r/selfhosted

🔥 Hot ▲ 411 r/selfhosted

Cloudflare is the most successful "Man-in-the-Middle" in history

I was thinking about the NSA scandals from years ago, the wiretapping, the underwater cables, the backdoors in datacenters. It was a massive international drama.

But then you look at Cloudflare. By design, they are a massive, legal Man-in-the-Middle. They decrypt, inspect, and re-encrypt the traffic of millions of websites. We’ve reached a point where "privacy" means "hidden from everyone EXCEPT Cloudflare."

It’s the ultimate irony: developers are so obsessed with "security" that they put their entire stack behind a single US-based entity that holds the private keys to half the internet. We basically did the NSA's job for them, and we did it voluntarily because the dashboard is pretty and the CDN is free.

Am I the only one who finds this centralization terrifying, or have we just accepted that true end-to-end privacy is dead in the name of DDoS protection?

reddit.com
u/Antique_Mechanic133 — 2 hours ago
I'm hacking the Apple Time Capsule so that it will work even after Apple removes support for it from MacOS. I'm 95% done, but need some volunteers to help
🔥 Hot ▲ 142 r/selfhosted

I'm hacking the Apple Time Capsule so that it will work even after Apple removes support for it from MacOS. I'm 95% done, but need some volunteers to help

For the people who don't know: the Apple Time Capsule (2008-2013, rip) is basically a hard drive strapped to a wifi router. Most importantly, the hard drive part works really well for smooth Apple Time Machine backups for anyone with a Mac. Just come back home, your macbook automatically connects to wifi, and automatically starts backups.

Well, Apple's trying to kill it off with the next version of MacOS next year. Apple is removing AFP support from MacOS, which means the computer can no longer connect to the Time Capsule, which only supports AFP and SMB1. (Apple already removed SMB1 support from MacOS many years ago. SMB1 was notoriously insecure and caused the WannaCry worm).

A few months ago, I started this project, got it halfway done, got frustrated because cross compiling stuff for NetBSD6 on a Mac was painful, and stopped working on it: https://github.com/jamesyc/TimeCapsuleSMB

I'm finally finishing it up the past few days, and it's 95% done. It works! (For running Samba 4.8 with SMB3 on my Time Capsule). I can use it as a network drive in Finder, as macOS uses SMB3 to connect to it (not SMB1).

It's almost at my long term goal: hacking the Time Capsule enough that anyone who can copy some terminal commands can spend 10 minutes, and get their Time Capsule working with future versions of MacOS.

Unfortunately, due to sheer bad luck, Apple broke macOS Time Machine backups in 26.4 recently: https://www.cultofmac.com/news/macos-tahoe-26-4-breaks-time-machine-network-backups There's a workaround, but it doesn't work for everyone, and it's not working for me.

This means I can't actually properly test it. Also, I only own a A1470 generation Time Capsule, so I can't test the code on other generation devices as well.

I'm asking for some people who are a bit more on the technical side (translation: more comfortable with using the terminal than my grandmother) who have a spare Apple Time Capsule to help out with some testing. If you only have a little bit of free time, feel free to read the README in the repo and try it out. File a github issue if you run into any problems: https://github.com/jamesyc/TimeCapsuleSMB/issues

If you're willing to volunteer more time, especially if you have a mac that is NOT on 26.4, comment below what specs you have for your Time Capsule and Mac and I'll try to figure out the best strategy to quash the last few bugs.

u/jaxchang — 7 hours ago
Built an open-source Nepali calendar API that computes dates astronomically
🔥 Hot ▲ 66 r/SideProject+4 crossposts

Built an open-source Nepali calendar API that computes dates astronomically

Been working on this for a couple months. It's called Project Parva, basically an API that computes Nepali calendar stuff (BS/AD conversion, festival dates, panchanga, muhurta) using real planetary position data from Swiss Ephemeris rather than storing hardcoded dates someone typed in from a government PDF.

The main thing that bothered me about existing stuff is they all assume Kathmandu. If you're building something for diaspora users, the sunrise-dependent calculations (tithi, muhurta windows) are just wrong for anyone outside KTM. This one takes actual lat/lon.

