Feeling better every day having my stuff under my control and away from prying eyes of trackers and other unsavory stuff.
this post was submitted on 01 Nov 2026
96 points (98.0% liked)
Selfhosted
63469 readers
508 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil.
-
No spam.
-
Posts are to be related to self-hosting.
-
Don't duplicate the full text of your blog or readme if you're providing a link.
-
Submission headline should match the article title.
-
No trolling.
-
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
-
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 3 years ago
MODERATORS
Just completed my set of needed services by adding nextcloud to the list. Now life is good. Jellyfin: check. Navidrome: check. Pihole: check. Invidious: check. Nextcloud: check. What else? lol
This week, I've mainly been handling the fallout from the PHP vulnerability that occurred in late October. Following that incident, I made a few changes: I've opened only the necessary ports to the outside world, and the admin panel is now accessible only via VPN. I've created an inventory list for each server, clearly detailing which services are running and their versions, so that the next time a CVE is released, I'll know immediately which servers are affected. In addition to running daily automatic backups, I periodically restore them to a clean machine to verify they work.
Remember: Always treat your servers as if they might be lost tomorrow, and make sure to have a thorough recovery plan in place.
I got new rack gear. I don't 3d print so I ordered metal face plates for my 10 inch rack. got them here https://www.rackmountplates.com/
I am not affiliated. just a happy customer that stumbled on a solution to a problem. Sharing in case others have similar needs
After the recent plex player debacle I'm once again trying to come up with a way for me and my diaspora to share media using Jellyfin, but without relying on Tailscale. We have several media libraries, and some of the library hosters are not too tech savvy, so coming up with a solution to replace the ease-of-use of plex hasn't been easy.
What's wrong with tailscale?
Hey, I did the same. It’s not as bad as it seems. Get yourself a domain name from cloudflare and use it. I got mine for $10 a year. Then just installed cloudflare on my Debian server and all that (I’m sure you know the rest) then made users on my admin jellyfin dashboard and started sending people their usernames and passwords. The only difference for them is now they would need to enter the server URL on the first page of whatever they use then username and password. Good thing these jellyfin clients have the page of entering the server URL in your face with their “connect to server” button. Let me know if you have any questions.
Careful with using CF Tunnels for streaming content. It's against their ToS to use the free tier for streaming content, so they can technically turn it off whenever they want from my understanding.
Upgrading one of my powerhouse Dell R410 proxmox nodes to 128GB of smoking hot PC10500 DDR3 ECC Ram from 64.
Now it's cutting edge.
Last week I had to update everything to make sure that it didn't fall back on DST because the fucking idjits in my backwoods province decided that they needed to create a new time zone.
OMG patching all the vulns. I actually pulled my wordpress offline overnight for that one. Still waiting on the Ubuntu patch for that IPv4 kernel CVE.
That reminds me - It's time to do No NAT November again. This CVE gives me an excuse. Last year, the Nintendo Switch Switch and Steam were the big standouts. I think the Switch 2 will actually work with it now.
Oh, and my workplace is shifting offices, so my offsite backup is not offsite. Must take care to not burn the place down. I just put new fans in my PoE switch and now I can hear a server fan is dying too. There's a lot of maintenance work to all this.
I recently got around to setting up OIDC for my internal apps using Pocket ID.
Sonarr v5 adds OIDC support, currently only in beta
Jellyfin SSO plugin
Nextcloud with the Nextcloud OIDC app
Mealie, Paperless, and Immich natively support OIDC
Calibre-Web I migrated to AutoCaliWeb, which supports generic OIDC
Sadly Navidrome doesn't natively support OIDC and forward auth is a bit jank due to the subsonic API
i have an asustor nas and i set it up with my hdd raid 1 drives as volume1, and installed my ssd later as volume2. now docker is constantly making my hdds tick and I can't move it to the SSD because asustor don't allow it ☠️ so I'm looking at reeeeaaallly testing my backups, wiping the device and reinstalling everything. It's all in docker so it's theoretically easy enough 🤞
I've been a Joplin user and using their Joplin Sync server for a few years now. Last night, I migrated everything over to Obisdian and just finished setting up a self hosted obsidian sync. I will say that the self hosted sync was nothing short of a puzzle for me but finally nailed that down between my phone and desktop app. So, I have the same as Joplin now for that functionality.
What got me started on this little side journey, is I've been seeing more and more pretty cool uses for Obsidian and have a lot of great things about it. I'm not dumping Joplin yet, but am giving this a solid try before I make any hasty decisions.
Do you have any experience with logseq? I am using it as I looked for an obsidian alternative that is FOSS. I don't really use much of its possibilities though, so I don't really know how they compare.
No, but I used this as part of my basis for decision:
You can select which notes apps you want to compare features against.
I set up crowdsec on all my internet-facing services. Couldn’t seem to get the online dashboard connected but I could at least confirm that it can block requests.
