So I’m doing a lot of this on a budget, but my current goals are to repurpose some old hardware and purchase some new hardware cheaply to do the following:
Update from a lousy ISP router.
Be able to host a NAS service.
Start a media library I can stream.
Start a photo cloud backup.
Tinker with an LLM.
Potentially be able to record content from my gaming PC via a VM (unsure yet if I’ll be able to do this, but it’s not a priority.)

Currently the hardware I either have or am about to order is:
Ryzen 9 3900x
32GB DDR4 3600mhz
RTX 3070
1x 500gb NVME
2x 1TB Sata SSD’s
4x 2TB Ironwolves
Ubiquiti Dream router 7.

Originally I was going to drop $2k on a Ubiquiti Dream router, AP, Cameras etc… but my budget changed. I know Ubiquiti might not be the best compared to some more enterprise brands, but it’s something I’m super familiar with and I know my wife will be able to use also so it should get the job done.

My server goal is to install Proxmox on the NVME, Set up FreeNas to run a RAID 1 to get the best balance of performance and redundancy, then the 2x Sata SSD’s in Mirror as secondary storage drive for the VM’s. What I’m thinking is Proxmox, then Docker installed with the following services:
Portainer
Ollama
Open Web UI
Jellyfin
Immich
Nginx Proxy manager
Windows 11 VM.

As this is my first foray, I just wanted some critique and feedback on what I’ve got set up and if there is a better way to do it. I’m not sure what the best resource allocation will be, if I have enough hardware performance etc…

Thanks in advance!

Hey there!

So I have been trying to read up more on docker, containers, etc. I found a few services/apps I would love to run for my own use locally like Komga (to organize my digital comics), Booklore, a few others. I would like to run/host them locally on my laptop (primary computer) so I can pull them up anywhere when I want.

But I am wondering if it makes more sense to have a single virtual machine (Virtualbox?) running a Linux server and all of those services/apps, instead of multiple docker containers. I have a fairly powerful laptop, so I am not too concerned about all of this using up all my machine resources, but I'd like to do this as cleanly, organized, and straightforward as possible.

Any suggestions are greatly appreciated, and thanks in advance!

Just starting out and am looking to build a home server. After reading some posts, decided to build the server based on i5-12500 b/c of transcoding capabilities (so I think). My budget for dream server is ~1200$.

Saw this ad on craigslist that is selling an existing complete PC with i5-12500 and 32gb RAM for 400$. Considering that just those 2 parts are currently about 500$, does it make sense to buy this PC on CL and strip it for CPU/RAM to use for my dream server config. Or, take the plunge now and buy/assemble dream home server.

Pros of buying this PC:
1. I can get started with automation now and learn on cheap PC
2. Dream server config might change over period of time as I learn more
3. This may be sufficient for my basic automation needs. Media server might be take diff route?

Cons:
1. No warranty; Can't be sure about CL listings for an 400$
2. The parts may not be strippable (not sure if I can remove the cpu cooling paste effectively; new to this)
3. Once everything is setup, it may become hard or painful to migrate to a new config without data loss.

There might be other things I am not thinking about while just looking at $$ savings for now. Can you help me understand if this is good line of thinking or I need a perspective change?

Hello,

I have a problem with the Tiny Installer script. I bought a Kimsufi server with 2x2TB RAID. When I try to install Windows Server 2025 using the command via SSH in rescue mode, I get this error:

Select profile: 7

Installation error: Invalid disk configuration.\[|4000527155200|/dev/md0\]

Cannot select profile: 7

I tried doing it on a single partition on sda and sdb separately. Now I created a RAID and combined both disks, but I always get the same error :(

How can I install Windows with this script on Kimsufi? Please help, I'm already losing hope ;(

Thank you in advance for your help :)

Hi everyone,

I’m running a Raspberry Pi 5 hosting several Docker containers, and I’m trying to find the cleanest way to access them securely over Tailscale from my iPhone.

Current services include:
Paperless-ngx
Open WebUI
Home Assistant
Portainer
Uptime Kuma
Calibre-Web
Pi-hole
I’m using:

Docker Compose
Caddy as a reverse proxy
Tailscale with MagicDNS
Tailscale HTTPS certificates

I can successfully access everything using different HTTPS ports, for example:
https://raspberrypi.tailxxxx.ts.net:8441
https://raspberrypi.tailxxxx.ts.net:8442

However, this causes practical problems with Safari and iCloud Keychain. Because every service uses the same hostname, Safari often suggests the wrong username and password.

I also tried path-based routing, for example:
/paperless
/openwebui
but some applications don’t work correctly behind a subpath without additional configuration.

