How to repurpose your old phone into a web server

by louismerlin • 8 months ago

358 114 8 months ago

Related ongoing thread: This blog is now hosted on a GPS/LTE modem (2021) - https://news.ycombinator.com/item?id=46049981

agentifysh3• 8 months ago

so once you have a web server on the phone how are you able to make it available publicly on the internet? don't ISPs detect these and ban? are you using wireguard or something like that?

ive been looking to build and serve my own servers and i have been considering to use old android phones to outright racks but the part I am still struggling to figure out is how to serve it publicly without ISP catching on as they require business plans for that and its not cheap

1bpp• 8 months ago

A Wireguard tunnel via a free tier or dirt cheap VPS, or a VPN provider that lets you forward ports like Proton

agentifysh3• 8 months ago

but can't the ISP still see something is up if there is traffic 24/7

rlupi• 8 months ago

A CloudFlare tunnel?

https://developers.cloudflare.com/cloudflare-one/networks/co...

Although, you may also go with a 5$ virtual host (e.g. Linode Nanode 1 GB) and wireguard to build your own tunnel (or just the 5$ virtual host to run your server)

agentifysh3• 8 months ago

i see so just run cf tunnel and ISP wouldn't be able to see I am hosting web apps? what if I am streaming large files (not torrent)? couldn't they see the bandwidths being consumed and then tell me to upgrade to business ?

Gabrys1• 8 months ago

at this point you don't need the phone :D

shevy-java2• 8 months ago

It used to be easier to get a web server up and running in the past. I remember the 1990s fondly.

Not sure what changed, but things got more complex - and more expensive, too.

teo_zero• 8 months ago

Not sure what changed

IP4 address exhaustion.

Nextgrid3• 8 months ago

don't ISPs detect these and ban

No. No ISP who desperately tries to grow marketshare at all costs and lock their customers into a year-long contract will intentionally ban users. I'm not even sure where this misconception comes from, it's not like ISPs led a massive PR campaign warning people of the dangers of running a server.

The only way you will get banned is if you cause disproportionate strain on their network, which means you'd need to exceed the usage of the typical gamer (downloading games worth hundreds of gigs regularly), streamer (streaming 4k video for hours at a time), cloud backup customer (uploading gigabytes regularly), Windows user (in its default configuration Windows can use P2P to share updates), torrenter (sustained full-duplex bandwidth usage), and unlucky idiot with a compromised device spewing DoS traffic at line-rate.

Saturate the pipe consistently for several days by hosting video? Yeah sure you could get a warning and eventually disconnected, assuming they don't already have traffic shaping solutions in place to just silently throttle you to an acceptable level and leave it up to you to move your homebrew YouTube clone elsewhere when you realize it's too slow.

Hosting a website which will have a few mbps worth of traffic with the occasional spike? That's a rounding error compared to your normal legitimate usage, so totally fine.

The reason most consumer ISPs have a clause against running servers (not even defining what counts as a server) is to preempt a potential business starting a data center off a collection of consumer connections and then bitching about it or demanding compensation when it goes down or they get cut off. Nobody cares about a technical user playing around and hosting a blog at home.

lelandbatey5• 8 months ago

ISPs don't care, actually. They care about operational problems, but you serving a constant stream of web traffic is probably not going to matter to them; web traffic for even a pretty successful blog is going to be a tiny volume compared to you streaming 4k movies from Netflix.

ISPs will have rules (maximum data volume per month) and restrictions (ISP equipment auto-drops all sending/receiving packets on port 25, 80, 443, or 456), but within those limits the ISPs do not care as long as you cause no problems for them.

Also, one of the easiest ways to expose e.g. port 80 of your in-house server is to just have your local server do an SSH port-forward to a remote server like a cheap VPS. Note that by default it'll bind to a localhost port on the remote, so on the remote you'd need to have an HTTP server reverse proxying to the remote localhost:8080, or you need to enable `GatewayPorts: yes` in sshd on the remote. Assuming you turn on GatewayPorts on remote.example.com, here's how you could expose port 80 of localhost:

    # Run this on in-your-house-computer to allow folks on public internet to visit
    # remote.example.com:80 but have the traffic served by in-your-house-computer:80
    ssh -R :80:localhost:80 username@remote.example.com

You can make the above connection permanent by setting up `autossh` on in-your-house-computer.

euroderf• 8 months ago

Would this involve "the usual" dangers of someone hacking the in-your-house server ?

hn_acc14• 8 months ago

If you're already paying someone monthly to "forward" ports, why not just pay for a blog somewhere? Way more secure.

edbaskerville• 8 months ago

Other folks have given general answers, but I'm wondering, what ISP do you have, and where?

