For weeks, my ancient Mac Mini home server had been sluggish, but personal time was always booked with wife and kids projects so I never had time to look into it. Then, while planning firewall and server upgrades at the end of July for Delta Township Utilities, I remembered the CMS installs on that old box of mine were overdue. I ran the updates. The CMS crashed… hard… That was the best and worst thing that could have happened.
Diagnosing the issue in a time efficient manner meant enlisting Claude, Copilot, and Gemini, and together we found something worse than a crash: a full root compromise, probably dating back to May or June. The way in? Embarrassingly, a reused password on the CMS (Yes, sometimes your tech people reuse passwords and even write them down on sticky notes). SSH being the most obviously dangerous path inside had a fresh, strong password but on the CMS’s I’d figured the worst case was cleaning up spam posts. Turns out admin access plus outdated software is all a hack script needs to inject a web shell then move laterally across the filesystem as the php user. Honestly, I thought web shells were still just a novelty used on April 1st web pranks. It’s only luck (and probably obscurity) that the rest of my ancient home networking devices were spared (no one’s putting a web shell on a Nintendo 3DS with a web server).
Anyway, I lost. The hackers had taken over and zombified my server. I was devastated. Then ANGRY! No one comes into my house and uses my server on their botnet! Time for extreme action: server off, disk pulled, maintenance page up on another piece of hardware (that 3DS was earning it’s keep tonight) with a 3am “fighting hackers” AI photo.
Here’s the part I didn’t see coming. By this point, those wife and kids projects had progressed to hospital time for what would become a two-week stay. Her parents had our kids but I was stuck working my day job and couldn’t visit her until the weekends. I had just enough time to get this restored! I grabbed a spare SSD, installed Ubuntu LTS, and started with Webmin. It turned out to be a solid admin tool, but the wrong job for websites on it’s own. Just when I was about to format and start over with HestiaCP (my backup plan), I decided to run a little AI experiment. I’d only ever run AI tools on my desktop, but OpenCode has a “terminal user interface”. I figured if it was competent enough to do coding work on Steam games and Windows config files, maybe it could handle a web server. I already had to format away Webmin; what did I have to lose?
Within hours: a clean, hardened baseline. Within a week: majority of the old sites were cleaned and migrated. Then we had scripted routine tasks the models could run and report on to be proactive. Within a month: we had a chat server running so I could talk to it from my phone. Within two months: multiple AI agents with delegated jobs, running on a $10/month OpenCode Go LLM plan.
The box that got me hacked became the birthplace of my home AI fleet. Desperation, meet inspiration.
Leave a Reply
You must be logged in to post a comment.