Verified against 65 dates from MoHA holiday PDFs across 2080-2082, passes all of them.

Here's my project,
GitHub: https://github.com/dantwoashim/Project_Parva

reddit seems to flag the direct link to the API

 (AGPL, open source)
Happy to answer questions or take feedback on what's missing.

u/Natural-Sympathy-195 — 2 days ago
Musicseerr - a self-hosted music request and discovery project built around Lidarr
🔥 Hot ▲ 111 r/selfhosted

Musicseerr - a self-hosted music request and discovery project built around Lidarr

Hello everyone, my name is Harvey - I'm a backend software engineer from the UK. I've been really into self-hosting, privacy, etc recently and for the past 6 months I have been working on this project, Musicseerr.

It started as I was looking for something to bridge a gap between slskd and Lidarr where I could search for music and request directly to Lidarr (A bit like the Jellyseerr/Arr flow) but I couldn't find anything. So, around 6 months and I've finally released Musicseerr into a v1. It currently supports the following features:

  • Search & Request - Search the full MusicBrainz catalogue and send requests to Lidarr
  • Built-in Player - Stream from Jellyfin, Navidrome, local files, or YouTube, with a 10-band EQ
  • Discovery - Personalised album recommendations based on your listening history
  • Home - Trending artists, popular albums, and genre-based sections
  • Scrobbling - ListenBrainz and Last.fm support
  • Library - Browse and filter your Lidarr library with full artist/album pages
  • Playlists - Create and manage playlists with playback support
  • Requests page - Track, retry, and cancel requests

I'm pretty proud of it but I still know that there's a lot that could be added, and it's definitely due some user testing! I'd love for anyone to give it a go, I'm always open to bug-reports/feedback/suggestions so feel free to send them to me on here, or on the discord linked in the Github/Website.

Thanks all and I hope it helps some of you :)

github.com
u/HabiRabbit — 23 hours ago
We made our VIN decoder 100x faster. Again
🔥 Hot ▲ 93 r/selfhosted

We made our VIN decoder 100x faster. Again

Follow-up to our previous post.

First, the v3 rewrite: SQLite was killing us on batch operations - 1000 VINs meant 4000 queries. We switched to binary indexes and now it's:
- Cold start: 200ms -> 23ms
- Single decode: 30ms -> 0.3ms
- Batch 1000: 4 seconds -> 300ms

Still fully offline, still no API keys.

On the EU data feedback: this is the real problem we've been digging into. Vehicle data is a mess globally, but especially across regions:

-US sources use 37k+ boolean feature keys with values embedded in key names ("12.3\" display": true)
- Canadian sources use nested category structures - better, but incompatible
- EU sources have great mechanical specs but almost no feature data

Same car, three regions, three completely different data contracts. And trim names are chaos:
- a US "Premium Plus" is a Canadian "Progressiv" is a German "45 TFSI quattro S tronic".

We're working on a schema standard (VIS) to normalize this. The goal: decode a VIN anywhere, get the same structured output regardless of source. Will share more when it's ready. As always - fully open source - code here: https://github.com/cardog-ai/corgi/

cardog.app
u/cardogio — 22 hours ago
Image 1 — Foldergram v1.1.0: self-hosted local photo/video gallery with an Instagram-style feed, Stories, Reels, and search
Image 2 — Foldergram v1.1.0: self-hosted local photo/video gallery with an Instagram-style feed, Stories, Reels, and search
Image 3 — Foldergram v1.1.0: self-hosted local photo/video gallery with an Instagram-style feed, Stories, Reels, and search
Image 4 — Foldergram v1.1.0: self-hosted local photo/video gallery with an Instagram-style feed, Stories, Reels, and search
Image 5 — Foldergram v1.1.0: self-hosted local photo/video gallery with an Instagram-style feed, Stories, Reels, and search
Image 6 — Foldergram v1.1.0: self-hosted local photo/video gallery with an Instagram-style feed, Stories, Reels, and search

Foldergram v1.1.0: self-hosted local photo/video gallery with an Instagram-style feed, Stories, Reels, and search

I posted Foldergram here when it first launched and got a really good response, so I wanted to share the latest update.