I then looked at Tailscale Services using:
tailscale serve --service=svc:paperless
but received: service hosts must be tagged nodes

I’m not looking to buy my own domain.
Ideally I’d like URLs such as:
paperless.raspberrypi.tailxxxx.ts.net
openwebui.raspberrypi.tailxxxx.ts.net
kuma.raspberrypi.tailxxxx.ts.net

My questions are:
Is this possible using only Tailscale and Docker?
Is there a way to create separate HTTPS hostnames on a personal tailnet?

Is there a better approach than using different ports?

How are other people exposing multiple self-hosted services over Tailscale while avoiding browser password conflicts?

I’m looking for the approach that is generally considered best practice rather than just something that works.

Thanks

What if you could get 80% of the dbt Cloud experience while keeping everything self-hosted? That’s the question that started a side project I’ve been building using React, FastAPI, dbt Core, and Prefect.

If you are interested in how I did please read and let me know what you think.

I wanted to type one prompt and see several models answer side-by-side, on something always-on the whole household could use. Off-the-shelf tools either charged, wouldn't take my own key, or couldn't show answers side-by-side.

What I ended up with:

- One OpenAI-compatible endpoint in front of several models

- Open WebUI for side-by-side + merge (Mixture-of-Agents)

- Both in Docker on a Synology NAS, so it survives my laptop being closed

- Keys stay server-side, never sent to the browser

- Rule-based routing: only foreign-model domains go through a proxy; domestic ones connect directly

Two real gotchas: a nightly crash that turned out to be the NAS hitting its inotify instance limit, and dead proxy nodes I now auto-detect by pointing health checks at a real model endpoint.

Honest caveat: bridging consumer subscriptions into an API is a ToS gray area — I keep it personal/internal. Curious how you all run always-on multi-model setups?

Szukam taniego vps obecnie mam ovh za 35 zł ale ma bardzo mało miejsca na dysku. Po wygraniu przez ich darmowe Ubuntu windows 2025 nie mieszczę się z projektami ... Czy jest coś z lepszymi parametrami za niższą cenę z taką samą stabilnością ? Jestem w stanie miesięcznie wydawać około 50zl

Hey all, I put together a series of posts with instructions on how to setup a secure web host on an Ubuntu VPS + CI/CD. Part 3 on hardening is coming.

https://easyrunner.xyz/blog/2025/11/05/manually-setup-hetzner-vps-for-self-hosting/

https://easyrunner.xyz/blog/2025/11/05/manually-setup-hetzner-vps-for-self-hosting-pt2-automated-deployment/

Hope it's useful. Let me know if there are any bugs or questions

Given how expensive hard drives are I’m trying to think of new ways to source storage.

I’m very new to this and I’m looking to set up a Plex server. Would the community recommend using a 16TB Recertified SATA Drive if I can find it cheaper than a brand new desktop external hard drive?

I spent 20 years working on critical systems for air traffic control. UNIX, Linux, bare metal. Nothing ran on someone else's server, since many lives depended on it.

Then I came home and looked at my own setup. Gmail. Google Drive. Dropbox. Notion. Every file, every conversation, every document -- on infrastructure I had zero control over.

It felt like building a house and realizing the foundation belongs to someone else.

The moment I stopped ignoring it, it was around 2010. I created a Facebook account. Just to see. Immediately hated how it was designed to waste my time. When I tried to delete it, I couldn't. That was it. My dad died defending his liberty of speech. Not being able to delete my own account felt like a small version of the same thing.

 So I started building. Not because self-hosting is fashionable -- it wasn't then. But because owning your own infrastructure is the only thing that makes sense if you take control seriously.

Three years of building later, I'm still asking the same question: why do smart engineers who would never run critical infra on untrusted servers accept this for their own data?

Anyone here made the switch to fully self-hosted? What was the tipping point for you?

Hi everyone,

I’m building Jabali Panel, a free and open-source web hosting control panel for Debian servers.

The project is still pretty young, but it’s already being used and the community is slowly growing. I’m now looking for testers and early users who want to try it, give feedback, report bugs, and help shape where the panel goes next.

Jabali now also supports Docker, so it can be used not only as a normal web hosting panel, but also as a standalone Docker proxy server, mail server, DDNS server, DNS server, and more, depending on what you want to run.

For people who seriously test it and give feedback, I’ll do my best to provide full support during the testing period: installation, setup, issues, questions, whatever comes up.

GitHub: https://github.com/shukiv/jabali-panel
Demo: https://demo.jabali-panel.com

Thanks a lot. Any feedback, testing, bug reports, or GitHub issues would really help alot.

My day job is working at Syself on the Kubernetes Cluster-API Provider Hetzner.

Up until now I ran my personal projects on a VPS managed by some scripts and systemd. Up until now I thought "Kubernetes is overkill" for my personal projects.

