgrade. Use docker-compose pull to update container images.

• Backup Strategy: Implement a robust backup plan using a tool like restic or borg to perform automated, encrypted backups of all critical data (Docker volumes, Tor service keys, application configurations).

---

7. Integrated Service Enhancement: The Secure Zone "Clean Pipe"

The Sovereign GatewayPi will incorporate two additional services, running as Docker containers, to fundamentally improve the quality of all traffic within the Secure Zone. These services will be managed by the Ansible playbook as optional, but recommended, components.

1. DNS-Level Ad & Tracker Blocking (Pi-hole)

Instead of a simple dnsmasq setup, the GatewayPi will run a full Pi-hole instance.

• How it Works: The GatewayPi's DHCP server will assign itself as the sole DNS server for all clients in the Secure Zone. Every DNS request (e.g., "what's the IP for google-analytics.com?") is processed by Pi-hole. If the domain is on a known ad, tracker, or malware blocklist, Pi-hole refuses to resolve it, effectively preventing your device from ever connecting to it.

• The Benefit:

  • Network-Wide Ad Blocking: Ads are gone from browsers, apps, and even smart TV interfaces on any device connected to the Secure Wi-Fi. No client-side software needed.  This means no ads  on your phone or pad computer hooked to the wifi, even  app ads are blocked.

  • Enhanced Privacy: Blocks countless invisible trackers that monitor your browsing habits across the web.

  • Improved Performance: By preventing the download of ads and tracking scripts, web pages load noticeably faster. This is a massive win when your connection is already bottlenecked by Tor. Blocking this junk data upstream means Tor's limited bandwidth is reserved for the content you actually want.

2. Web Content Caching (Squid Proxy)

The GatewayPi will also run a Squid caching proxy server.

• How it Works: The firewall will be configured to transparently redirect all web traffic (HTTP/HTTPS) from the Secure Zone through the Squid proxy before sending it to Tor. When a user requests a web element (like an image, a CSS file, or a javascript library), Squid downloads it, passes it to the user, and saves a copy in its cache on the Pi's storage. If another user (or the same user) requests that same element again, Squid serves it instantly from its local cache, never needing to fetch it over the internet.

• The Benefit:

  • Significant Speed Boost: For commonly visited websites, cached elements load at local network speeds instead of the much slower speeds of the Tor network. This can make the Tor browsing experience feel dramatically snappier.

  • Reduced Bandwidth: It reduces the total amount of data that needs to be pulled through the Tor network, respecting the shared resources of the volunteer-run Tor project and making your own connection more efficient.

The New Traffic Flow within the Secure Zone

This creates a powerful, multi-stage filtering and optimization pipeline for all traffic:

1. Client Device: A user tries to visit a website.

2. DNS Request: The device asks the GatewayPi (Pi-hole) for the IP address.

   • If the domain is an ad/tracker, Pi-hole blocks it. End of story.

   • If the domain is legitimate, Pi-hole returns the IP address.

3. Web Request: The device sends its request to the website's IP.

4. Firewall Intercept: The GatewayPi's firewall intercepts the request and transparently redirects it to the Squid Proxy.

5. Squid Cache Check:

   • If Squid has a fresh copy of the requested content in its cache, it serves it directly to the client at LAN speed.

   • If not, Squid forwards the request to the next stage.

6. Tor Anonymization: The request is passed to the Tor service, which anonymizes it and sends it out to the internet.

7. The process happens in reverse for the response.

The Role of the Digital Homebrewer (Expanded)

This enhancement solidifies the Digital Homebrewer's role. They are not just providing a private internet; they are providing a premium internet experience for their community.

• They are giving their friends and family an internet with the ads stripped out, the trackers disabled, and the speed optimized.

• This is a powerful demonstration of the benefits of taking control. The experience in the Secure Zone isn't just "more private"; it's tangibly better than the standard, ad-filled internet everyone else uses. This makes the "hurdle" of using the Secure Zone an easy sell—it's an upgrade in every sense of the word.

Appendix A: Hardware Options & Upgrade Paths (The A/B Model)

The project is designed with a two-tiered philosophy. Option A is the low-cost solution for 95% of users. Option B is the high-performance upgrade.

A.1 Core Gateway Networking Hardware

• Option A (Standard): USB 3.0 Adapter

  • Setup: Uses the Pi 5's built-in Gigabit port for one interface and a simple USB 3.0 to Gigabit Ethernet adapter for the other.

  • Pros: Very low cost, simple plug-and-play setup, sufficient for any standard gigabit internet connection.

• Option B (High Performance): PCIe Dual-Port NIC

  • Setup: Utilizes a PCIe HAT and a dedicated M.2 dual-port 2.5GbE network card (e.g., Intel i226-V).

  • Pros: Maximum throughput (2.5Gbps+), minimal CPU overhead, frees up USB ports for storage.

A.2 Wireless Access for the Secure Zone

• Option A (Standard): Integrated Wi-Fi Access Point

  • Setup: Activates the Raspberry Pi 5's built-in Wi-Fi module to broadcast the "Secure Zone" wireless network.

  • Pros: Zero additional cost, minimal physical footprint, perfect for simple or portable setups.

