Learn how to transform a Raspberry Pi into a powerful, private, self-hosted multi-service home server using Docker and Portainer.

In this complete guide, we show how a single Raspberry Pi device can run multiple useful services at the same time: file storage, password management, smart home control, local AI models, and secure remote access — all without relying on cloud subscriptions or third-party providers.

You stay in control of your data.

Why a Raspberry Pi as a multi-service server?

Despite its compact size, a Raspberry Pi is capable of running multiple services reliably when combined with:

• A 64-bit operating system
• SSD storage
• Containerized services with Docker

By using containers, we can isolate each service, avoid dependency conflicts, simplify updates, and keep the system maintainable over time.

What is Docker?

Docker is a platform that packages applications and all their dependencies into isolated units called containers.

Each container:

• Runs independently
• Uses its own libraries
• Can be started, stopped, updated, or removed without affecting others

This prevents conflicts between services and makes your system reproducible and robust, which is essential for a multi-service server.

What is Portainer?

Portainer is a lightweight web-based management platform for containerized applications.

With Portainer, you can:

• Deploy services using Docker compose files
• Manage containers, stacks, volumes, and networks
• Monitor resource usage
• Avoid working directly from the command line for most tasks

Thanks to Portainer, managing a home server becomes much more accessible, especially for users without advanced system administration knowledge.

What you’ll need

For this project, we are using our self-developed Pi Hack dev board, featuring:

• Raspberry Pi Compute Module 5 with 8 Gb of Ram and 32 Gb of EMMc memory
• 256 GB NVMe SSD (system and data drive)

This setup provides excellent performance and reliability for Docker-based workloads.

You can follow this guide using any Raspberry Pi model. However, we strongly recommend using an external SSD instead of a microSD card for better performance, more storage, and long-term reliability.

Before you start: important notes

• Never expose services directly to the public internet without HTTPS and authentication
• In this guide, services are configured for local network usage
• Remote access is handled securely via VPN
• Always change default passwords. Use strong, unique credentials for every service

Important concept: one IP, many services

Your Raspberry Pi has a single local IP address, for example:
192.168.1.50

Multiple services can run on the same IP by using different ports, such as:
192.168.1.50:8053
192.168.1.50:8082
192.168.1.50:8096

As long as no two services use the same port, they can coexist safely.
Vaultwarden is a special case and will use HTTPS on port 443, which we handle via Nginx (we’ll get there)

Services installed in this project

Each service was selected based on usefulness, performance, and compatibility with Raspberry Pi hardware:

• Vaultwarden: self-hosted password manager (security & productivity)
• Nextcloud: private cloud storage, contacts, and calendar (productivity)
• Ollama: run lightweight AI models locally (AI & experimentation)
• Home Assistant: smart home control platform (automation)
• WireGuard VPN: secure remote access to your home network (security)

First steps: system setup

1. Install Raspberry Pi OS Lite (64-bit) Desktop is not required.
2. Configure Raspberry Pi Connect or enable SSH in Raspberry Pi Imager.
3. Find the IP address:
   hostname -I
4. Connect via SSH:
   ssh pi_username@IP_ADDRESS
5. Update the system:
   sudo apt update
sudo apt upgrade -y

Assign a static IP address to your device

Run:
sudo nmtui

• Select your active connection (wlan0 or eth0)
• Set IPv4 to Manual
• Assign:
  • Static IP
  • Gateway (router IP)
  • DNS server

Save and reboot:
sudo reboot

Installing Docker

Download and install the official package, set the required user permissions and reboot the system:
curl -sSL https://get.docker.com | sh
sudo usermod -aG docker $USER
sudo reboot

Verify Docker is in your groups and run the test container «Hello world»:
groups
docker run hello-world

Installing Portainer

Run the installation command:
docker pull portainer/portainer-ce:latest
Create a Docker volume for Portainer data:
docker volume create portainer_data
Run Portainer using the command:
docker run -d -p 8000:8000 -p 9443:9443 --name=portainer --restart=always -v /var/run/docker.sock:/var/run/docker.sock -v portainer_data:/data portainer/portainer-ce:latest

Access Portainer. Open a browser window and type:
https://YOUR_IP_ADDRESS:9443

Follow the initial setup, log in and you’ll be ready to install your first service!

Installing Vaultwarden (self-hosted password manager)

Vaultwarden is a lightweight, self-hosted implementation of the Bitwarden server API. It is fully compatible with official Bitwarden apps and browser extensions, but runs on your own infrastructure.

Key advantages:

• Full control over your passwords
• No subscriptions
• Compatible with all Bitwarden clients
• Very low resource usage

Because it manages sensitive data, Vaultwarden must always be served over HTTPS.

Prepare directories

Via SSH paste the following commands:

sudo mkdir -p /srv/docker/vaultwarden
sudo mkdir -p /srv/docker/nginx/conf
sudo mkdir -p /srv/docker/nginx/certs
sudo chown -R $USER:$USER /srv/docker


Create Docker network

In Portainer:

• Networks → Add network
• Name: vaultwarden_net
• Driver: bridge

Deploy Vaultwarden stack

Deploy the stack in Portainer → Stacks → Add stack:

Name it: vaultwarden
Paste the install script in the web editor:

version: "3.8"
services:
vaultwarden:
image: vaultwarden/server:latest
container_name: vaultwarden
restart: unless-stopped
environment:
WEBSOCKET_ENABLED: "true"
DOMAIN: "https://PI_IP"
TZ: "Europe/Madrid"
volumes:
- /srv/docker/vaultwarden:/data
expose:
- "80"
- "3012"
networks:
- vaultwarden_net
networks:
vaultwarden_net:
external: true

Press «Deploy stack».

Generate a self-signed SSL certificate

Enter the following commands via SSH:

sudo mkdir -p /srv/docker/nginx/certs
cd /srv/docker/nginx/certs
sudo openssl req -x509 -nodes -days 365 \
-newkey rsa:2048 \
-keyout vaultwarden.key \
-out vaultwarden.crt


Note: Use the Raspberry Pi IP as Common Name when prompted.

Configure Nginx

Edit the config file through SSH:
nano /srv/docker/nginx/conf/vaultwarden.conf

And paste:
server {
listen 443 ssl;
server_name _;
ssl_certificate /etc/nginx/certs/vaultwarden.crt;
ssl_certificate_key /etc/nginx/certs/vaultwarden.key;
location / {
proxy_pass http://vaultwarden:80;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Real-IP $remote_addr;
}
location /notifications/hub {
proxy_pass http://vaultwarden:3012;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
}

Install Nginx

Deploy the stack in Portainer → Stacks → Add stack:

Name it: nginx_vaultwarden
Paste the install script in the web editor:

version: "3.8"
services:
nginx:
image: nginx:latest
container_name: nginx_vaultwarden
restart: unless-stopped
ports:
- "443:443"
volumes:
- /srv/docker/nginx/conf:/etc/nginx/conf.d:ro
- /srv/docker/nginx/certs:/etc/nginx/certs:ro
networks:
- vaultwarden_net
networks:
vaultwarden_net:
external: true

Press «Deploy stack».

If everything has gone correctly, you should be able to access:
https://YOUR_IP_ADDRESS

• Your browser may warn about the certificate (this is normal)
• Accept the warning
• Vaultwarden should load without any HTTPS errors
• There should be no conflicts with other services
• Vaultwarden does not use ports on the host

Once inside the Vaultwarden panel, you can start creating and organizing your passwords, all stored securely on your self-hosted server.
On the official Vaultwarden website, you can find comprehensive information about all the features and settings you can configure to customize your experience and get the most out of this tool.

Installing Nextcloud (private cloud)