I’ve not gotten into self-hosting yet, but as someone who has gotten a Filesharing-Abmahnung amounting to roughly 1700€ I can tell you what I would do. All of this is of course purely theoretical.

Regarding torrenting and piracy, it is my understanding that German law (same with most other countries) has yet to find a decisive answer. But, to keep yourself safe, so far the consensus is as follows:

1. Don’t use torrents.
2. If you use torrents, never upload. ('Tis a trap, see below)
3. If you use torrents, use a VPN.

Now let’s put this into practice, with examples for each use case. Our goal here is to never break existing German law. The further you go away from option one, the higher the risk of breaking the law.

1. Don’t use torrents. If you never interact with anything regarding torrents, you cannot be sued for torrenting, and that’s really the only issue in Germany. As far as I’m aware, you’re not liable if you simply download or stream something from a website freely accessible on the internet. Examples are streaming sites like Aniwave or download (DDL) sites like DDLbase.net. Hell, you could click on one of them and watch something right now. No one cares. To make this a bit more organized one could even use Cloudstream, which is an app that can aggregate “streaming websites” through external add-ons and it gives you a beautiful UI for it. Available for Linux, Windows and Android.

2. “If you need or want to use torrents, never upload.” is what I thought, because it sounds reasonable, right? If you look around on the internet (and in my personal use case) the courts and attorneys that send out these Abmahnungen always seem to take issue with you sharing and uploading files. And mostly music, not movies or TV series. By uploading you’re sharing files that do not belong to you. So, if you deactivate uploads on your torrent client, you’re done, right? If you don’t share, you aren’t technically breaking the law, right? Wrong. And for two reasons: (1) The process of downloading something always includes uploading some information about the download. So while you might be able to stop uploading files, you can’t stop the upload of other information needed for the correct download of the files. Which leads us to the second reason: (2) These attorneys don’t care what information you’ve uploaded, how much you’ve uploaded, what parts you’ve uploaded or how long, they just care that they caught you participating - in any way, shape or form - to their tracked torrent. You participated, you necessarily both downloaded and uploaded something, you broke the law. If you want to make sure you don’t upload nor download anything, use a Debrid service like RealDebrid which downloads it for you. Of course you’re only using it to torrent Linux ISOs for you, so you’re not really breaking the law anyway.

3. Now correctly: If you use torrents, use a VPN. You either relegate it to someone else (a Debrid service or a seedbox like Ultra.cc) or you do it yourself by using a VPN. You’re not breaking the law by connecting to a VPN or a seedbox.

Now, to the point that you’re probably most concerned about. “What if one day sharing Linux ISOs becomes illegal, what if the program or kill-switch fails, what if the VPN actually does sell my data, what if the police use brute-force and physically take the datacenters, what if X or Y protection fails?” Enter layered protection. For example:

• Use a VPN, but also never upload. This way, even if your program accidentally uploads a file, it doesn’t matter because your VPN is there. Use a VPN, but also use a Debrid service like RealDebrid that downloads the torrents on your behalf. This way, even if your Debrid service sells your IP, it doesn’t matter because your VPN masked it. It is highly unlikely that both fail, and even if there’s still a risk, you’re statistically in a much better situation than you were before. You’re basically doubling your chances of success.
• Use streaming and DDL-websites, but use a VPN too. Let’s say your VPN does sell your data and everyone finds out that you, you, did a thing. It doesn’t matter, because you were just browsing streaming websites, and no one cares about those.

P.s. This approach doesn’t replace using good tools to keep you safe. Similarly, it doesn’t matter if you have 5 locks on your front door if they’re all made out of chocolate. Use a good VPN, use a good torrent client, use good trackers, etc. And lastly:

Don’t stress too much.

A friend of mine uses NordVPN, has a kill-switch on the VPN and uses Stremio with a Debrid service to make sure he never uploads nor downloads any torrents on his server, and paid for it with a Paysafecard that isn’t digitally tied to him. Is this perfect? No. He is the farthest away from option number 1 and is exposing himself to risks. He can theoretically be identified if you look up the security footage of where he bought the Paysafecard. NordVPN has not been proven to be as secure as Mullvad, has no diskless servers and the clients aren’t open-source. He paid the VPN with his credit card. The single kill-switch can fail. He is still dabbling with torrents by using a Debrid service. He is using public trackers. But remember: The FBI or in your case the Bundesnachrichtendienst will not invade Panama to shut down your VPN, then threaten the developer of your favourite streaming client to install a backdoor to see that it’s really you that is pirating this show right now, and then come knocking on your door because you pirated KissXSis or the latest season of Game of Thrones. You’re simply dealing with copyright trolls and to quote someone else in this comment section: “Trolls will look for the best return on their trolling”. As long as you take just two good precautions, you will be safe from most adversaries. And that’s really all you can and want to achieve.

Edit: corrected the “upload” parts. Thanks @retro@infosec.pub!

