06 — Set up household applications

TL;DR: Install and test one application at a time. Give it the files and connections it needs, back up its data, and check that people can use it after an update or restart. This chapter uses Docker Compose for general applications, Plex for media, and Home Assistant OS for home automation.

Choose the first application#

Start with something you actually want to use. Plex can serve your media library; Home Assistant can connect supported smart-home devices. You can follow the general application steps for another service instead. Tell your AI operator who will use it, from which devices, and whether it needs to work away from home.

Use the servers, accounts, and storage you set up in the earlier chapters. If a service needs a new account, data folder, or connection, your AI operator should include creating it in this task. You should not have to discover those missing pieces halfway through installation.

Before the first application, check that you can still reach its server from your admin computer, that the intended storage is available, and that your backup restore test worked. If one fails, fix that problem before adding another service that depends on it.

Understand what Docker will run#

Many applications publish a container image: a packaged copy of the application and the software it needs. Docker downloads that image and runs it as a container. You can replace the container when updating while keeping the application's saved data in a separate location.

Docker Compose describes how to run an application in a file. It records the image to use, where data goes, which connections are available, and any related components such as a database. Keep one Compose project for each application, including components that need to be maintained together. Commit and push its configuration to your private GitHub repository.

Compose works well on one server. If you have several application servers, each can run its own projects. It does not automatically move an application elsewhere when that server fails. The operations chapter discusses when a system that schedules work across machines becomes useful. Docker's single-server deployment guide

A running container does not necessarily mean its application is ready. A database may still be starting, or storage may be missing. Have your AI operator configure startup checks and test a normal user action, such as opening a library or saving a record.

Install Docker Engine and Compose#

Use Docker's supported Ubuntu installation procedure for the release you installed. Your AI operator should inspect the server first and prepare the commands for you to run in your server administrator account. If Docker already exists, it should explain that installation and any existing data before changing it.

Prompt to paste:

Walk me through installing Docker Engine and the Compose plugin on this Ubuntu
server. Inspect its release, architecture, package sources, current container
runtimes, firewall, and any existing Docker data. Use Docker's current official
Ubuntu instructions and signed package repository. Explain any conflict first.

Prepare one administrator procedure that saves changed configuration, checks
the package transaction, installs the supported packages, enables startup,
and configures bounded logs using the local logging driver. Keep my everyday
account and your account out of the docker group. Check the installed versions,
socket permissions, listeners, logging, and startup after a server reboot.
Give me the commands with the computer, account, expected result, and recovery
steps clearly identified. Save configuration and results in private GitHub.

Docker's Ubuntu installation guide and Compose plugin instructions are the references for those commands. Check the installed versions afterward; downloading an installer is only the start of the task.

Keep Docker control in your administrator account#

Controlling the usual Docker service effectively grants administrator access to the server. For example, someone who controls it can start a container that reads files from the host. Membership in the docker group grants that control. Docker's account guidance

Let your AI operator prepare and check Compose files in its own account. Initially, you run the reviewed installation procedure from your administrator account. Test that the AI operator's account cannot control Docker or change the protected installed configuration.

If repeated deployments later justify more automation, add a narrowly limited, independently reviewed deployment mechanism for those tasks. A prompt saying “only update Plex” cannot limit an account that actually controls the entire Docker service.

Try a small disposable application#

The first exercise starts a simple web page, checks it, restarts it, and removes it. This lets you see the workflow before using an application with valuable data.

Download the lesson script, its helper, and the Compose file into one folder on the server that only your administrator account can modify. Ask your AI operator to prepare the folder and download instructions for your chosen location and explain the script before you run it.

The published script SHA-256 is 4589ec3c878fae5162668af4bc2c266e307eefba37f21e2170b8eea38d47b3e8.

The Compose file’s current downloadable file hashes to 0749ed759da1741688320959ab78aaeb088239a0ac3c14eb626e40a31a5b91ae. These checksums let you verify that the downloaded files match this reviewed exercise. If they differ, investigate rather than replacing the expected values.

Prompt to paste:

Help me run the downloadable Compose lesson. Read the script, helper, and
Compose file, verify their published hashes, and explain their behavior.
Prepare a protected folder and a single command using its real absolute path
and the actual AI operator account whose Docker access should be denied.
Tell me to run it from my administrator session on the intended server.
Explain where to find its log and how to interpret success or failure.
Do not claim runtime tests passed until the script has run on that server.

The command will have this shape; have your AI operator supply the real path and account rather than copying the placeholders:

sudo /bin/bash /path/to/reviewed/run-compose-lesson.sh operator-observer

The page listens only on the server itself. The script checks the response, tests restart behavior and the AI operator's lack of Docker access, then cleans up its temporary application. It prints SUCCESS only after those checks and cleanup pass. If it stops, give your AI operator the existing log so it can explain the failure before proposing another action.

Make a short record for each real application#

Use the service readiness template. Have your AI operator fill in the technical details it can inspect. You supply the purpose, intended users, privacy preferences, and acceptable interruptions.