  • Cons: Limited performance, increased CPU load on the Pi.

• Option B (High Performance): Dedicated Wi-Fi Access Point

  • Setup: A dedicated, purpose-built Wi-Fi AP is connected via Ethernet to the GatewayPi's LAN port.

  • Pros: Vastly superior wireless range, speed, and reliability (Wi-Fi 6/6E); offloads wireless management from the Pi's CPU. This is the recommended method for anyone prioritizing performance.

Appendix C: System Resilience - Automated Backup and Restoration

A core principle of digital sovereignty is not just owning your data, but ensuring its permanence and protecting it from loss. The Sovereign GatewayPi is the single point of truth for your private services; therefore, a simple and powerful backup strategy is something that should be easy to  add and configure.

This appendix outlines the integrated backup and restoration system, designed to be both user-friendly for initiation and robust for recovery. The system is managed via a lightweight, secure web-based Administrative Panel (Cockpit) running as another container on the GatewayPi.

Core Components

• Administrative Panel (Cockpit): A secure web interface for system administration. This panel will have a custom "Sovereign Backup" page for managing the features below.

• Backup Engine ( The industry-standard tool for creating efficient, incremental, and reliable file-level backups.

• Automation: A combination of udev rules (for detecting new drives) and cron jobs (for scheduling regular backups) will automate the process.

---

C.1 The Backup Process

The system supports two backup targets, following the project's A/B philosophy.

This is the simplest and most physically secure method for creating a complete system backup.

The User Experience:

1. Plug In: The user connects a blank or empty USB hard drive/SSD to one of the Pi's free USB 3.0 ports.

2. Access Panel: The user logs into the Administrative Panel (e.g., http://gateway.local:9090).

3. Designate Drive: On the "Sovereign Backup" page, the new USB drive will be visible. The user clicks "Designate as Backup Drive."

4. Initialize: The system will ask for confirmation, warning that the drive will be formatted. Upon confirming, the system initializes the drive (formats it with ext4, labels it, and creates a marker file).

5. First Backup: The system immediately kicks off the first full backup. A progress bar is shown in the admin panel.

6. Automated Backups: Once complete, the system automatically schedules an incremental back up every few minutes. No further user interaction is needed.

7. This backup is rbackup by date every few minutes.  The first backup of all the containers and data and config files takes the longest.  After that only files that have changed are backed up.  The backup drive will be a snapshot by time and date of every file on the system. 

Behind the Scenes:

• When designated, a script formats the drive and creates a unique marker file (.sovereign_backup_marker) so it can be identified later.

• An rsync script runs, archiving all critical data (see "What is Backed Up?" below).

• A cron job is created to run the rsync script every night, efficiently copying only the changes since the last backup.

For users with a NAS (Network Attached Storage) or another server, backups can be sent over the local network.

The User Experience:

1. Access Panel: In the "Sovereign Backup" admin panel, the user selects the "Remote Share (NAS)" tab.

2. Enter Details: The user enters the network path (e.g., //192.168.1.50/backups), username, and password for their network share.

3. Test & Save: A "Test Connection" button verifies the credentials. On success, the user saves the configuration.

4. First Backup & Automation: The process for the first backup and subsequent automated nightly backups is identical to the USB drive method.

---

C.2 The Restoration Process

The true value of a backup is a simple restore. This process is designed for disaster recovery (e.g., a corrupted SD card or a complete hardware failure).

The User Experience:

1. Prepare Hardware: The user flashes a fresh copy of the Sovereign GatewayPi base OS onto a new SD card and inserts it into the Pi.

2. Connect Backup Drive: The user connects the USB backup drive that contains a valid backup.

3. First Boot: The user powers on the Raspberry Pi with the backup drive connected.

4. Console Prompt: During the initial boot sequence, a script will detect the backup drive. The user will see a prompt on the connected console/SSH session:

   == Sovereign GatewayPi Recovery Mode ==

   A valid backup drive has been detected.
   Do you want to restore the system from this backup? (y/n):

5. Restore & Reboot: The user types y. The system will then:

   • Copy all backed-up data back to their correct locations on the new SD card.

   • Run the core Ansible playbook to ensure all services are re-installed and configured correctly around the restored data.

   • Automatically reboot one final time.

Upon reboot, the Sovereign GatewayPi will be back online, fully restored to its last backed-up state—all users, files, .onion addresses, and configurations intact.

(Note: Restoring from a network share is an advanced procedure that requires the user to first configure the network back up on the fresh install and the user will be given the option to restore the back up if it already exists.)

---

C.3 What is Backed Up?

The backup script is configured to be comprehensive, ensuring a full restoration of the system's identity and data:

• All Docker Volumes: This is the most critical part, containing the raw data for Nextcloud (files, users), Gitea (repositories, issues), Pi-hole, etc.

• Tor Hidden Service Keys: The private keys for every .onion address you have generated. Losing these means losing your addresses forever.

• Core Service Configurations: All settings for tor, pihole, squid, and other system services.

• Sovereign Hub Configurations: The docker-compose.yml file and any related environment files.

• Custom Scripts: The create-invite.sh and revoke-invite.sh scripts and any other system customizations.