Autor: Jakub Rusinowski · Ostatnia aktualizacja: 10 lipca 2026
A local LLM home server runs Ollama on one always-on machine and makes it reachable from your phone or laptop anywhere through Tailscale — no opened ports, no cloud accounts touching your prompts. Thi
A local LLM home server runs Ollama on one always-on machine and makes it reachable from your phone or laptop anywhere through Tailscale — no opened ports, no cloud accounts touching your prompts. This guide sets up the server, a proper chat UI, multi-model serving, and secure remote access in about an hour.
Last Updated: July 2026
One box in a closet runs your models 24/7; every device you own talks to it over an encrypted private network. This differs from our Setting up a Local API guide in scope: that one exposes an endpoint on localhost for your own scripts — this one turns the machine into a persistent, multi-model service for all your devices, anywhere.
The non-negotiable: never port-forward Ollama to the internet. The Ollama API has no authentication — anyone who finds the port can run your models, delete them, or pull 100GB of new ones onto your disk. Internet-scanning bots find exposed 11434 ports within hours; this is exactly what a mesh VPN like Tailscale is for.
Any machine that runs your target models works; always-on duty changes the priorities toward idle power and silence:
Install Ollama, then make it listen on all interfaces so other devices can reach it (Tailscale will provide the security boundary):
# Linux (systemd) - set the env var on the service
sudo systemctl edit ollama
# add:
# [Service]
# Environment="OLLAMA_HOST=0.0.0.0:11434"
# Environment="OLLAMA_KEEP_ALIVE=30m"
sudo systemctl restart ollama
# macOS - set for the app and restart it
launchctl setenv OLLAMA_HOST 0.0.0.0:11434Pull a small stable of models rather than one giant one — a home server shines by having the right tool loaded per task:
ollama pull llama3.1:8b # general chat
ollama pull qwen2.5-coder:7b # coding questions
ollama pull qwen2.5:14b # heavier reasoning, if RAM allowsTwo environment variables control multi-model behavior: OLLAMA_MAX_LOADED_MODELS (default fits what VRAM allows; Ollama swaps models in and out on demand) and OLLAMA_KEEP_ALIVE (how long a model stays warm — 30m is a good server setting; the default 5m causes cold-start waits between sessions).
Open WebUI gives every device a ChatGPT-grade interface — chat history, model switcher, document upload/RAG, and its own login layer:
docker run -d -p 3000:8080 \
--add-host=host.docker.internal:host-gateway \
-e OLLAMA_BASE_URL=http://host.docker.internal:11434 \
-v open-webui:/app/backend/data \
--name open-webui --restart always \
ghcr.io/open-webui/open-webui:mainOpen http://localhost:3000, create the admin account, and confirm your models appear in the dropdown.
Tailscale builds a WireGuard mesh between your devices — every machine gets a stable private 100.x.y.z address that works from any network, with zero exposed ports. The free tier covers this entire use case.
# On the server (Linux; Mac/Windows: install the app)
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
# Note the server's tailnet address
tailscale ip -4 # e.g. 100.101.102.103Install the Tailscale app on your phone and laptop, sign into the same account, and you're done: from anywhere in the world, http://100.101.102.103:3000 (or the MagicDNS name, like http://homeserver:3000) opens your private ChatGPT.
Optional polish — serve it over HTTPS with a trusted certificate inside your tailnet:
tailscale serve --bg 3000
# now available at https://homeserver.your-tailnet.ts.nethttp://your-server:11434, which is now reachable over the tailnet.base_url=http://your-server:11434/v1 — the patterns from the local API guide apply unchanged, just with the tailnet hostname.ollama --version vs releases monthly; Open WebUI updates via pulling the new image. Set a calendar reminder — self-hosted means self-patched.ollama list and prune quarterly, or you'll discover a full disk the hard way (disk-space troubleshooting).docker volume backup or the built-in export covers it. Models need no backup — they re-pull (or see moving models between machines).Put both devices on a Tailscale tailnet, run a UI like Open WebUI on the server, and open the server's tailnet address from the phone. You get encrypted access from any network without exposing a single port to the internet.
On your home Wi-Fi, plain OLLAMA_HOST=0.0.0.0 plus the server's LAN IP works fine. Tailscale adds the "from anywhere" part — cafe, office, mobile data — with the same address every time, plus encryption on untrusted networks. WireGuard by hand achieves the same with more effort.
Yes. Open WebUI supports multiple accounts, and Ollama queues concurrent requests (set OLLAMA_NUM_PARALLEL to serve several at once if VRAM allows). For a household it's perfect; past ~5 truly concurrent heavy users you want vLLM-class serving instead.
A Mac Mini class machine: $1–3/month in electricity. A big-GPU tower: $8–17/month, dominated by idle draw. The electricity cost guide has per-tier tables and the settings that cut it down.