The record should tell a future session where the service runs, how people access it, where its data and credentials are stored, and how to update and restore it. Include the connections it needs, its memory and disk limits, and a normal user action that demonstrates it works. Keep credentials as references to their protected locations, not values in Git.

For example, Plex needs to read the media library, write its own settings and database, and use temporary space while converting video. It should not need to edit your personal documents or administer the router. That description helps your AI operator choose and test useful limits.

Choose where the application's files go#

Keep saved application data separate from the replaceable container. Ask your AI operator to show you which folder holds settings, databases, uploads, and other files you need to preserve. Add each to the backup plan before people depend on it.

Use separate space for household files and temporary work. A video conversion cache should have a limit so it cannot fill the disk holding an application's database. Give a media player read-only access to a library when it does not need to change the files.

Some applications expect Docker-managed volumes rather than ordinary host folders. Those can work too; have the AI operator demonstrate the supported backup and restore procedure for the volume. Do not treat an obscure location as someone else's responsibility.

For network storage, check that the application supports it. Some databases require filesystem locking or other behavior that the proposed share cannot provide reliably. Plex's configuration storage, for example, must support locking. Plex container documentation

Prompt to paste:

Prepare this application's storage from our service record. Identify all
persistent data, bulk read-only data, and bounded temporary paths. Verify
backing filesystem/source and ownership before startup. Use long bind syntax
with create_host_path: false where applicable, and separately verify that the
intended filesystem is mounted; directory existence is insufficient.

Check the application's documented database/locking requirements. Configure
its supported backup/export and test restoration to a disposable instance.
Include all protected paths in the installed backup job before accepting real
data. Keep secrets in protected files where the application supports them,
with recovery copies outside this host and no values in Git or your account.

On Linux, a missing mounted filesystem can leave an ordinary directory at the same path. Test that the application stops rather than writing into that directory on the OS disk. This is a Linux mount-path issue; it is not how Finder displays a disconnected share.

Check connections in both directions#

Decide who may connect to the application and what the application itself may contact. A service can have no public incoming port and still connect outward to devices in your house.

Have your AI operator test from another device, including one that should be denied. It should also check that the container cannot reach management interfaces or unrelated data it does not need. Docker changes the host's networking, so existing firewall rules alone are not enough to infer the result. Docker firewall documentation

Prompt to paste:

Prepare the application's network and permission limits from its service
record. Inspect the installed Docker firewall backend and both IPv4/IPv6.
Use separate project networks and an internal database network where suitable.
List required incoming ports and outgoing destinations. Test allowed clients,
denied clients, and attempts from a disposable container toward management,
backup, and unrelated service networks. Preserve local recovery during changes.

Review the complete merged Compose configuration, including overrides and
environment inputs. Flag privileged mode, host namespaces, Docker sockets,
broad host mounts, extra devices/capabilities, new ports, and secrets outside
the protected store. Explain any necessary exception before installation.

Install and test one release#

Have your AI operator read the application's official installation and update notes and prepare the complete configuration. Review what it will change, then run its checked procedure from your server administrator account. The installed configuration must be a protected copy of what you reviewed.

For an existing application, create a current backup before an update. Find out whether the new version changes its database format. If it does, returning to the old image may also require restoring the old database. Decide how to preserve any new work before taking that recovery path.

Prompt to paste:

Prepare one release using a pinned publisher image digest and the full merged
Compose configuration. Show the meaningful changes, data migrations, new
permissions/connections, and recovery procedure. Validate the configuration
without exposing secrets. Save the current release and create a supported
pre-update backup for existing data; verify a representative restore.

Prepare one administrator procedure that copies all reviewed inputs to a
root-owned directory your account cannot change, verifies hashes there, and
uses explicit Compose file/project/environment arguments from that directory.
Recheck storage, identities, capacity, and backup selection before applying.
Update only this project. Test startup, real client use, denied access, logs,
and resource use. On failure, stop and explain recovery choices. Save results
and commit/push configuration and records after the task.

Open the application from a normal household device. Sign in and do something representative: play a file, save a test record, or operate a test automation. Then restart the application and repeat. Schedule a server restart too, so you know the whole setup returns after power loss.

A health check or successful deployment command does not replace these checks. Add alerts for repeated crashes and failed backups. Let the normal service supervisor handle ordinary restarts; avoid adding competing restart scripts that hide the cause of a failure.

Give web applications a stable address#

A reverse proxy receives a browser request and forwards it to the right application. It lets several web applications share a server while using separate names and HTTPS.

If you already operate a suitable proxy such as Traefik, use it. For a new setup, this guide's simple example is Caddy running as a host service, with application web ports bound to the server's loopback address. Your AI operator should prepare its installation and the first route from the network and certificate plan, then test the name, HTTPS, login, and a request that should be denied.

Keep private services reachable through the home network or VPN. Making one public is a separate choice: identify the audience, login requirements, and functions that become reachable. A reverse proxy does not make an application's account permissions disappear. File sharing and other non-web protocols need their own access arrangements.

