A home LAN server: Mini PC, Linux, PHP, Python, and Home Assistant
A services server next to Home Assistant
Home Assistant is designed for home automation. Separate web applications, databases, and recurring Python jobs are often easier to maintain on a dedicated LAN server. This series builds that server on a small x86 Mini PC and then shows three distinct communication paths to Home Assistant.
Updated stack
- Hardware: Mini PC with SSD and Gigabit Ethernet
- Operating system: Debian 13 “Trixie”, the current stable release in August 2026
- Web server: Nginx with PHP 8.4-FPM from Debian's official repositories
- Scripts: Python in per-application virtual environments
- Scheduling: systemd timers with journal logging
- Home Assistant: MQTT Discovery, REST API, or HA-triggered SSH/REST calls
There is no honest universal power figure for “a Mini PC.” CPU, firmware, SSD, memory, and load all matter. Measure the actual device over representative workloads before estimating running cost.
The five-part series
1. Hardware and base installation: choose a Mini PC, install Debian 13, test SSH keys, and configure updates and a firewall. Read the article
2. Nginx and PHP 8.4-FPM: install packages, create a server block, route PHP safely, and align upload limits. Read the article
3. MQTT: publish measurements and Discovery configuration from Python. Read the article
4. REST: read states and call Home Assistant actions. Read the article
5. Automation: let Home Assistant start a tightly scoped server job. Read the article
| Task | Suitable route | Key concern |
|---|---|---|
| continuous measurements | MQTT Discovery | retain policy, availability, unique IDs |
| read a state or call an action | REST API | protect token, use timeouts, handle HTTP errors |
| HA starts a server job | SSH shell_command or HTTP rest_command |
restrict permission to one job |
The approaches can work together: an automation can start a backup, which later reports completion through MQTT.
Security boundary
“LAN only” is not authentication. Every service needs its own access control, secrets stay out of repositories, and this series requires no router port forwarding. Use a VPN for remote access and store backups on a second system or medium.