I’m also struggling with a new Home Assistant automation to send a live notification to my phone when my washer and dryer are running. The notification action works when I run it manually, and the automation as a whole gets triggered when the machine is on, and Home Assistant says it activates the notification, but I get nothing on my phone during a real test. Gonna keep fiddling.
Crowdsec is on my to-do list as well. Should be easy to set up on OpnSense, just never pulled the trigger.
I have HA notifications set up for the same thing, but sometimes they simply won't work. Have you set up all the energy settings? There's a way to create a manual notification from HA, does that work?
I can report crowdsec runs great via opnsense. I run this container to get fancy home hosted info https://github.com/TheDuffman85/crowdsec-web-ui
The manual notification works, yep. And it’s using a vibration sensor, which looks to be working. I can see the Automation getting triggered, and the trace says it’s executing the notification step. The notif just never seems to arrive.
Edit: I tested again and it worked. Who knows what it could have been.
If it's important to know the time the notification was sent, put a time stamp in the message. Your phone will time stamp the notification on receipt, which is sometimes much later than it was sent (if an app was asleep, for example.)
Got my hands on an old laptop. Since I started using nix a little while ago, and want to migrate to NixOS for my servers, this will be the starting point. Started cobbling together some code to commission it as a smart tv platform. KDE Plasma BigScreen is what I'm looking at atm.
Holy shit are you me? I started doing exactly this with an old laptop, NixOS and Plasma-Bigscreen too!
My automatic weekly backup ran for the first time last night. Everything worked nicely.
If it's automated, why only run it weekly?
I practiced restoring my offsite backup this week. Good experience.
Then I printed and laminated the instructions and stored in two locations.
load more comments
(2 replies)
load more comments
(1 replies)
Finally took the leap and wiped my NUC to start doing things over. Originally had a family member who works in IT set everything up, but he did the absolute bare minimum and I screwed some stuff up along the way the first time around, so I figured now was as good at time as any to teach myself to set things up from scratch!
I also have moved from Portainer, to Dokploy, to Arcane for docker management, and I actually really like Arcane. I've also accomplished something I'm really damn proud of, which is getting HTTPS working on Tailscale (so, for example, arcane.(my subdomain).ts.net but with HTTPS!) alongside Pocket ID for all of it. Maybe it's just me, but I had trouble finding clear documentation on how to do this, no matter how much I searched. But I documented it for myself, at least. And it's probably that I lack a lot of knowledge in this field, too.
I have some questions, and although I know there's a chance this gets buried, I figured I'd try asking anyway. Little skittish about making a thread myself.
My NUC is running Debian 13, and I was wondering some security things. Everything is behind Tailscale and I don't plan on exposing anything to the internet (even through Tailscale Funnel, I'm using Tailscale Serve for the HTTPS.)
- How valuable is a firewall in this case? I've never used one, and I'm wondering if it'll just make adding services more of a hassle than it's worth for the security since everything is staying local.
- Similarly, what about Fail2Ban? I have it on my RPi and it's not a big deal to set up, but I was reading a firewall is more important?
- Is it okay to run unattended updates for security OS stuff on the NUC? I don't always check updates, admittedly I'm easily distracted and forgetful. I'm a little worried about auto restarting it to finish the updates up just because I utilize a NAS and sometimes it's annoying to get them to reconnect to each other (even with the fstab edited) when there's a restart for either of them.
- Thoughts on auto updates on docker containers? I know this is pretty personal preference, but I mostly ask because I'm forgetful and distractable. I know this is kinda my own problem, but I want to know other people's thoughts if possible.
Thank you for reading my very long update! And any answers to my questions are very appreciated. Hope everyone else is doing well!
F2B/FW: If it's only available locally/via VPN, I think your threat model is your LAN. People in your wifi or rogue smart home stuff. I think a firewall makes more sense here, but if it's just 1 machine, you should be fine with ufw or the like. If you have several VMs that are supposed to be separated, the solution would depend on the virtualization software.
Unattended upgrades are way better than none at all, both for system and docker. Of course it depends on how important it is that your services are "always" available and I get the NAS struggle though.
Hey, thank you for the comment!
That makes sense, that I would be tightening security on the LAN. It's not just one machine, I have a Raspberry Pi 4 as well running a flavor of Debian (and the Synology NAS), so I would assume a firewall on both the Raspberry Pi and my NUC would make sense? I don't have any VMs that I'm aware of, and I've heard of VLANs but don't know anything about those.
Services don't always have to be available! It's just me and my partner who are accessing them, so nothing like a lot of people who need media playback. I'll have to weigh if it's worth fighting with the NAS over auto reboots, but I'm leaning towards yes as an experiment. I'll have to actually look into how to do unattended Debian security updates, though.
I think for that use case, Firewalls on the hosts make sense. VLAN is not a bad idea either, though you'd need a managed switch (hardware) for that.
I'm currently in the process of writing yet another script. This time my aim is to make one that will setup a server from a fresh Operating System install.
