Hacker News user replaces Hetzner VPS with rooted CMF Phone 1 for home server

A contributor on Hacker News has successfully repurposed a CMF Phone 1 into a personal home server, replacing a dedicated Hetzner VPS to host a suite of web applications and remote services. The decision to migrate was driven by the escalating costs of dedicated CPU machines required for resource-intensive workloads, alongside a market environment characterised by high DRAM prices that made new hardware purchases unattractive. By utilising an existing device, the user eliminated recurring monthly fees while retaining a robust computing environment.

The CMF Phone 1, equipped with eight ARM cores, 8 GB of RAM, 128 GB of flash storage, Wi-Fi 6, and a 5G modem, initially faced challenges when the user attempted to install postmarketOS. Driver incompatibilities resulted in a black screen and non-functional peripherals, prompting a return to stock Android. This pivot recognised that the native operating system already possessed the necessary drivers for hardware acceleration, power management, and connectivity, allowing the device to function as a stable base for Linux applications through Termux.

To address performance latency, particularly for the Surf remote browser workload, the device was rooted to utilise a native chroot for Linux applications. This approach bypassed the performance overhead associated with userspace translation layers like PRoot, enabling the Chrome browser to execute efficiently. The system management is automated via Ansible, which handles service definitions, power settings, and deployments from a private repository, ensuring that the infrastructure remains reproducible and state-driven.

Ingress is managed through Cloudflare Tunnels for public HTTP services and Tailscale for secure administrative access. This configuration allows the server to remain reachable regardless of network changes, supporting the user’s requirement for mobility. The setup includes a custom observability dashboard accessible via https://dash.cmf, which monitors CPU, memory, storage, battery, and service health, providing visibility into the system’s operational status without requiring direct SSH access.

Secrets are managed securely using Ansible Vault integrated with a 1Password SSH agent, ensuring that private keys are not stored on the device. The user notes that while the setup is not a substitute for a dedicated workstation with a GPU, it offers a quiet, battery-backed, and cost-effective solution for personal infrastructure. The migration demonstrates how mobile hardware can be leveraged to reduce dependency on traditional cloud hosting providers when specific performance and security requirements are met.