HomeHub

What is HomeHub?

HomeHub is an Ubuntu/Debian server we install and configure directly in your home or office — your own, fully independent "home cloud." No third parties, no subscriptions, no external Chinese, American, or Russian servers holding your data.

What's included

A set of proven, time-tested open-source systems, covering:

• Smart automation — scenes, sensors, energy monitoring, notifications
• Personal cloud — files, photos, calendar, contacts
• Media server — movies, shows, music
• Digital archive — searchable documents, cold storage
• Telephony — your own phone system (VoIP)
• Video surveillance — local motion detection

Everything runs behind a MikroTik router with WireGuard VPN — secure remote access to your home from anywhere, without exposing anything publicly on the internet.

Product structure

1. Ubuntu/Debian server — the heart of the system
2. MikroTik — network router with firewall and VPN
3. WireGuard — encrypted tunnel for remote access
4. Open-source containers — proven systems for each function, each in its own isolated Docker container

What is MikroTik?

MikroTik is a brand of professional networking devices (routers), known for reliability and flexible configuration. It's the "gateway" of your home network to the internet — controlling what traffic goes in and out, and the foundation the whole system's security is built on.

What is WireGuard?

WireGuard is a modern VPN protocol — it creates an encrypted "tunnel" between your device (phone, laptop) and your home. It's as if you were physically there, wherever you actually are — without exposing anything publicly on the internet.

What does "full automation" actually mean?

For most people, "smart home" mainly means turning lights on and off from a smartphone. The real added value, though, is devices reacting to each other on their own, without human intervention. Three examples from practice:

• Window and heating control — a window sensor detects it's open, the smart radiator thermostat automatically stops heating. No heat wasted on an open window, without anyone needing to remember.
• Smoke detector with instant alert — when smoke is detected, the occupant gets an instant smartphone notification — whether at home or elsewhere.
• Water detection with automatic shutoff — a water sensor detects incoming water and simultaneously triggers a notification and automatically closes the motorized main water valve — before serious damage occurs.

These exact connections — the sensor detects, the system reacts, the person is only notified when needed — are the real essence of automation, far beyond simple on/off lighting.

Telephony: a two-tier VoIP concept

For households — since the majority of German households use a FritzBox, ITCustoms enables the official FRITZ!App Fon app combined with the existing WireGuard tunnel. Your smartphone reaches the FritzBox as if it were on the home network — your landline number is reachable on the go, with no extra server component and no additional cost.

For businesses — where extensions, call queues, and complex call routing are needed, ITCustoms supports a local phone system (PBX) connected to the existing FritzBox — full classic phone-system functionality, without calls passing through a foreign data center.

Internal communication

For chat, voice, and video calls between sites or staff, a self-hosted chat and video platform is used, backed by a local TURN/STUN server — communication data never leaves the client's own infrastructure, unlike solutions relying on third-party services. Combined with the WireGuard tunnel, it's usable on the go too.

Security model: Defense-in-Depth

Every infrastructure installed by ITCustoms follows a multi-layer security model, where each layer is controlled independently and only the system's owner decides on access:

• Local network with no public exposure — core services are only reachable within the local network via internal DNS names — no port-forwarding, no publicly discoverable domains.
• Controlled WiFi access (MikroTik Hotspot) — WiFi access goes through hotspot authentication with individual credentials set exclusively by the client.
• Zero-Access remote support (WireGuard) — by default, ITCustoms has no standing access to the client's infrastructure. Remote support happens exclusively through a WireGuard tunnel with clearly defined, time- and function-limited permissions — activated by the client or at their explicit request.
• Transparency log — every remote action taken is logged in a simple, client-visible record (e.g. "performed Docker update", "ran archive drive diagnostics").

Minimal data footprint

The ITCustoms website deliberately has no registrations, tracking cookies, or personal data collection. Internally, only a simple, QR-code-organized equipment inventory is maintained (installed hardware per site), so a broken part can be replaced quickly. This inventory contains only technical device data, never sensitive client information.

Either way you look at it: our clients' data never leaves their own premises — no copy on foreign Chinese, American, or Russian servers, no "cloud subscription" with fine print. Data sovereignty in the most literal sense: the server sits with the client, not somewhere out in the world.