I want to do this for two reasons. The first is so that I have an alternative to backups. It would also help with major Operating System updates because sometimes those are a bit messy.
The second reason is because I want to help other people setup a simple, minimal and more secure setup for a home server as well.
It will all be POSIX portable too so it won't be limited by extra requirements. I've already made a lot of progress with it because I started doing the same with my personal computer. I've been able to focus on that because my home server is super simple and I've been able to ignore all the recent vulnerabilities.
Don't create another Omarchy please!
I have a similar thing but I'm using Ansible. That way, I don't have to handle all the error checking etc myself.
I don't like bloat or AI/LLMs and I focus more on minimalism to reduce surface attack areas while still focusing on security. There's nothing flashy about how I plan to approach this project. It's going to look ugly.
My main focus is to help create communication for local communities and not create tech that enables control over other peoples freedom.
I highly doubt my project will ever leave my community and that's fine, I'm not interested in making a name in an already crowded space.
What are you building for your community? I think smaller communities is really the spot where this hobby can have a greater impact in enabling people to collaborate in different ways.
The end goal at the moment is to have the script setup a minimal environment that would host a forum. That way people can organize themselves based on local community needs.
My current and more manageable goal is to create a script to setup a minimal environment for a basic blog. At the very least someone can make posts for their community or themselves. Once I have that baseline, then I'd work towards the larger goal if that's still how I feel after getting there.
I'm also interested in exploring different ways to be able to share local community servers/sites. It may look ugly, and may add slight inconveniences but it would be nice to have alternatives to big tech offerings. I'm leaning towards a small web concept. A focus on local communities helping themselves and neighbouring communities.
Home Assistant got a larger STT recognition model thanks to openvino (on an Intel NUC). The intent was to get better recognition of music artists names.
It's better, but not perfect. Instead I'm scraping the music directory for names and injecting them into a database that the automation can query.
I'm into this as a regular thing!
Pinned, I think a lot of us really enjoy seeing what others have been doing to take back and make improvements to our own setup.
Glad you like it! I tried to go for a 2-3 week cycle as I realized every week is a bit too often (less comments). I also tried to do it alternating with the community on slrpnk but they're currently down. I often forget to do these anyways :D
Anyone can make these, of course. I always enjoy doing them and talking about stuff I enjoy.
I deleted a bunch of services I’m not actually using on my home server. Nothing used php, but it was good to do some house cleaning.
I also started a blog (Hugo is much nicer than I thought). The procrastination has helped me get a lot of other things done.
Is there an easy way to do that ? I often think about all the random libraries and crap I've downloaded over time.. auto remove doesn't really clean anything up but if I look through the apt list I've got no idea what's a dependency of what.
With nix it was just deleting their config lines, firewall rules and then rming the data folders.
From my logs nothing bad happened to any of my services. I turned off my entire homelab for a few days until every single app/service had an update. Then I turned everything on, updated and that was that.
One cool thing I have is https://github.com/lklynet/hypermind totally pointless, but I like it.
Nothing really cool per se, but I installed Radicale on my local network as I am slowly moving away from my cloud providers.
Once I find some hardware to host Immich, I'll be fully self supporting on all my tech.
Radicale and immich replaced my nextcloud instance and I never looked back. I have both updating through apt like everything else and it's amazing how little maintenance it requires.
load more comments
(1 replies)
Using nix to maintain my fleet with automated updates so I didn't really need to worry about it thankfully; just checking that I had relevant/patched versions. All my services are nice and up to date so didn't even have to take anything down (yay)
What I'm excited for today is to progress personal slop project (be gentle) I started yesterday. Hoping it'll just be one or two weekends.
I've been hallucinating a transcoding suite/workbench. Includes experimental sampling matrix of ffmpeg settings with a composable / layer-based project configuration; rust egui+mpv desktop client. Then the hosted orchestration server can distribute ffmpeg jobs across my worker machines (via my local headscale tailnet). Output produces a project+metadata bundle that includes hand-picked source:result JXL frame comparisons alongside both human readable reports and client readable configuration that makes the projects (more or less) reproducible (with worker tool env versioning via nix flake.lock) and logs provenance.
I intend for this to be a replacement to the piles of crappy python scripts I've been using for the last decade; my current workflow is to move files into host-labeled ingest folders with an argument string in a text file, then ssh to the host to run the job.
But what I'm most excited for is the experimentation matrix. I hope that it will reduce my electricity usage and disk thrashing; it will let me sample settings for ~1minute of footage around the sample frame and let me iterate my tuning much faster. Currently, it's faster (in terms of hands-on time) to just transcode whole episodes or even entire seasons multiple times with different settings and then just discard the ones that underperform. Extremely wasteful; testing a settings matrix is something I've always wanted, but never had the time to build (and still don't, hence slop).
I've been focused so much on work-related stuff involving DST changes that I neglected my own systems!
view more: next ›