A VPN is enough for torrenting, as long as the VPN provider isn’t logging. I personally use AirVPN because they have port-forwarding but I’ve used Mullvad before. I also live in Germany and I’ve never gotten in trouble.

The guide you linked seems a little outdated, Jackett has been replaced by Prowlarr, which is there to have a central location to manage your trackers. If you plan to use Jellyfin, you should also use Jellyseer instead if Overseer. The *arr services are the ones that actually search for the files to download by using the trackers you set up in Prowlarr. You don’t need all the *arr services, I only have Sonarr and Radarr, which are for shows and movies respectively. I also have Bazarr for subtitles. AdguardHome is only for ad-blocking, might be useful to you but isn’t needed. Idk why that’s even in the guide. Flaresolverr is something I’ve never heard about and I don’t use it, so I can’t tell you anything about that. Heimdall is something I don’t need because I use YunoHost, which has a dashboard already but it might be useful to you.

A VPN is a great start, but there’s a few things you can do to make yourself a bit safer.

I like Mullvad for it’s client that allows me be in a lockdown mode where access to the internet can only go through a VPN. It’s a killswitch and you’re going to want one no matter who provides your VPN. The reason you want a kill switch is because your computer may otherwise connect to your home or office network and leak your IP address.

If you torrent you’ll want a torrent client like qBitTorrent because under advanced settings in that program you can set it to only work on your VPN’s network interface. This adds a second wall of protection to make sure you don’t leak your IP address.

At this point your ISP isn’t going to know any much more than you’re using a VPN and torrenting, but that’s all. And you’re probably good right here, but there’s more you can do if you’re really worried.

By tweaking some wireguard settings in the Mullvad client you can even obscure your torrenting traffic altogether. At that point your ISP won’t have much more to report than that you’re using a VPN.

You’ll then want to test your VPN is working well with your torrent client by using Torrent Tracker IP Checker or something similar. Verify that your IP is what it should be.

And if you’re feeling extra motivated, doing all of this on a separate computer running linux would be ideal so that you can ensure no software running on your rig deanonymizes you, and can keep it locked when not in use.

hey Op - I went through the same journey as you recently.

I found the exact same guide you linked - but here’s what I found on my journey from knowing literally nothing to having it work.

firstly that guide is a bit outdated and very terse, in fact most of the guides have at least one thing that’s outdated and several things not explained

Here were my learning steps:

• getting confident with the Linux command line enough that “chmod” and “chown”, user:group, rm, nano, and other basic commands weren’t foreign to me

• getting confident enough with docker and docker compose that I understand what a container, image, compose file are and how to both manipulate them and exec commands inside them

• understanding the basics of what a VPN is and does so the terms proxy, reverse proxy, port forwarding, DNS aren’t alien to me

• understanding the basics of Linux file management including dotfiles, fstab, mounting, blkid, and as mentioned chmod and chown

none of this is particularly hard to grasp once you’ve grasped it but most guides you see and people you meet along the way will assume all of the above is second nature to you. at first I would pull my hair out seeing suggestions like “have you shelled into the container to curl your public IP?” like what the fuck does that even mean

I started with VPN as thats the important protective part. I paid for Mullvad because its fairly cheap and stuck with it all the way. First I used their GUI app and then later I switched to Tailscale and ran it as an exit node.

I also found guides like YAMS (Yet Another Media Server), dockSTARTer, Trash Guides and the Servarr wiki and would jump between them, Uninstalling, reinstalling, going down paths that didn’t work and formatting my raspberry pi and starting from scratch several times. It took me about 6 weeks to skill up to the point where I’m confident knowing about all the parts of my setup.

I’m happy to answer all the questions I can (bear in mind I knew nothing about this a few months ago, but my newbie perspective could help because I know what it’s like to not really know what half these terms mean)

PS:to specifically answer “what do these tools do”

• Ombi (optional) – allows other people (or yourself if you like) to select requests for things to download (tv shows and movies)
• qBittorrent - the torrent download client, takes a torrent from Prowlarr (see next point) and downloads it to your storage
• Unpackerr (optional) - if it happens to download as a rar or zip file, unzips it for you
• Prowlarr (replaces Jackett) – takes requests from Ombi (optional part) or Radarr/Sonarr/Lidarr (usually de rigeur) and uses trackers to find torrents. Trackers are services that take “I am looking for this movie” and turn it into “here is the torrent”. Prowlarr is where you manage the Trackers
• Radarr (movies), Sonarr (tv), Lidarr (music), Whisparr (porn), Mylar (comic books), and Readarr (books) are part Ombi (find me this movie) but when qBittorrent has finished downloading and Unpackerr has unzipped it, puts tv shows together into series/seasons, handles the meta data, organizes everything for you and talks to the other apps so your library isn’t just a /downloads/ folder full of random crap, also sometimes you’ll download episodes 1 and 2 from one source, 3 and 4 from another, Sonarr gives you a UI to group them all together.
• Jellyfin then let’s you watch these on your TV