By popular demand from this post, here’s the write-up for my version of that travel server.
The travel server is shown with the, currently, bare 5V UPS board to its right. One day I hope to have a 3D printed case for both of those, but they’re currently separate as my 3D modeling skills are basically non-existent. The power cable is wrapped in aluminum foil and then wrapped in electrical tape due to EMI from the wifi adapter causing random glitches. A ferrite bead would probably solve that more elegantly, but I didn’t have any on hand so made due with what I have.
Hardware
- Banana Pi M4 Zero
- 1.5 GHz Quad Core ARM
- 4 GB RAM
- 32 GB eMMC
- 1 TB Samsung PRO Plus SD Card (bought before prices went nuts)
- Li-2B UPS Board + 2x 3,000 mAh 18650 batteries
- USB-C to USB-A 90 degree angle adapter
- USB Nano Wifi adapter
- Note: Unlike the Pi Zero, these have two USB ports. One is configured in host mode and the other in peripheral mode.
Features and Capabilities
- Multiple wifi clients can use this for network access
- Multiple “WAN” options
- Multiple VPN connections (OpenVPN, Wireguard, IPSEC) e.g.
- Privacy VPN for general internet traffic
- Wireguard to connect back to home network
- Ad-blocking via PiHole
- Locally-hosted web applications with valid hostnames and valid SSL certs (via Let’s Encrypt).
Travel Router / Access Point
For internet uplink, there are multiple options depending on need. By default, the internal/bulit-in wi-fi is the internet uplink and the USB wi-fi adapter is the client-facing AP interface. This is how I normally keep it configured in my use-cases.
Alternatively, the built-in wi-fi can be used as the client-facing AP and the uplink to the internet can be provided by a USB-tethered smartphone or a USB ethernet adapter or the internet uplink can be omitted entirely and either the USB or built-in wifi adapters can serve clients. Fortunately, the built-in wifi chip in the Banana Pi works well in AP mode but that’s not always the case (cough Orange Pi Zero W2 cough).
If a PC is connected to USB0 (the OTG port), the device will act as an ethernet gadget. The travel server will add its end of the usb0 interface into the LAN bridge along with the client-side AP. This means the connected PC will be on the same LAN as the wireless clients.
It’s also possible to add a USB ethernet adapter and bridge it into the LAN side as well.
Depending on configuration, a small USB-C hub may be needed. I’ve got one that includes a USB A port, ethernet port, and additional USB C port.
VPNs can also be configured as needed. I’ve got a privacy one that can route all traffic as well as a Wireguard one that connects back to my home LAN when I’m using it remotely.
DHCP and DNS are both provided by PiHole
Reverse Proxy
All applications hosted on the travel server are fronted by Nginx and use valid Let’s Encrypt certificates. This eliminates the need to install a custom CA cert in end devices or have the clients accept an untrusted self-signed cert.
This also ensures all applications are protected by TLS which is required for full functionality of some applications.
How does that work?
The hostname of the travel server (mobile) is a subdomain of my personal, project domain (mydomain.xyz). All applications are a subdomain of that (e.g. application.mobile.mydomain.xyz), and I simply request a wildcard cert from Let’s Encrypt for *.mobile.mydomain.xyz. Currently, Let’s Encrypt requires the use of DNS validation when requesting wildcard certificates.
Movies/TV
Movies and TV shows are provided by Jellyfin and are stored on the 1 TB SD card. I’ve tested 4 simultaneous streams, and the travel server didn’t even break a sweat. Granted, it’s not transcoding anything so I believe I’m mostly limited by USB, wifi, and/or SD card bandwidth in that regard.
For reliability, the Jellyfin database is stored on the internal 32 GB eMMC rather than the SD card. This both reduces wear and tear on the card as well as proves to be more reliable.
CPU transoding is a non-starter, and the GPU drivers for these boards isn’t exactly well supported. The GPU drivers also rely on V4L which Jellyfin has deprecated for hardware transcoding, so I opted to forego transcoding entirely.
To load movies/TV shows on here, I pre-process them with ffmpeg in the following way:
- Scale to 720p to reduce space
- Encode to H.264 in an MP4 container (including subtitles as
mov_textif available) in yuv420p pixel format to avoid the need for remuxing or transcoding - Map only the English audio and subtitle streams to further save space
Music
Music is provided by a combination of MPD and Snapcast and the library is also stored on the 1TB SD card.
MPD manages the music collection while Snapcast allows synchronized multi-room audio and connecting receivers via wifi.