(I'm lucky to have Sonic, in the SF Bay Area. A local ISP that actively campaigned for net neutrality and has 1Gps symmetric as the standard basic fiber plan. Pretty sure they're not shutting down anybody's servers.)

prmoustache• 8 months ago

Why would your ISP ban you?

whynotmaybe• 8 months ago

Many ISP don't care.

Some may block port 80 and 443 "For Security", but you can sometimes contact the support and they'll open it, even if you're not a business.

I have a webserver running at home and use the free dynamic dns from noip.com.

jeroenhd2• 8 months ago

don't ISPs detect these and ban

No? I mean, I'm sure there are ISPs out there that do it, but that's a ridiculous thing to do.

louismerlin• 8 months ago

In my experience (in Germany and Switzerland) ISPs don’t care, but they will rotate everybody’s IP once or twice a year.

Friends from other countries, India for example, have had different experiences though, where IPs were on a much more frequent rotation and required scripted solutions.

clueless• 8 months ago

Title should be updated to include "unused android phone"

mceachen• 8 months ago

"unused android phone with unlocked bootloader that is supported by postmarkOS"

(or maybe be able to use recovery zip that requires effort after every reboot)

shevy-java2• 8 months ago

Nothing beats my toaster serving my webpages.

iberator• 8 months ago

Of course it runs NetBSD

a96• 8 months ago

More an exception than a rule these days, sadly.

Though they might still have an edge on toasters.

misiek08• 8 months ago

I have wireguard and basic home automation things running as an experiment on vacuum cleaner. Its app was deadly slow, so having 2 cores and some memory to spare he became his own savior, with Valetudo included.

dinkleberg• 8 months ago

This sounds like a fun project. A perfect use for an old android phone sitting in the junk drawer.

_whiteCaps_• 8 months ago

For some reason, I never buy phones that work with postmarketOS :( And I find phone naming confusing, it's difficult to find a used one locally to play with. Is it a Moto Play 2018 or a Play 2020? Trying to get that information from someone on Facebook marketplace is like pulling teeth.

sexeriy237• 8 months ago

Ebay bro, play 2020 was $25 last time i got one. dont mess with fb sellers

ssl-3• 8 months ago

That makes sense. Most phone users aren't technical. Like -- at all.

If you can think about how deep into technicalities the most average person you know gets, then you can also understand that ~half of everyone is even less technical than that.

There's nothing wrong with this. That's just the way that it is. (We can accept this or be frustrated. Acceptance is more useful.)

As a workaround, I find that searching by part number provides a good filter.

Maybe I want a very particular Moto G Power to use for whatever. I don't search for any permutation of "Motorola G Power" at all, because that description doesn't help me.

Instead, I just find the part number (maybe something like "XT2041-7") and search for that instead.

This excludes a lot of listings straight away, and that's fine: I don't want to stumble through listings from people who don't know what they have. I only want to buy what I want to buy, and what I want is an XT2041-7.

officeplant3• 8 months ago

All my old phones used to become BOINC nodes doing WorldCommunityGrid or seti@home, at least until we got to the point where you couldn't run the phone without a battery anymore. Came home to one too many spicy pillow'd phones even keeping them in a cool area with a rigged up fan blowing on them.

ChrisbyMe2• 8 months ago

Interesting, I wonder if using a regular sff pc fan might work if you don't need the touchscreen.

Just thermal paste to the battery hah

officeplant3• 8 months ago

I do Wigle wardriving with a dedicated cheap phone these days. (Moto G Stylus 2023)

In order to prevent issues this time around I've preemptively removed the back of the phone, and the camera modules so I can have a nice flat phone. Then I bought a heatsink nearly the same size as the phone itself. I've got thermal pads on the SoC which sits lower than the battery and the heatsink itself had thermal adhesive on it pre-applied which is sticking to the battery/phone frame holding it to the phone. No more phone overheating worries and if the battery goes pillowy it should just pop the heatsink up instead of warping the whole phone.

jjice• 8 months ago

The thing that holds me back from this is always the battery. I want to have my battery removed so that it doesn't eventually become a time bomb, but it's a pain on modern phones and I'm not even sure if they boot without. The mobile hardware reuse space can suck for hobbyists.

ActorNightly2• 8 months ago

Most phones can have battery removed somewhat destructively, but without affecting the rest of the phone.

Generally, as long as you keep the phone plugged in, the battery should be safe virtually indefinitely - the battery management on board will keep it in a state where its a constant charge which means the chemistry will be stable.

jprd• 8 months ago

I'm not educated enough in this area to have any expertise, however, in my personal experience leaving a lithium-ion battery plugged all the time results in scary semi-exploded batteries that also stop working.