Foldergram is a self-hosted, local-first photo/video gallery I built for my old backup photos because I wanted something that feels more like scrolling my own old posts instead of browsing files in a traditional gallery.

It scans an existing gallery folder, indexes everything locally, generates previews/thumbnails, and gives you an Instagram-style feed, folder pages, and a post viewer. The goal is still the same: make revisiting old photos actually feel enjoyable.

Since the first public release, it has grown quite a bit. Recent updates added:

  • Reels-style browsing for local videos
  • Stories and highlights support from the reserved AppFolder/stories folders
  • Explore search with media/folder tabs and recent searches
  • Admin/Viewer/public access modes
  • Original media download actions from the feed, post viewer, stories, and reels
  • Better post viewer behavior and cleaner canonical routes
  • Configurable excluded folders from .env or from Settings
  • A new app-managed preview/thumbnail layout that is easier to maintain long-term

It is still intentionally local-only:

  • no cloud sync
  • no external API
  • no SaaS account
  • built for personal/offline or LAN use

If you tried the earlier version, this release is much more complete. I would especially love feedback from people who have used other self-hosted gallery apps and care about the browsing experience, not just file management.

Repo: https://github.com/foldergram/foldergram
Docs: https://foldergram.github.io/
Demo: https://foldergram.intentdeep.com/

u/sajjadalis — 19 hours ago
What does your stack look like? Sharing my single-node k8s homelab and curious what you all are running
▲ 1 r/selfhosted+1 crossposts

What does your stack look like? Sharing my single-node k8s homelab and curious what you all are running

TL;DR

I'm building out my self-hosted setup and would love a sanity check from the community. I'm trying to figure out if I'm using the wrong or overly complex tools for my goals, and I'm really curious to see what you all are building for similar use cases

Background:

I'm an experienced platform/infra software engineer. Some of my tooling choices might seem "complex" for a homelab, but they're actually easier for me due to professional familiarity.

My main motivation for self-hosting is having a reliable, private, and opex-efficient way to run services that make my life easier. It gives me the ick knowing my data is owned by private companies, siloed away, and tied to subscription fees. Especially when they can randomly change the rules on me based on someone else's timeline.

Some key use-cases:

  • Media backups (mostly books; writings/documents, pictures)
  • Data warehouse (emails, chat history, financial transactions, ...)
  • Automation (e.g. autobooking gym PT)
  • 2nd brain --> Eventually, I want to wire Obsidian/LLMs into a personal data warehouse so I can search through organically structured data

Stack

GitOps configuration. Any backups on 3rd party services (e.g., B2) must be encrypted client-side.

Compute

  • Hardware: Single-node homelab, mini-PC.
  • OS/Orchestration: Talos Linux with Secure Boot & TPM encryption keys. Kubernetes.
  • Registry: Zot. A single-binary image registry. It does the job and is super low maintenance.

Storage

  • Longhorn CSI (Container Storage Interface). Regret using it...it's very memory heavy. Alternatives when/if I switch:
    • local path provisioner looks neat, has single-node RWX support, but lack volume size limits
    • Some zfs/btrfs automation like https://openebs.io/?
    • Note: I originally wanted something simple to avoid Ceph/Rook, but maybe I was wrong.

File Storage: A single RWX volume (Longhorn implements it as NFS under the hood). Database: PostgreSQL (cnpg) as my main OLTP database. Most products support it, and I prefer it over SQLite just to keep cognitive overhead low. Backups: Kopia for backing up storage and databases onto Backblaze B2.

Observability

  • Prometheus+vector+Loki+Tempo & Grafana:
    • I dislike their storage model, but it's good enough for now. Something like Qryn looks neat, with single analytical database to keep mind on.
  • Alertmanager I seldomly check. Haven't wired up any notifications yet

Networking

  • Cert-manager
  • Contour ingress controller:
    • Client authN is annoying, has to be external service. Traefik's forward auth plays nicer with authentik. Maybe I'll switch eventually

Releases

Deployments: Argo CD Core Dependencies: Renovate VCS: GitHub (I'll eventually replace this with Forgejo) CI: Woodpecker CI

Security

  • Secrets: 1Password for secret management, with their 1password-operator. It's neat!
  • AuthN/Z: Authentik
    • It's a bit resource-heavy, but it supports a lot of features. The hope is that it will support whatever random system I want to integrate in the future (LDAP/OIDC/mTLS/etc.).