For local playback, I use myMPD web UI and use its streaming feed or use the MPD and Snapcast clients on the end device. There’s also a Snapcast client installed on the travel server itself, so if you add a USB speaker it can playback music directly.
Books
It runs Calibre-Web to manage my book collection which is also stored on the 1 TB SD card.
Development
The travel server runs CodeServer which is an un-Microsofted web-based version of VSCode. You can set that up however you want, but I’ve got it setup for:
- React / NextJS development
- Python development
- ESP8266/ESP32 development with Platform.io
Other services it runs to facilitate development include:
- NodeJS and Bun
- Postgres (via Docker)
- Mosquitto MQTT
- Redis
- CouchDB
- NodeRED
Offline Knowledge
Kiwix is installed with a large selection of ZIMS for offline reference.
- DevDocs for React, Bun, NodeJS, ExpressJS, NextJS, etc. Pretty much every major libarary and framework I work with has offline docs
- Full text Wikipedia dump with images (approx 130GB)
Search
I installed SearxNG so I always have an ad-free, AI-free, no BS search engine available.
File Sharing
The travel server has a few different ways to share files:
- Samba (SMB) shared folder
- PairDrop for quick and easy one-to-one local sharing in the browser or phone app
- SSHFS (alternative method of accessing the SMB shares
Future Plans / Not Yet Implemented
- Add data passthrough to the UPS board so a host PC can charge the UPS/power the travel server while also enumerating it as a USB ethernet device. Currently the UPS board only passes power.
- Set up captive portal so Android (and probably Apple, too) devices don’t freak out if there’s no internet uplink. Currently requires an annoying “Stay connected to this network” and enabling airplane mode so that DNS will work over the wifi connection if there’s no internet uplink available.
- Make a web UI to manage services/configs. Currently, config changes require SSH-ing in and modifying the config directly. I do have preset configs for different “modes” but you still have to swap them around by hand.
- Design and 3D print a case that can hold the UPS board and the travel server itself while allowing the travel server to be “ejected” (basically I imagine it slotting into it from the outside and connecting to fixed USB and mini HDMI connectors embedded in the case).
made due
made do?
I travel a few times a month for work. My main concern would be losing that, and thinking either what personal info I’d have there or what access it would give to a malicious party. I travel to somewhat hostile countries so my main risk scenario is someone confiscating my devices at border upon entry. That’s why I dont carry the flipper zero around, ever.
I have a beryl travel router which does wireguard to home and mullvad. I also have a broken samsung phone, which I use in dex mode to access services on hotels’ tvs. Minimal setup needed.
What is Dex mode?
Thats samsung’s marketing term for the desktop mode on their selected flagship phones. I have an old s23 with screen a bit cracked, but that doesnt really matter because only use I have it for is to connect that to the hotels’ televisions. I carry it turned off when traveling so its encrypted before pin entry.
This is great, I’d love to see the config files - especially the WiFi pass through stuff. No experience with that! But the rest all fitting together would be rad as hell.
Peeps would be able to get the 4GB banana zero and just rock it up quick full service!
I know that’s a big ask, sharing your cursed config files is work… if you feel up for it tho - hell yes
Please upload to codeberg
It’s kind of a mix of things duct-taped together, but here’s the gist of what controls what. If you want to see any specific configs, let me know.
Network Manager controls the “static” interfaces. I’ve got some udev rules for my known hardware (USB wifi/ethernet adapters) so that they get friendly names as opposed to ugly “predictable” names.
The interfaces managed by NetworkManager are:
- STA mode Wi-Fi (internet uplink)
- LAN Bridge
- Wired Ethernet (internet uplink)
Connecting a USB-tethered smartphone is pretty plug and play. It automatically gets picked up as a USB ethernet interface, receives its IP address from DHCP, and gets set as the default gateway. So there’s nothing that needs to be configured when using that as the internet uplink other than making sure there’s no other active gateway that might interfere.
The LAN segment is a generic Linux bridge called
br-lan(I’m borrowing OpenWRT’s naming convention). In normal operation, it haswlan1andusb0as members (AP and USB ethernet gadget, respectively). If I need a wired ethernet port on the LAN side, I just plug a USB ethernet adapter in and add it withbrctl addif br-lan eth{XXX}The
usb0ethernet gadget interface is brought up using a script that runs at boot via systemd to configure alibcompositeethernet gadget before the network target. This ensures it’s available when the network comes up so it can be successfully added to the LAN bridge.When changing out of the default configuration, I just go into network manager to enable/disable the correct interfaces. e.g. If I want to use wired ethernet for uplink and internal wifi for client AP, I enable the wired ethernet and disable the internal wifi’s connection to the router. Then I swap hostapd conf files to use the one configured for the internal wifi instead of the USB one and update the members in the LAN bridge accordingly. e.g.
brctl delif br-lan wlan1 ; brctl addif br-lan wlan0To add a LAN-side wired ethernet, I just make sure it’s not already configured for “WAN” in NetworkManager and add it to the LAN bridge. That, or setup a VLAN interface and use a single USB ethernet adapter for both (haven’t done that on this device but I know it works from having done that in the past).
