My server is a phone now: rooting a CMF Phone 1 to replace a VPS

A self-hosting enthusiast has replaced a small Hetzner VPS with a phone that was sitting unused in a drawer. In a detailed write-up, the author describes rooting a CMF Phone 1 and turning it into the machine that now runs his personal infrastructure: a remote browser, a finance tracker, a screen-sharing service and several smaller web apps.

Why a phone

The migration started as a cost problem. The VPS was cheap but starved whenever Chrome, used by a remote-browser project called Surf, had real work to do; dedicated-CPU machines solved that but cost too much for a personal browser. Building a new machine was ill-timed because DRAM prices were high. The phone already on hand offers eight ARM cores, 8 GB of RAM, 128 GB of flash, Wi-Fi 6, a 5G modem and a built-in battery that behaves like a small UPS.

From postmarketOS to Termux

The first attempt — flashing postmarketOS — ended at a splash screen and a black display, with Wi-Fi, Bluetooth and hardware acceleration all marked as broken. Restoring the stock Nothing OS required a Windows flashing utility, which the author ran in QEMU before moving to a real Windows installation; at one point the phone appeared soft-bricked. The lesson: Android already has working drivers for the hardware. The second attempt kept stock Android and used Termux as the host environment, with OpenSSH, runit, Caddy, Cloudflared and Tailscale, plus Termux:Boot to start services after a reboot. An Ansible-managed Android profile installs a wake lock, disables light and deep idle, exempts the needed apps from background restrictions and keeps Wi-Fi and an always-on Tailscale VPN running.

proot, then a real chroot

Applications shipped as Linux ARM64 OCI images initially ran under proot-distro, which needs neither root nor a special kernel but intercepts filesystem and process operations in userspace. The latency-sensitive browser workload could not reach the CPU efficiently that way, so the author rooted the phone to mount the same Debian filesystem and enter it with a real chroot. Images are pinned by digest, verified and installed by Ansible; a root helper creates a private mount namespace and drops privileges. No Docker daemon or compiler lives on the phone.

Ingress, roaming and results

HTTP services are exposed through a Cloudflare Tunnel — an outbound-only connection, so there are no inbound router rules, and moving the phone to another network simply reconnects the tunnel. The Surf remote browser, which terminates its own TLS and is pinned by an old iPad, has its TLS stream wrapped inside a WebSocket to cross the tunnel; the author measured roughly one extra round trip, with the iPad connection around 60 ms. A native dashboard service reports CPU, memory, storage, battery, thermals and reachability at dash.cmf over the LAN or tailnet. The author's verdict: reasonable for a handful of personal services if you have a rootable ARM64 phone — but not for irreplaceable data without automated off-device backups.