Would you say this is a chemistry/QA problem? Have there been advances in battery / controller technology that achieves the above?

munk-a2• 8 months ago

There were several generalizations in that statement that align with my similar fears to the OP. Most firmware should minimize the charge cycling, most batteries should be stable at constant charge... most isn't great for something that I want to sit in the corner undisturbed for a decade just chugging along - I have a few old desktops I use whenever I need a stand alone server or to host something web-live for a while. They'll eventually have hardware failures, but I have a lot more confidence that when they fail it won't be dramatic or destructive - ditto with old laptops, the serviceability expectations are much higher than phones so I have yet to meet a laptop I can't pop open and just pull the battery out of to run on AC alone - in the case of a power failure the UPS can't cover I'd rather the machine just power off rather than needing to deal with the possibility of dramatic failure.

I think if you're considering re-harvesting old devices to use for hosting and get far enough down your list to get to phones then you've likely got enough constant maintenance costs in overseeing things that the additional worry of fire risk just isn't worth it.

hn_acc14• 8 months ago

Depends on your phone. Just has to replace the battery on a generally always-plugged in Moto (at least after a certain age). Battery had pillowed out. It's acting as our "landline" with a link2cell on some old DECT handsets.

smeej• 8 months ago

Of the six old Android phones I have around, two of them I don't dare turn on due to swollen batteries. I guess it depends how old the devices are whether this was a real risk, but I won't leave devices plugged in anymore for this reason.

crazygringo2• 8 months ago

Generally, as long as you keep the phone plugged in, the battery should be safe virtually indefinitely

What is your source on this?

I've replaced the battery in always-plugged-in iPhone 3 times over 10 years because it was expanding into a spicy pillow.

I too want a way to run phones directly off of USB power, without a battery present.

aziaziazi• 8 months ago

Place the "server" into a shoebox. Place another shoebox on top, filled with sand. Tape together and hide behind a furniture.

n4bz0r• 8 months ago

So the phone effectively becomes a 4U rack server that's probably not much of a fire hazard. We'll tuck it away behind some wood for extra safety. Never liked sleeping with my eyes shut anyway!

xgulfie• 8 months ago

Then put that in a garage at least 50ft away from your home

6510• 8 months ago

Red Magic can be set to not use the battery when the power cable is plugged in. (it is to avoid heating issues and not degrade the battery)

jeroenhd2• 8 months ago

In theory, you can replace the battery with a chunky enough capacitor (to get past the power-on surge) and a power source at the right voltage attached right where the battery would go. The soldering points are way too tiny for my amateur soldering skills, though.

volumo• 8 months ago

Check out this method: https://www.youtube.com/watch?v=7f8SliNGeDM

yaky• 8 months ago

You could try to fake a battery instead: https://yaky.dev/2022-09-06-smartphone-without-battery/

(This is for a removable battery, but should be close for built-in ones too, I suppose)

4k93n22• 8 months ago

hopefully "bypass charging" becomes more of a thing in the future. a few of the latest pixel phones use it but the only other time ive seen it is on tablets aimed at gaming

leobg2• 8 months ago

I grabbed a few power point timer switches, and set them to only over up the charger for a hour a day. Never had another battery puffing failure - at last not in the next 2 or 3 years before I left.

[0] https://news.ycombinator.com/item?id=45021233

GTP• 8 months ago

They don't boot without it, but you can make it think that there's a battery by connecting power directly to the battery pins [1].

[1] https://www.youtube.com/watch?v=7f8SliNGeDM&pp=ygUYZ3JlYXRzY...

ActorNightly2• 8 months ago

Don't even need postmarketOS.

Simple root, with a custom degoogled rom, and termux is all you need.

codethief• 8 months ago

Can't you just run a Linux VM on Android these days?

zoobab2• 8 months ago

"Simple root"

You don't need root if you webserver is listening on a port over 1024.

Termux plus some webserver like nginx is all you need.

Now to make it reboot resistant is another story.

hatmanstack• 8 months ago

Hell, even simpler. Termux + Caddy + cloudflared with a domain you own. Serving in 15 min.

tonetheman• 8 months ago

As others have mentioned you have to watch the battery if you do this for real.

The battery will swell and explode if you run 24x7 on a phone.

qubex• 8 months ago

Call out to World Wide Web (no affiliation) that sets up a web server on an iOS/iPadOS (€9.99 for PRO, https://apps.apple.com/it/app/worldwideweb-mobile/id16230068...)

denysvitali• 8 months ago

Should be merged with: https://news.ycombinator.com/item?id=46027554

retrac2• 8 months ago

If the device can run PostmarketOS with a mainstream kernel, then it can run any Linux distribution. (I put Arch ARM on such devices, since I like that distro.)

That's the big hurdle though - mainstream kernel support.

For most devices, even if they can be rooted and jailbroken, you're stuck with the kernel they come with. Doesn't have a new feature you need? A horrible security flaw in the network stack? You're out of luck. Most "repurpose your old phone" approaches have this problem. You can make it a server but you wouldn't want to expose it to the public Internet.

norman784• 8 months ago

Is Arch ARM officially supported by the same team? If not, what might be the reason?

retrac2• 8 months ago

x86_64 is the only official Arch Linux. All other ports are unofficial. They are community projects where many of the members are the same as the main Arch Linux.