Thankfully, PiHole exposes the DHCP controls for its underlying
dnsmasqand since I’m already running PiHole for ad blocking and DNS, it was natural to also use it for DHCP. It’s configured to advertise addresses to thebr-laninterface only.Routing/NAT is all done directly with
iptables. The VPNs dynamically update it as they connect/disconnect using theirupanddownhook scripts, and for the NAT used for client connections, it’s basically justiptables -t nat -A POSTROUTING -s $SOURCE_CIDR -o $OUT_INTERFACE -j MASQUERADEwhereSOURCE_CIDR=192.168.5.0/24is the LAN segment address range andOUT_INTERFACE=wlan0is the uplink interface (in the default configuration).I’ve got some ugly scripts to adjust the NAT rules depending on which interface is currently acting as the “WAN” interface.
Thanks for the write up, again! I def gotta up my NetworkManager game…
Great project. One risk I see (and faced in the past) is dying sdcards. They hold up much less overtime compared to ssds. Did you face this before? I have gotten a bunch a corruption on my dbs, and even filesystems (ext4). SDcards are vulnerable especially if running 24/7. I wonder if there are better tiers or better solutions.
I addressed that in a few ways:
- I bought a quality SD card to start with. A 1 TB card is a lot of eggs in one basket so I wasn’t about to cheap out on that part.
- The board has 32 GB of eMMC which is where the OS is installed
- There are very few writes to the SD card during normal operation (after initially loading content onto it). Running data (DBs, caches, log dirs, etc) for most applications is stored on the eMMC rather than the SD card or in some cases written to tmpfs (logs).
- The subset of content I loaded onto this from my main media server was all chosen because it has the most re-watch potential, so re-loading close to a TB of media isn’t something that’s going to happen too often. The largest write it sees is the semi-annual refresh of the full ~130 GB Wikipedia ZIM dump, but I may push that back to once a year. I’ve only updated it twice so far.
- Armbian assumes it’s going to run from SD card and does a pretty good job about minimizing the number of writes. Logs are all written to zram and only occasionally written to disk, it has no swap file, etc. If those are good enough to keep an SD card happy, they should keep an eMMC even happier.
Basically, I tried my best to configure the SD card so that in day to day use it’s WORM (write once, read many) without actually going so far as mounting it read only. The data that gets synced daily from my main servers is incremental and usually has few changes.
I’ve had PIs running for years without issue with the SD card mounted read only and retired them from service before the SD cards ever started showing issues. My Meshtastic EAS Alerter project is using one of those Pi Zero W2’s I retired from an older project and its 6 year old SD card.
This is actually the second iteration. Originally I attached a 1 TB SSD via a USB->NVMe enclosure. That worked, but also made the unit sprawl which was something I wanted to trim down in the final version. It worked but had random glitches and instability that I initially chalked up to the board and/or Armbian. I didn’t realize it was EMI from the Wi-Fi coming in through the USB cable until after I switched to the 1 TB SD card. That’s why I added some ghetto shielding to the power cable for lack of having ferrite beads on hand lol.
Should the SD card prove problematic over time, I can always go back to the USB->NVMe solution and lose its “keychain” form factor.
/_\ _ _ _ __ | |__(_)__ _ _ _ / _ \| '_| ' \| '_ \ / _` | ' \ /_/ \_\_| |_|_|_|_.__/_\__,_|_||_| v25.11.2 for BananaPi BPI-M4-Zero running Armbian Linux 6.12.58-current-sunxi64 Packages: Ubuntu stable (noble) Updates: Kernel upgrade enabled and 52 packages available for upgrade WiFi AP: SSID: (BananaAP), channel 6 (2437 MHz), width: 20 MHz, center1: 2437 MHz IPv4: (LAN) 192.168.5.1, 10.10.10.15 (WAN) 192.168.1.12 Containers: postgres_postgres_1 Performance: Load: 4% Uptime: 18 weeks, 22 hours, 49 minutes Local users: 2 Memory usage: 45% of 3.83G Zram usage: 74% of 1.91G CPU temp: 63°C Usage of /: 35% of 29G RX today: 6 GiB
Interested to know if this is for international travel, or just within your country’s borders? I would be concerned with this going through airport security, whether in carry-on or checked luggage - x-rays can damage electronics, and the potentially suspicious appearance of electronics to the non-technical could cause problems.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters AP WiFi Access Point DHCP Dynamic Host Configuration Protocol, automates assignment of IPs when connecting to a network DNS Domain Name Service/System NAT Network Address Translation NVMe Non-Volatile Memory Express interface for mass storage PiHole Network-wide ad-blocker (DNS sinkhole) SSD Solid State Drive mass storage VPN Virtual Private Network
[Thread #50 for this comm, first seen 11th Jul 2026, 12:40] [FAQ] [Full list] [Contact] [Source code]
Is there any reason this can’t be done on a VM in your laptop?
