NixOS appliance · Open source
The whole homelab, on one box.
Pocket Box turns a spare PC into a home server running Pocket Core and 50 Pocket apps. Boot the installer from a USB stick, pick a disk, reboot. Then open pocket.local from your phone.
x86-64 PC with UEFI · TPM 2.0 recommended · MIT licence
From USB stick to signed in
- 1
Boot the installer
Write the ISO to a USB stick, boot the PC from it and run pocket-install. Pick the disk, type its name twice, and it installs. No network needed: the finished system is already on the stick.
- 2
Open pocket.local
From a phone or laptop on the same network, open http://pocket.local and install the box’s certificate once. The page has the steps for iPhone, Mac, Android and Windows.
- 3
Create your account
The first account in Pocket Core becomes the admin of Core and of every app. Everyone you add later gets their own space in each app.
- 4
Finish the wizard
Time zone, Ethernet or Wi-Fi, Tailscale and a console password, in one short setup. Skip it and everything waits under Settings → System.
Built like an appliance
Nobody has to open a setup screen for the services underneath, and nobody has to remember to update it.
HTTPS on every app
Each app lives at https://<app>.pocket.local behind Caddy, with certificates from the box’s own certificate authority. Names are announced over mDNS, so there is no DNS to set up.
One sign-in
Every app has “Sign in with Pocket Core”. One account per person, with passkeys, across all of them.
Media services, already set up
Jellyfin, Navidrome, Immich and the ONLYOFFICE Document Server come configured on first boot, and every person gets their own account and key in each.
Nightly updates that undo themselves
At 4 a.m. the box installs the newest release, waits for every app to report healthy, and switches back on its own if anything does not come up. A bad release is never tried twice.
Encrypted with the TPM
On a PC with TPM 2.0 the disk is encrypted with LUKS2 and unlocks itself at boot. A recovery key is shown once, for the day the motherboard changes.
Every app on its own
Each app is its own systemd service under its own user, with its data in its own folder, listening only on loopback. Caddy is the only thing on the network.
Reach it from anywhere
Tailscale is installed and waiting: log in from the setup wizard with a link or an auth key, and the box joins your tailnet.
Declared, not configured
The whole system is one Nix flake. Apps are pinned to their release tags, built from source, and tested in a VM install before a box ever sees them.
What is on the box
Pocket Core and 50 Pocket apps, each at https://<app>.pocket.local, and the open-source services some of them sit on top of.
- Core
- Hub
- AI
- Flows
- Alerts
- Watch
- Music
- Photos
- Podcasts
- Audiobooks
- Library
- Bookshelf
- Reader
- Radio
- Requests
- Subtitles
- Guitar
- Notes
- Tasks
- Calendar
- Contacts
- Mail
- Documents
- Files
- Office
- Draw
- Clips
- Money
- Invoicing
- Split
- Garage
- Inventory
- Wishlist
- Day
- Habits
- Health
- Movement
- Still
- Kitchen
- Travel
- Learn
- Horoscope
- Projects
- Time
- Review
- PR Review
- Blueprint
- Database
- Monitoring
- Backups
- Network
Services set up for you
| Service | Used by |
|---|---|
| Jellyfin | Pocket Watch, Pocket Subtitles |
| Navidrome | Pocket Music |
| Immich | Pocket Photos |
| ONLYOFFICE Document Server | Pocket Office |
Each one can be switched off. Media lives in /srv/media: movies, TV, music, books and audiobooks.
Tools the apps need, already there
- OCRmyPDF and Tesseract in 16 languages for Pocket Documents
- yt-dlp and ffmpeg for Pocket Podcasts
- ffsubsync and alass for Pocket Subtitles
- restic and rclone for Pocket Backups
Build it yourself
Everything is declared in one Nix flake, so the image you build is the image that ships. You need Nix with flakes on x86-64 Linux. Try the whole box in a VM before you touch a real disk.
Every change runs a full install in a VM with a software TPM: install, unlock, sign in to Core, check every app over HTTPS, then an update that must succeed and one that must roll itself back.
# the installer image
nix build .#iso
# the whole box in a VM
nix run .#vm
# → http://pocket.localhost:8080
# a single app
nix build .#habitsStill to come
- Installing the certificate from the Pocket Homelab app during pairing, instead of from the landing page
- The pocket.local names on the move, not only on the home network
- Boot counting, so a release that does not boot rolls back without a trip to the boot menu
- ARM images, Secure Boot, and Sign in with Pocket Core inside Jellyfin and Immich themselves
Pocket Homelab
Pair your phone in one scan.
Pocket Homelab for iPhone and Mac pairs with Pocket Core with a QR code and receives every service on the box, with its own token for each.