Add a shared login only when it helps#

Start with individual accounts in each application. Store the credentials in your password manager and test recovery. If several browser applications later make account management repetitive, a single sign-on service can reduce that work.

A product such as authentik can provide shared login, but it becomes another service to operate and restore. Have your AI operator integrate one application first, preferably through the application's native support. Test login, logout, removal of access, mobile clients, and what happens when the login service is unavailable. Keep your local server and recovery access independent of it.

For household accounts, grant the libraries, dashboards, and controls each person needs. Everyday use should not require the account that administers the whole server. If an application offers child profiles or restrictions, choose them according to your household's needs and test them from the devices children actually use.

Set up Plex and test playback#

Plex can send a file unchanged when the playback device supports it. That is Direct Play. It may repackage audio/video without converting them, called Direct Stream, or convert them, called transcoding. Transcoding can demand much more processor or GPU work, and subtitles can trigger it too. Plex playback overview

Begin with the hardware you chose and your actual TVs, streaming boxes, phones, and browsers. While a file is playing, open Plex's activity dashboard and expand the playback details. Ask your AI operator to help interpret whether the video and audio are playing directly or being converted. Test your usual subtitles as well as different files.

If playback buffers, compare that information with server load and network performance. Only consider conversion hardware after those checks show the server cannot sustain the transcoding you need. Have your AI operator check current Plex compatibility and subscription requirements before proposing a purchase.

Prompt to paste:

Set up Plex using its supported image and a pinned release digest. Put /config
on storage that meets Plex's locking requirements and back it up. Mount media
read-only, limit transcode scratch space, and use only the ports needed by our
clients. Keep claim tokens and other credentials out of Git; remove temporary
claim credentials after setup. Add a GPU device only after playback testing
justifies it and the supported device mapping has been checked.

Walk me through playback on our actual clients and interpreting the dashboard.
Test audio formats, subtitles, concurrent use, restart, and a disposable restore
of Plex state. Record whether each representative case direct plays, streams,
or transcodes and what causes any buffering.

For remote playback, measure your home upload speed and test from outside the house while someone else is using the connection. Leave capacity for calls, backups, and administration. Use your VPN where the client supports it. If you enable Plex's public remote-access feature, understand that its web administration shares the server endpoint; a different hostname does not isolate those functions. Protect the owning account and test what an ordinary user can access. Check Plex's current remote-access instructions before configuring the router.

Set up Home Assistant for the devices you want to use#

For home automation, this guide uses Home Assistant OS on supported dedicated hardware, or a dedicated virtual machine if you already have a suitable virtualization setup. It provides the supported installation and managed updates. Follow the Home Assistant installation guide with your AI operator for the hardware you choose.

Start with a concrete device or routine, such as turning off a group of lights. Add and test that integration before importing a large collection of automations. Give household members the controls they need and keep an accessible manual way to operate the devices when Home Assistant is unavailable.

Home Assistant Container is another supported option, but you take on more of the surrounding services, device connections, updates, and backups yourself. Ask your AI operator to explain that maintenance before choosing it. Avoid giving a general application container broad access to the host just to make device discovery work.

Set up automatic backups outside the Home Assistant device and save its recovery key independently. Test restoring to a spare or disposable instance. For locks, heating, leak controls, and alarms, check the manufacturer's independent controls and recovery methods. Use the AI operator to help prepare and inspect automations; do not let its conversational guesses directly operate consequential controls.

Add media organization tools one at a time#

If you want automated organization, tools such as Radarr and Sonarr can manage movie and television libraries and coordinate with a download client. Add only what supports your intended workflow, using material you are authorized to obtain and share.

Have your AI operator plan the folders and accounts together. The downloader should write its download area; the importer should organize its intended library; Plex should read that library. Test an import with disposable files and confirm that it does not duplicate large files unnecessarily or change unrelated libraries.

Prompt to paste:

Plan consistent media paths and service identities for the selected importer
and downloader. Where hard links are intended, use the same filesystem and
consistent parent mount; verify links and ownership inside the actual containers.
Limit each process to its required download/library paths, and bound scratch
space and bandwidth. Do not widen permissions to hide path or UID/GID errors.
Back up application configuration and test a representative import and restart.

If a download workflow uses a VPN, scope it to that downloader. Keep Plex, Home Assistant, and server administration on their intended connections. Ask your AI operator to test that the downloader loses external connectivity when its tunnel stops and resumes after it returns. A VPN icon alone does not demonstrate that behavior.

Share selected files with another household#

Treat file transfer separately from media streaming and backup. Decide which files the recipient may receive, whether transfers need to resume, and how much upload bandwidth they may use. Give the recipient a dedicated revocable account with access to a limited export folder. Test that it cannot alter the source library or reach administration and backup storage.

Save what you learned#

After each application works, commit and push its configuration, account references, connection settings, backup procedure, and test results. Record where it can grow, what consumes temporary space, and how you would remove it while saving any data you still want.

Keep the work scoped to the applications you selected. Continue to operations and recovery to arrange ongoing checks, updates, and recovery practice.