Applications

Next steps

  • S3 compatible API for data-lake. Generally I'm thinking:

    • Maybe MinIO, exposing main RWX volume as S3 API?
    • Or SeaweedFS?
  • Analytical database:

    • Delta Lake or IceBerg. At a personal scale, interoperability is a much higher priority than raw "performance," thus avoiding ClickHouse.
    • Datafusion for queries. Ideally via ADBC interface. I could use CH over open table format as well.
    • Superset seems neat for visualisation; better fit over grafana for certain usecases
  • Some nice low-code PostgreSQL UI

  • Some automation platform?

    • n8n & temporal look neat

Conclusion

What do you all think of the stack? Anything you'd swap out or do differently? (Especially interested if anyone has strong opinions on my 'Next Steps'!)

If anything stands out and you're wondering why I went with X instead of Y, just ask. I'm more than happy to jump into the comments and explain the reasoning behind my choices!

u/Citopan — 40 minutes ago
Chiri - a cross-platform CalDAV-compatible task management app for desktop
🔥 Hot ▲ 57 r/selfhosted

Chiri - a cross-platform CalDAV-compatible task management app for desktop

Hi! I've been working on a cross-platform CalDAV-compatible VTODO task management app for a while now since December of last year - it's called Chiri.

https://github.com/SapphoSys/chiri

The app supports:

  • Subtasks, statuses (needs action, in progress, cancelled, etc), progress, tags, repeat tasks, reminders, etc
  • Backwards compatibility with clients like Apple Reminders (macOS), Nextcloud Tasks, Tasks.org (Android) and DAVx5 (Android)
  • Almost every CalDAV server implementation (RustiCal, Nextcloud, Baikal, Radicale)
  • Managed CalDAV servers (Mailbox.org, Fastmail)
  • Server auto-detection so you don't have to hunt down for the exact principal URL
  • .mobileconfig files to import your CalDAV accounts

Honestly, I'm pretty happy with how it turned out and evolved compared to where it was a few months ago.

The app is still in active development, but I have been using it daily to get things done. Let me know what you think! ^^

u/solelychloe — 22 hours ago

PolicyFS - open-source FUSE filesystem for self-hosted media storage

I built PolicyFS for a very specific problem: apps like Plex, Sonarr, Radarr, and Bazarr love to scan libraries on their own schedules, which means HDDs keep waking up even when nobody is actually watching anything.

PolicyFS presents multiple disks (SSDs + HDDs) as a single mountpoint, but for HDDs metadata lookups are served from SQLite instead of touching the disks directly. In practice, that means scans and directory listings can be handled without walking HDDs. Only actual file access needs the physical disk.

What it supports:

  • glob-based routing rules for read/write targets
  • SSD-first writes
  • a built-in mover to migrate colder files to HDD by age, size, or disk usage
  • deferred delete/rename logging for indexed HDD paths, so metadata mutations don't force immediate spin-up

For home media, the intended setup is pfs + SnapRAID: flexible disk expansion, practical parity protection, and HDDs that can actually stay asleep until playback.

Even if spindown is not your main goal, pfs can still work as a transparent SSD write tier in front of larger HDD storage.

Single binary, one YAML config, includes systemd units. Not intended for databases, Docker volumes, or workloads that are heavy on fsync or mmap.

Homepage: https://policyfs.org

GitHub: https://github.com/hieutdo/policyfs

reddit.com
u/hieudt — 12 hours ago
BluFiles - Self hosted file sharing and management platform

BluFiles - Self hosted file sharing and management platform

Hi self hosters! I took on myself to make a fully open source and self hostable file sharing platform, which took shape as BluFiles!

