Installing Debian as a headless server

A homelab server is a computer you talk to over the network rather than sit in front of. There is no monitor, no mouse, no desktop — just a box on a shelf that you reach from your laptop over SSH. This post takes you from a blank machine to exactly that: a minimal Debian install with nothing running but the essentials and an SSH server waiting for your first connection. If you have not read why Debian for a homelab yet, that explains the choice; this is where you actually build it.

level:Beginner verified:Jun 2026

ℹ️ Hands-on — you'll install Debian on a real (or virtual) machine. The first steps happen on your current computer; the rest on the new server.

⚠️ Read this on a second screen, on a machine you can afford to wipe. Keep this guide open on a phone or another computer — the machine you're installing has no browser while it's being set up. Expect to hit something you didn't anticipate, or to make a wrong choice and have to start the install over; that is normal the first time. Pick a spare box or a VM where losing everything costs you nothing.

The version that matters: the current Debian stable release is Debian 13, codename "trixie", first released in August 2025 and on point release 13.5 as of May 2026 (Debian Releases). Everything below targets trixie.

⚠️ Warning — Installing Debian wipes the target disk. The guided partitioner reformats the whole drive, and there is no undo once it writes. Make sure the machine you point this at holds nothing you want to keep, and double-check you selected the right disk before confirming.

💡 Tip — Do your first run in a virtual machine. Spin up a VM in VirtualBox, on a Proxmox host, or with virt-manager, and practice the whole flow there. A VM costs you nothing if you fumble a step, and the installer behaves identically to bare metal. Once it feels routine, repeat it on the real box.

Here is the whole arc — the first three steps happen on your current laptop, the rest inside the booted installer:

flowchart TD
    A["Download netinst ISO"] --> B["Verify checksum"]
    B --> C["Write bootable USB"]
    C --> D["Boot the target<br/><i>vendor boot key</i>"]
    D --> E["Installer: language,<br/>hostname, user"]
    E --> F["Guided partitioning<br/><i>whole disk</i>"]
    F --> G["tasksel:<br/>SSH server + standard"]
    G --> H["Reboot, SSH in"]

The flow from your laptop into a running headless Debian server; the green field starts the moment the installer boots.

Get the netinst image

Debian publishes several install images. For a headless server you want the netinst (network install) image — a small ISO, around 700 MB, that boots the installer and then pulls everything else over the network. The why: the netinst image carries only the installer and a minimal base, so you download just what you need and always get current packages from the mirror rather than whatever was frozen onto a larger DVD image. Grab it from the official Debian download page — pick the amd64 netinst for a normal 64-bit PC.

Alongside the ISO, the download directory contains a SHA256SUMS file and its signature. Checking the SHA-256 sum confirms your download is not corrupted or truncated; this is a host-machine step, done before you write anything:

os:windows open PowerShell and run Get-FileHash -Algorithm SHA256 debian-13.5.0-amd64-netinst.iso, then compare the output line against the matching entry in SHA256SUMS.
os:macos run shasum -a 256 debian-13.5.0-amd64-netinst.iso and compare against SHA256SUMS.
os:linux run sha256sum -c SHA256SUMS from the folder holding both files; it reports OK for the ISO it recognises.

The download page also links full verification instructions if you want to check the GnuPG signature on the sums file too, which proves Debian signed it. For a homelab the checksum alone is a reasonable bar.

Write the bootable USB

The installer is not something you run inside your current operating system — the target machine boots straight off the stick, so the ISO has to be written as a raw bootable image, not copied as a file. This is still a host-machine step and differs by the computer you are using:

os:windows use Rufus: select the ISO, select the USB device, and write in DD image mode if prompted. Ventoy is a good alternative if you boot several ISOs.
os:macos use balenaEtcher (select image, select drive, flash), or dd from the terminal as below.
os:linux use balenaEtcher for a GUI, or dd from a terminal.

For the dd route (macOS or Linux), confirm the device name first with lsblk on Linux or diskutil list on macOS, then write it:

⛔ Danger — dd writes raw bytes to whatever device you name, with no confirmation prompt. Point of= at the USB stick (e.g. /dev/sdb), never your system drive — naming the wrong device erases it instantly. Confirm with lsblk that the size matches your USB stick before you press enter.

sudo dd if=debian-13.5.0-amd64-netinst.iso of=/dev/sdX bs=4M oflag=sync status=progress

Replace /dev/sdX with your actual stick (for example /dev/sdb, not a partition like /dev/sdb1).

Boot the target machine

Plug the stick into the server, connect an Ethernet cable (wired networking saves you a lot of fiddling in a headless install), and power it on while pressing the boot-menu key. That key is vendor-specific — commonly F12, F11, F10, or Esc; for the firmware setup it is often Del or F2. Pick the USB device from the menu. If the machine boots its existing OS instead, you missed the key window — power-cycle and tap it earlier.

From the Debian boot menu choose Install (the plain text installer) or Graphical install — they ask the same questions and produce the same result, so pick whichever you find easier to read. For a headless box you only need it on a monitor during install; afterwards it runs without one.

Walk through the installer

The first screens are quick: choose your language, location, and keyboard layout. The installer then configures the network over DHCP automatically if the cable is plugged in.

