I’ve been around selfhosting most of my life and have seen a variety of different setups and reasons for selfhosting. For myself, I don’t really self host as mant services for myself as I do infrastructure. I like to build out the things that are usually invisible to people. I host some stuff that’s relatively visible, but most of my time is spent building an over engineered backbone for all the services I could theoretically host. For instance, full domain authentication and oversight with kerberized network storage, and both internal and public DNS.
The actual services I host? Mail and vaultwarden, with a few (i.e. < 3) more to come.
I absolutely do not need the level of infrastructure I need, but I honestly prefer that to the majority of possible things I could host. That’s the fun stuff to me; the meat and potatoes. But I know some people do focus more on the actual useful services they can host, or on achieving specific things with their self hosting. What types of things do you host and why?
Public services: my social network(hubzilla), Email(mailcow), Matrix chat, Peertube.
Private: my media (jellyfin, audiobookshelf, calibre, homeassistant.
I enjoy the freedom that comes with this and its like having your own home on the internet. I have a very modest setup but its enough to host my friends and family so nothing fancy like k8s. Just a refurbished optiplex running docker :)
@0x0 headscale/tailscale. I have a VPS that gives me a public IP so i use that to host a headscale control plane.
I self host jellyfin, nextcloud, owncast, tandoor, komga, photoprism and searxng. I use nginx proxy manager for a reverse proxy and SSL cert automation. Works great for me but I would like to get into traefik sometime.
I self host for privacy reasons, also it’s fun, it’s a learning opportunity and sometimes self-hosted services are functionally better than the other options out there.
I use nginx proxy manager for a reverse proxy and SSL cert automation. Works great for me but I would like to get into traefik sometime.
I got tired of the NPM and went to traefik for 2 reasons.
-
NPM kept locking me out of my account (admin), like 4 times during the time I was using it. That meant that it was not reliable enough for daily use.
-
From what I heard is that the NPM project only has 1 developer and so they can’t really respond and fix security flaws in a proper timeframe.
I’m using traefik now for internal traffic while VPN in if I need internal services while out and about.
Jim’s Garage has a great YouTube video on setting it up.
From what I heard is that the NPM project only has 1 developer and so they can’t really respond and fix security flaws in a proper timeframe.
It’s mostly just nginx with a webui. You can even see the nginx config files if you bash into the container. It has the same bugs as upstream nginx. Do not expose the management port to the internet.
Plus compared to normal nginx, it’s harder to misconfigure it. Most of my services are just the default config, so I can’t mess it up accidentally.
About lockouts: Once also happened me, but that was just a messed up update, next update fixed itself. If you lock yourself out you can usually edit the db directly, it defaults to sqlite, but I used it with mariadb.
How did you set up a VPN to securely connect to your services over the internet? I have looked for guides to do this and haven’t had much luck. I would really like to implement this in my setup.
I can once again refer to Jim’s Garages video about setting up wireguard on Docker. Very easy.
Wg-easy, with a nice interface.
Everything
Yeah hosting email as a company is a pain. I can’t imagine selhosting it. At least in a company people can search you online.
(Preface: almost all of this is handled in a single Nix config, and no docker in use at all)
At home, in a two-hosts Proxmox cluster:
- blocky for adblocking
- a full *arr stack with torrents and nzbs for uuuuuuhhh Linux ISOs
- Jellyfin so friends and family can watch, I mean use the Linux ISOs
- Paperless (HIGHLY recommend)
- Wastebin (Pastebin alternative)
- Sterling-PDF (also really recommend, allowed me to get rid of Acrobat Reader for filling out and signing PDFs, plus a bunch more)
- Homeassistant
- Linux and Windows clients available for whenever you might need them (not often, but can come in handy)
- Borg client, backing up parts of my NAS to a cloud storage box
- OPNSense backup for the hardware firewall
- Forgejo
On a bare metal machine at a reputable cloud provider:
- my personal Email, Calendar, Contacts (super easy with Nix)
- another blocky instance
- another borg client
- Rustdesk server (OSS Teamviewer)
- wireguard that’s just used by my TV so crunchyroll thinks it’s in (other country), Lmao
Wishlist:
- Vaultwarden
- Immich, once added to nixpkgs
- PeerTube
- Pixelfed
If you want to keep everything inside a singular Nix configuration while still using Docker, you can check out the NixOS option virtualisation.oci-containers - essentially, a declarative way of managing docker/podman containers (similar to docker-compose) but with Nix.
Any chance you could share any of your Nix config? I’m curious how it’s being used with Proxmox (I’m using ansible and terraform right now).
I thought about adding a link, but am a bit hesitant to de-anonymize myself on here 😅
But it’s basically this:
- Proxmox is not Nix configured. There’s a project for that, but IMO t’ll take a couple of years to be ready for production.