This sports a modern and sleek interface with support for files and folders (of course), pastes and collections (groups of files for sharing). Smart uploading of files, supporting 8GB+ with high speed uploads (saturates 1000mbps at least from testing)

Sharing files is probably the main deal, with two clicks you can share files and pastes, or entire folders and "collections". You get an easy overview of your shared stuff making it simple to see what's gaining attention and to remove sharing for stuff. Shows rich information and preview of the file (for images and videos) when sending links on platforms like Discord or Slack.

Looking for feedback on this one, anything is appreciated:)

Source code: https://github.com/BluDood/BluFiles

Documentation: https://docs.files.bludood.com

u/RealBluDood — 17 hours ago
I built Docksentry — a Docker update manager with Telegram bot, Discord, Web UI, and auto-rollback
▲ 1 r/selfhosted+1 crossposts

I built Docksentry — a Docker update manager with Telegram bot, Discord, Web UI, and auto-rollback

Hey r/selfhosted!

I've been working on **Docksentry**, a lightweight Docker container update manager. It monitors your running containers for image updates and lets you manage them through Telegram, Discord, a Web UI, or webhooks.

**What makes it different from Watchtower?**

- **Interactive control** — Telegram bot with 14 commands, inline buttons for per-container updates

- **Auto-rollback** — if an update fails or the container becomes unhealthy, it automatically restores the previous version

- **Web UI** — full dashboard with status, logs, settings, pin/unpin, auto-update toggles (all settings persist across restarts)

- **Multi-channel** — Telegram (interactive), Discord (rich embeds), generic webhooks (Ntfy, Gotify, Home Assistant)

- **Docker Compose support** — detects Compose stacks and uses native `docker compose pull/up`

- **Pin containers** — freeze specific containers at their current version

- **16 languages** included

- **Zero dependencies** — Python standard library only, no pip packages

**Quick start:**

docker run -d \

--name docksentry \

-e BOT_TOKEN=your-token \

-e CHAT_ID=your-id \

-v /var/run/docker.sock:/var/run/docker.sock \

amayer1983/docksentry:latest

**Links:**

- GitHub: https://github.com/amayer1983/docksentry

- Docker Hub: https://hub.docker.com/r/amayer1983/docksentry

It's MIT licensed, and I'd love feedback! There's a community roadmap issue where you can vote on features: https://github.com/amayer1983/docksentry/issues/2

u/Neo007-1 — 2 hours ago

Is paying for privacy just a false sense of security? Self-hosting is the only option ?

Do you think paying for “privacy-friendly” apps is a real long-term solution, or just a better short-term fix?

I mean: even if we pay, we are still trusting a company with our data.

So I’m wondering:

Do you personally prefer trusting a company to do the right thing,
or having full control yourself (for example with self-hosting)?

reddit.com
u/christiangomez92 — 7 hours ago
▲ 2 r/selfhosted+1 crossposts

Beginners' guide: Unified Personal Cloud & Remote Gaming Station (on bazzite-deck)

I wanted to learn more about self hosting and servers, and I was looking for something practical that is completely free aside from the hardware, and that I can keep improving over time by adding more features once I have a solid foundation.

I’ve been working on this setup over the past few weeks and tried to document everything in a beginner friendly way, basically how I wish I had found it when I started. I’m still a complete beginner and while I’ve learned a lot, I’m sure there are many things that could be improved with more experience.

I also started as a total Linux beginner and didn’t know anything about this kind of setup. Claude and Gemini, both on free tiers, were a huge help along the way for research, understanding how a setup like this should look, creating and learning bash scripts and syntax, and making sure I didn’t leave anything undocumented so it’s easier to troubleshoot and reproduce later on.

I really hope it’s useful for anyone looking to learn new skills or set up their own self hosted personal cloud and cloud gaming system.

For hardware, I’m personally using the GMKTec NucBox K8 Plus.

Here the guide: Unified Personal Cloud & Remote Gaming Station

reddit.com
u/NumerousBand5901 — 5 hours ago

A couple of network security questions (VLANS and container vs VMs)

I have been setting up a home server for my family and I've made pretty good progress so far in getting to a position where I can start exposing services to family members. I've got VLANs for internal and external services, along with one for IoT devices, reverse proxy setup with my DNS managed through Cloudflare, geoblocking and rate limiting rules in cloudflare, looking into fail2ban, integrating an authentication service like authentik, and then will feel pretty good at that point.

