Every January 2nd or 3rd, once the leftover something-with-potatoes is gone from the fridge, I do the same thing I've done for probably a decade now: I SSH into the home server and start poking around at everything I let rot for the last twelve months. This year it was the 3rd, because on the 2nd I was still lying on the couch pretending the holidays weren't over.
I'm not going to pretend this is some elegant system. It isn't. It's a running list of half-remembered commands and grudges against my past self. But every year at least one person emails me asking how I "maintain" the little Debian box under my desk, so here's this year's version, warts included.
Step one: docker system prune and immediately regretting it a little. I run about 19 containers on that machine right now (Jellyfin, a Postgres instance for a hobby project, Pi-hole, a couple of things I built and forgot the purpose of). Every year I forget just how much dangling image cruft piles up, and every year the prune command reports back something absurd, this time it clawed back 41GB. Forty-one gigabytes of layers from images I rebuilt a dozen times testing something in March and never cleaned up. I don't actually love that Docker makes this so opaque by default — you basically have to remember to ask it, on a schedule, or your disk just quietly fills up until something falls over at 2am. Mine did, once, in 2022. Woke up to Pi-hole down and half the house convinced the internet was broken.
Step two: actually reading my crontab instead of just skimming it. This is the part I always skip and always regret skipping. I've got jobs in there going back to God knows when, including one line that, as far as I can tell, backs up a directory that stopped existing sometime around 2021. crontab -l this year turned up eleven lines, and I could confidently explain the purpose of maybe seven of them without looking anything up. That's not great! If you run any kind of home server, I'd genuinely recommend just sitting down once a year and reading the whole file top to bottom, out loud if you have to, until every job makes sense again. It takes twenty minutes and it's oddly satisfying, in the same way cleaning out a junk drawer is.
Step three: SSH keys. I keep a authorized_keys file that, this year, had six entries. One was from a laptop I sold on eBay back in 2023 and clearly forgot to revoke access from. Nothing bad happened, as far as I know, but that's a pretty flimsy thing to hang your peace of mind on. Pulled it immediately.
Step four, and this is the one I'll actually argue with you about: I do not trust unattended-upgrades on a home box, and I never have. I know plenty of people swear by it and I get the logic, patched is safer than unpatched, sure. But I've had it silently restart a service mid-upgrade and break a config file in a way that took me forty minutes to untangle on a Tuesday night, and after that I switched to just doing apt update && apt list --upgradable manually every couple weeks and applying things myself when I have ten minutes to actually watch it happen. Slower, yes. But I'd rather be the one holding the wrench when something goes sideways than find out from an angry family member that the DNS is down.
None of this is glamorous work and none of it makes for a great "look what I built" post. It's just maintenance, the unsexy kind that nobody writes tutorials about until they've been burned enough times to bother. If your server's been quietly running since last January without you looking at it once, it's probably fine. Probably. But take the twenty minutes anyway. Read the crontab. Prune the images. Check who still has keys to the place.
I'll be back in this same spot doing the same thing next January, forgetting the same lessons in between. That part I'm fairly confident about.