- I’ve created a custom nix module that essentially just sets my default values for stuff like bios type, boot order,… And allows to set CPU cores, RAM, IP,…
- all this does though is just setting the corresponding values from the nixos-generators proxmox output
- additionally, all the usual stuff is handled (user, known ssh keys, base config of the system)
- for each VM, I only have a single file containing the VM settings (ID, RAM, cpu, ip,…) and the service config for whatever the VM is for
- then lastly I have a custom script/shell that essentially just allows to do “nixvm-new <flake output name>” which generates the image, moves it to the nas, and calls on proxmox to import the image, plus some cleanup
TBH this sounds way more complicated than it is / feels to use 😄
I’ve seen a few mentions of PiHole and AdguardHome, I started on PiHole, then moved to AdguardHome for adblocking. Then I heard about and have been using TechnitiumDNS server which is sort of overkill for our needs, but with the right ad-lists, it is fantastic at blocking advertisements on my home network. Super fast install too, even on a Raspberry Pi 2 :) I run that along with Proxmox-VE (Protected behind OIDC Login) and several other containers on my cranky old Dell Desktop server.
Mostly Vaultwarden, and a few other services for home private use such as PairDrop for inter system sharing and a self destructing file sharing server for when we need to send documents to our Attorney’s (rarely but sometimes we need to) office via Pingvin.
I also run:
- Home Assistant
- Transmission Dockerized so I can help contribute to the Linux community and share the ISO’s.
- For some of my externalized sites, I run Authentik It acts sort of like a Reverse Proxy if you configure it to do so. I love that I can simply identify myself with my WebAuthn device skipping any passwords. :)
With Authentik setup, I can login to things like my Fresh Tomato Router TechnitiumDNS (Both use HTTP Auth headers) and Memos which uses OIDC/SSO. It’s meant to replace our Google Keep notes.
- Tailscale is installed and I connect to it from my phone when away from home to always stay on my network. Sometimes, hotspots block it so I generally avoid those as much as possible.
- Wallos to help keep track of our re-occuring subscriptions.
- Grafana and Promethus - both are staged and ready for configuration and one of those I will get around to eventually.
- InfluxDB - I plan on moving Home Assistsant logging soon to that which should tie nicely into Grafana later.
- Ben Phelps’ Homepage - it’s my main server dashboard my wife and I use to access our server. Quite simply one of the best dashboards IMHO.
- Wyze Cam Bridge - One of the better services in which you can log into your Wyze cams and convert their streams to RTSP, RTMP or HLS streams easily. I have that feed to my Home Assistant Security Dashboard.
- Baserow It’s a good Airtable alternative and I use it to keep track of my Static IP assignments, Sleep tracker (I suffer from insomnia), and other data points. It’s pretty amazing. I even created a pain logging for for my wife so she just accesses it and answers basic questions about her pain levels and it pushes it to the database for later retrieval.
- Joplin Server - Sorry, I don’t have the link, but it’s installed via compose. I use Joplin Notes on my phone and computer for keeping my code snippets. I’ve tried Obsidian and it didn’t really meet my needs and Also Anytype, but that’s not self-hosted. Joplin server is for me and that’s become handy a time or two when on the road.
- Bookstack - my grand plan for that is to build a Wiki for my family to use in the event something should happen to me, they can know how to manage the server with nice screenshots and instructional steps. I have that protected behind Authentik’s OIDC logins.
- IT-Tools - hands down one of the coolest self hosted tool sets you can use.
- Webcheck - All-in-one OSINT tool for analyzing any website https://web-check.xyz/ is their demo site. :)
- Stirling PDF - Kind of like a Swiss-army knife for PDF’s. :)
- Dozzle - For those times with you really need to see what your Docker logs and too lazy do run a
docker logs -followcommand.
I still use Portainer-CE and am happy there, I may try Dockage or the others, but it’s fine for what I need it for (It’s also protected by OIDC)
I’m sure I may have missed a few, but this post has gone on long enough. :)
A bunch of people recommend dozzle in this thread… I’ve been using Dockge. I wonder how they compare. I’ll have to check that out later.
Dozzle is just log viewing plain and simple. Dockge shows more that’s all I know. I tested Dockge earlier on in development and haven’t been back since, I know it’s grown a lot more since.
It’s not so much that Dockge shows more, and more that it does more. Log viewing in Dockge is actually pretty bad; it’s honestly the one thing that really needs more work. But Dockge is a full management plane; it allows you to deploy, modify, bring up and bring down entire compose stacks. Dozzle is only a log viewer, nothing else. Given that log viewing is the one thing Dockge does badly, they’re actually a perfect complement to each other, and I’d strongly recommend running both.
IT-Tools - hands down one of the coolest self hosted tool sets you can use.
Looks similar to Cyberchef. Any reason to use that one over Cyberchef?