My 2 questions though. Just HOW segmented is considered best practice from a network security standpoint, is it ridiculous to make a VLAN for each exposed service or could they be lumped together in 1 VLAN? I've been most lump them together but my brain wonders why they couldn't be totally separate.

Then question 2, I have read so many conflicting ideas on what to put in a VM and what to put in a container. I know VMs are generally safer because they are completely isolated, but have way more overhead to running them. Is it reasonable to group services together in a VM? Like if I wanted to setup an arr stack for various types of media, is it reasonable that all of them would be managed in 1 VM? The server is running on Proxmox if that makes any difference, but I suspect it doesn't. Just really want to stay on top of security for my family.

reddit.com
u/swagmessiah00 — 14 hours ago
I built a 3D Docker dashboard with anomaly detection, crash diagnostics, and dependency impact analysis

I built a 3D Docker dashboard with anomaly detection, crash diagnostics, and dependency impact analysis

Hey everyone!

I've been working on DockScope, an open-source browser-based Docker dashboard.
It turns your containers into an interactive 3D graph so you can see your whole stack at a glance and manage everything from one UI.

What it does:

  • 3D force graph of all your containers, color-coded by health, with dependency arrows and network links
  • Live CPU/memory sparklines and network I/O, polled every 3s
  • Anomaly detection that flags CPU/memory spikes with pulsing indicators on the graph and toast notifications
  • Crash diagnostics that auto-analyze exit codes, OOM status, and last log lines when a container dies
  • Dependency impact view (press I) to see what breaks if a container goes down. Traverses depends_on upstream and dims unaffected nodes Real-time log streaming with search and export Embedded terminal (shell into any container)
  • One-click container actions: start, stop, restart, pause, kill, remove

Try it:

docker run --rm --pull always -p 4681:4681 -v /var/run/docker.sock:/var/run/docker.sock ghcr.io/manuelr-t/dockscope

Or:

npx dockscope up

Open source, MIT licensed.

GitHub: https://github.com/ManuelR-T/dockscope

Would love feedback from anyone running Compose stacks. What would make this useful for your setup?

u/Kero-neo — 15 hours ago

What bookmark manager are you currently using?

I know this question gets asked every couple of months, but I'm having a hard time deciding what to use instead of Linkding. I've been really happy with Linkding over the past few months, but it doesn't support multiple word tags (i.e. "Reddit Posts" etc.), so I'm looking for a new app to use in its place. I've set up Linkwarden, it's pretty decent so far, though I definitely miss how snappy Linkding is. I'm also tempted to try out one of the other options that has AI tag generation, but at the same time Karakeep does seem a bit heavy as well. I do also much prefer a list-based UI rather than the grids of Linkwarden and Karakeep.

Let me know what you're currently using and if you have any suggestions for me, thanks!

reddit.com
u/gooseta — 10 hours ago

I'm planning a primary backup system - but read TrueNAS is turning evil - what are my options?

I was planning a truenas setup but now I'm not so sure any longer

reddit.com
u/plolock — 9 hours ago

Whats a good backup strategy for VPS?

hey all. I'm currently running a VPS and several applications on my VPS. Vaultwarden, Immich, Searxng and some others. I want to be prepared in case anything explodes. Can you guys recommend me a good backup strategy? Would using a snapshot option on the VPS be enough?

reddit.com
u/ThatrandomGuyxoxo — 9 hours ago
I built a minimalist time-blocking tool for my own daily use. no data risk, data stays in your browser.
▲ 2 r/selfhosted+1 crossposts

I built a minimalist time-blocking tool for my own daily use. no data risk, data stays in your browser.

Why I built this:

I built a time-blocking/time-boxing website for my own personal use which is heavily inspired by timebox.so.

The Privacy benefits:

  • Zero Data Risk: Your data never leaves your machine. Everything is stored in your browser.
  • Export/Import: Since it's local-only, I added a feature to export your data to a file so you can move it or back it up manually.

Link: https://nitish-17.github.io/Timebox/

Source: GitHub Link

github.com
u/EitherComfortable265 — 8 hours ago
Week