I think it's basically for the same reason as why they dropped 32-bit x86 support about 8 years ago. Not enough users. (That resulted in the unofficial Arch Linux 32 to maintain support.)

Muromec• 8 months ago

I think the reason is they don't want to become debian where deciding anything takes foverever. Another architecture is a liability, so it lives in another "project" that official arch is not committed to.

I write this from arch on arm (orange pi) thingy, btw

Retr0id• 8 months ago

s/mainstream/mainline/

But yes, this is definitely an issue. I've been playing with a 2013-era Samsung device that came with a 3.0 kernel. It can run pmos with said kernel but there are multiple root LPE vulns. I've been looking into getting it to run a mainline kernel just for fun, but it's not going to be easy.

pabs3• 8 months ago

I note that Linux mainline has a device tree for the "Samsung Galaxy S1 (GT-I9000) based on S5PV210", not sure how complete it is though. Lots of others too:

  $ grep -rhoE 'Samsung Galaxy[^"]+' ./arch/arm*/boot/dts/ | sort -u

monerozcash• 8 months ago

This is the kind of task I've found tools like Codex to be pretty good at. You just have to be able to give it good enough access to test and debug its work.

hn_acc14• 8 months ago

The main question is WHY? I already have a 3570K box running our NAS, plex, Wifi repeater admin, etc, etc, and it would be trivial to put up a web server via python or something.. If I had any need for it.

KetoManx64• 8 months ago

How do I use your box to host my web server?

hn_acc14• 8 months ago

Sure, a phone could work - but only if you don't already have another server anyway. The downsides of a phone are probably too much of a pain over a cheap $50 used server.

4k93n22• 8 months ago

maybe because phones have a battery (built in UPS) so they will keep running if the power goes out. its only useful if you have a router that can be powered by an external battery pack i supoose

layer8• 8 months ago

For some reason I was expecting a RasPi in a rotary phone enclosure.

Jemm• 8 months ago

I use my old phone to proxy serial data to tcp. Also gives me macros and a video/audio feed. But most relevant to this is it has a built in webserver.

dang• 8 months ago

Related ongoing thread:

This blog is now hosted on a GPS/LTE modem (2021) - https://news.ycombinator.com/item?id=46049981

bdbdbdb• 8 months ago

It's through this link that I today discovered that a surface RT can run Linux. I think I got rid of mine already. Would have been nice to breathe some life into it

karlkloss• 8 months ago

I can run a web server on a $1 microcontroller, so what?

sgt2• 8 months ago

I tried this once a few years ago.. had half a dozen Samsung Android phones running an SSH daemon with some functionality that could be remotely accessed. However, what I learned is that phones generally don't like to run 24/7 as servers. They start giving you trouble after a while, never figured out why.

But I suspect it's just the "always on" nature and the battery. The usage pattern is just entirely different than having a phone in your pocket and using when you need it.

You're welcome to try though, maybe phones got more reliable.

jayd162• 8 months ago

I don't think people generally turn off their phones so it would be interesting to learn exactly what the difference was.

sgt2• 8 months ago

Exactly but I suspect phones last longer when they are in idle/near sleep mode with screen off.

phonkd• 8 months ago

better of compiling android kernel with docker support and using docker

leobg2• 8 months ago

I have an old iPhone XS lying around with a broken digitizer. Basically, it's recording phantom touch events all the time, making it unusable. Though the screen itself, camera, CPU etc. are all working fine.

Any ideas what I can do with it to give it some purpose?

vjerancrnjak• 8 months ago

Inspired by this, went to look into how much performance I can squeeze and turns out Qualcomm software practices are so bad that I can’t do much but accept old software.

It sounds like Qualcomm has to do everything from scratch on their hidden Linux software for every new chip.

justmee• 8 months ago

There is a much easier way to do this without renting a VPS or anything. If you download and install the Localtonet application from Google Play or Termux, it is very easy to do.

zoobab2• 8 months ago

With proot-distro under Termux, you can also run a container with proot-docker script.

Right now you have to find a skopeo binary for your arch, but that's WIP.

guluarte• 8 months ago

psa: remove the battery just in case

mixologic• 8 months ago

This sounds more like "How to add more devices to a botnet."

Exposing a port isn't exactly a safe thing to do nowadays, and I'd be wary of the security posture of an "old phone". Proceed with caution.

erremerre• 8 months ago

Asking from ignorance here.

Assuming you are using an old phone with termux to serve de webpage. What could be an attack vector?

The phone will be running Android 7.1

How to repurpose your old phone into a web server

Related Stories