Very very nice. Some good inspiration in this post, especially the mobile Jellyfin part.
This is insane.
Insanely cool!
Can I please stand behind you in the airport security queue, just to see what happens?
Ha, yeah, that UPS board isn’t going on any plane. I’d just use an approved power bank in that case.
Afaik you should be ok as long as you have it in your checked luggage, not your carry-on bag
I think it’s the other way around, at least in the US. The last time I flew, anything with a lithium battery had to be either on your person or in your carry-on and couldn’t exceed a certain amperage/watt-hour rating. I remember having to check specifically on that since I wasn’t sure if I could bring my vape.
But mostly, a bare PCB with two 18650’s visible isn’t something I want to have to explain to airport security lol. They may let it pass, but it’s definitely going to be a hassle. Easiest to just use an approved power bank or just power it from my phone’s USB port. The UPS was mostly so I could make it mobile and use solar chargers with it.
Iirc I had to check in my checked bag before going through security. Also had no problem with putting my Nintendo Switch and controller in my checked bag.
Although I only flew within the EU, so different regulations may have applied than in the US.
Ah, yeah, you can have most devices with lithium batteries in your checked baggage, but they have to be off and packed so they’re protected from damage. It’s preferred for those to be carry-on items but isn’t required.
Power banks, vapes, spare batteries, etc are specifically prohibited in checked baggage and must be in your carry-on or on your person.
How do you connect it to free wifi?
I’ve only had to go through a captive portal once with it but MAC cloning was sufficient
What i mean is, i don’t see a screen or a keyboard, so do you ssh into your server via wifi, and then use a cli version of network manager to connect to the free wifi? Are there cli methods to login via captive portal?
Oh, yeah. SSH from laptop or Termux on my phone.
Not sure if there’s a CLI way to deal with captive portals or not. Maybe a text-based browser like Lynx/Links2 if the portal isn’t super fancy, but I’ve used the MAC cloning method for ages and it’s just my “go to” for dealing with that. Honestly, I don’t deal with them very often since I just use a hotspot much of the time with it.
Great writeup and encouraging work! Thanks for taking the time to share and kudos for your work!
This is sick! Thanks for this write-up.
One thing this shows off nicely is just how many services you can squeeze onto some pretty modest hardware. I know people with big server racks running mostly this same stuff.
Yeah, I was surprised as well by how many things can run concurrently and why this project ballooned like it did. It was originally just going to be a travel router and PiHole but I decided to see how much I could cram in there. There’s still room for more but I had to move on to other projects once winter was over. If/when I have time, I’d like to add a map tile server to the mix.
The only limit I’ve run into is when I’m running the NextJS dev server and Jellyfin at the same time. That’s just a bit too much demand on the memory so one or the other crashes. So I can’t watch JF while I work, but considering what’s hosting these, I can forgive it.
Pretty much every major libarary and framework I work with has offline docs
Library, as in every library from npm that you import directly? Are Preact, lodash, MDN JS and Tailwind docs included in that collection? If I’m making a library, do I need to do anything specific to ease offline reading (and searching) of its website and readme along with other libraries if anybody finds it useful? All docs currently fit in these two pages.
- MDN (HTML, CSS, JS): Yes - Had to manually crawl/scrape that one myself. Took almost 3 days since I had a pretty generous delay between pages.
- Tailwind: Yes (v3 anyway)
The Kiwix web interface has a search, and it’s decent. AFAIK, unless you build your own somehow, that’s all there is for that.
Thanks for checking! Meanwhile I found the instructions on adding more scrapers for making documentation of other libraries and tools available offline if one wants to write them. Idk if it makes the docs available in Kiwix automatically, but Kiwix community seems to base its offline documentation packages on indexing this project.
Very very cool! Would love to see it all in the case once you design and print it.