Next it asks for naming and accounts:

Hostname — the name this machine answers to on your network. Pick something short and memorable, like homelab or vault. You can reach it later as homelab.local on networks with mDNS, or just by its IP.
Domain name — leave blank, or set something like lan if your router uses it. It is fine empty for a home setup.
Root password — here is a deliberate choice. If you leave the root password blank, the installer disables the root account's password login and instead grants your regular user sudo rights automatically — which is exactly what you want. Setting a root password works too, but you would then add sudo yourself later. Blank is the cleaner path.
Regular user — create a normal account with your name and a username (for example mart). This is the account you log in as day to day; you will use sudo for admin tasks.

💡 Tip — Leaving the root password empty is the recommended route. Debian then adds your new user to the sudo group during install, so you can run privileged commands with sudo straight away and never need to log in as root. The next post, hardening a fresh Debian server, assumes you have a sudo-capable user.

The installer sets the clock from your chosen location, then moves on to disks.

Guided partitioning, the simple way

Partitioning decides how the disk is carved up. The official installation guide walks through every option, but for a first homelab server the simplest correct answer is:

Choose Guided - use entire disk.
Select the target disk (confirm it is the right one — this is the wipe).
Choose All files in one partition — the recommended scheme for new users; one root filesystem plus swap, no separate /home or /var to size-guess.
Review the summary, choose Finish partitioning and write changes to disk, and confirm Yes to write.

flowchart TD
    A["Guided - use entire disk"] --> B["Select target disk"]
    B --> C{"Partition scheme?"}
    C -->|"recommended"| D["All files in one partition"]
    C -->|"advanced"| E["Separate /home, /var, /tmp"]
    D --> F["Finish and write changes"]
    E --> F
    F --> G["Confirm: erases the disk"]

The guided path. "All files in one partition" is the right default for a homelab; separate partitions are an advanced choice you do not need yet.

⚠️ Warning — The confirmation screen is the point of no return. Once you select Yes to write changes, the partitioner formats the disk and any existing data is gone. Read the disk model and size on the summary screen and make sure it is the machine you mean to wipe.

If you later want encryption or LVM, the guided menu offers those too, but plain "use entire disk" keeps your first build understandable. We will cover dedicated storage and backups in homelab storage and backups.

tasksel: choose what gets installed

After the base system copies, the installer runs tasksel — a menu of predefined software collections. This is where a headless server is made or unmade. The installer offers a "Desktop environment" task that, by default, would pull in GNOME and a graphical login (installation guide, software selection). For a headless box you want none of that.

Use the space bar to toggle each item. The result you want:

Deselect every "...desktop environment" entry (GNOME, KDE Plasma, Xfce, and the generic "Debian desktop environment"). No graphical stack on a server.
Select "SSH server" — this installs and enables OpenSSH so you can reach the box over the network the moment it reboots. Without this you would have no remote access.
Keep "Standard system utilities" selected — the common Unix tools (editors, man, basic networking utilities) you expect on any usable system.
Leave web/print/database server tasks unselected — you will install services deliberately later, in containers, per Docker and Compose on Debian.

flowchart TD
    A["tasksel menu"] --> B["[ ] Desktop environments<br/><i>leave all unchecked</i>"]
    A --> C["[x] SSH server<br/><i>remote access</i>"]
    A --> D["[x] Standard system utilities"]
    A --> E["[ ] Web / print / DB servers"]
    B --> F["Tab to Continue"]
    C --> F
    D --> F
    E --> F

The minimal headless selection: no desktop, SSH server on, standard utilities on. Press space to toggle, then Tab to the Continue button.

Tab down to Continue and let apt fetch the selected packages. Finally the installer offers to install the GRUB boot loader — say yes and let it install to the primary disk, so the machine can boot on its own. If you are curious what GRUB does, the explainer on boot loaders covers it.

Remove the USB stick when prompted and let the machine reboot into its new system.

Your first SSH in

The server is now running with no monitor needed. To connect you need its IP address. Check your router's DHCP lease list, or if you have mDNS try the hostname directly. Run this on your laptop (not the server):

ssh mart@homelab.local

or with the IP:

ssh mart@192.168.1.50

Use the username and password you created during install. The first time, SSH shows the server's host key fingerprint and asks you to confirm — type yes, and it remembers the key so future connections are silent unless the key ever changes (which would be a warning worth heeding). If you want the background on what SSH actually is and why it has outlasted every alternative, see SSH, the protocol nothing displaced. The thing answering your connection on the server is the sshd daemon — and if "daemon" is a new word, where the word daemon comes from explains it.

Once you are in, you are now at a shell on the new server. Confirm the basics and update the package lists:

hostnamectl
sudo apt update && sudo apt upgrade

hostnamectl shows the hostname and OS version (you should see Debian 13), and the apt commands pull any security fixes released since the ISO was built.

A short close

You now have what a homelab is built on: a minimal Debian server with no desktop, no extra services, and an SSH server you reach from your laptop. Everything from here is additive — you choose what runs on it. The very next step is not to install services but to lock the front door, because a box reachable over SSH is a box the whole internet can knock on. That is hardening a fresh Debian server: key-based SSH login, automatic security updates, and a firewall.

This post is part of the Build a homelab on Debian series. If you want to revisit the reasoning behind the distro choice, why Debian for a homelab is the opener.