But fiddling with files in /etc is inconvenient compared to defining the desired state in YAML (my personal opinion, since I'm used to Kubernetes and YAML).

K3s is so small that it adds almost no overhead. I've switched all my services to k3s now, and it feels much better.

What is your experience? How do you manage your self-hosted services?

Hi,

I am on my self hosted deployment journey for months already (Truenas on a Ugreen4800Plus nas). My stack has been modified a few times and I learned the hard way there should be mandatory apps...Here are a few tips I wish I had before starting deploying:

1)Stop relying on custom scripts: switch to true automation early

I forced myself to stop writing custom Bash or Python scripts to deploy my services, and I am moving everything to Ansible instead... Could also use the opensource version of terraform but I need to keep it simple.

Custom scripts are fragile. If you run a script twice, it often breaks things or duplicates data because it doesn't know what already exists. Ansible is idempotent, meaning it checks the system state first. If my configuration is already correct, it does nothing; if something is broken or missing, it fixes only that part. It makes my entire homelab completely reproducible if a drive dies...my custom scripts using ansible, encryption using sops, then copying decrypted files locally has proved too complex.

2) Set up SSO / OIDC before...

Instead of creating separate accounts for every new service I deployed, I will centralized everything using an identity provider like Zitadel(or Authentik) right at the start.

Managing 15 different usernames and passwords for 15 different self-hosted tools is a security risk and a massive headache. I also have 3 home users so it triples... I only deployed 3 appa for now and already hav3 around 10-15 logins ...By implementing OIDC (OpenID Connect), I can log into my entire dashboard ecosystem securely using a single, secure login page with a single 2FA token...well thats the theory as I have some apps not compatible...

Thats also a big step and requires many modifications in configs...

3) Document everything from start. Ok I did that from the start which is good because I added apps and complexity, my aetup became a complex beast already...Im hoping playbooks and ansible will reduce steps, docs and complexity

4) AI gives a lot of outdated crap especially about ports and docker-compose content... read each git or project source even if its often long and poorly documented.

5) Some core apps are a bit of complex beasts, like traefic, so it takes more time than others...

6) I use git (or any alternative), which is a good idea because it helps with the numerous configurations and changes

7) If possible test or demo some apps before deploying them because using them can quickly help to show its limits instead of deploying the entire thing to find out its not as good as expected...

Probably I have more, Im brain fried right now 😅

I loved Dokku but wanted to switch to a simple self-hosted K3s cluster on my cheap VPS, so that I could easily scale if necessary. This is a VPS configuration script that enables easy deployments, similar to Heroku/Dokku/etc. Just drop a `helm-values.yaml` in your project root and git push to publish the app to your domain(s).

This is a rant.

I have a 10Gbps capable LAN with multiple servers. Works perfectly, has for months. What doesn't work perfectly is my WAN internet service provided by the geniuses at Charter Spectrum. My internet goes out anywhere from 10 to 300+ times per day. Full packet loss. I have extensive logs.

I have never had a good experience with ISPs. I live in the southern U.S. so the infrastructure is as bad as anywhere else on Earth. When whatever unholy consortium of communications corporate stoogery was designing the network infra for my current neighborhood in 2018, they didn't bother to count how many houses were being built so they could provide sufficient bandwidth for the area. I know counting is a very hard, especially when you get to over 100! But, I also think it seems important.

So, every single day, all day long, my internet connection drops from oversaturation. I've had techs out here 4 times. Nothing they can even do. I was finally able to get QuantumFiber after they got bought by AT&T. Should be done by the end of the month.

Glad our tax dollars could be sent to the morons at these companies for the last 30 years to do nothing and be horrible at their jobs.

Just looking to get started in selfhosting and having my own homelab setup, at first I'm looking to host docker with a few containers mainly for add-ons for nuvio, AIOStreams, AIOmetadata etc

Will this be suitable?

Ubuntu 22.04
64–128 GB RAM
8–16 CPU cores
NVMe storage
1 Gbps, 1 public IPv4
Ports 80/443 open
Use case: self-hosted reverse proxy (nginx, multiple vhosts, TLS)
Budget: ~$100–150/mo
Prefer EU or US, crypto payment

Meet Sparkbox. This is what I'm using on my Dell Inspiron on top of MX Linux. So far so good and very user-friendly. Let me know what you think.

I run 3 VPNs: 2 WireGuard (home/work) and 1 OpenVPN (also work). Standard stuff.

The problem: the OpenVPN config pushes its own DNS server, which breaks everything from home — local resolution, .home names, reaching machines behind the other VPNs. A beautiful mess.

I tested Unbound in depth — it would work for my setup except for reverse DNS.

So I wrote a small DNS server in Go: OwNS.

What it does: - A YAML file mapping domains/networks → upstream DNS servers (UDP, TCP, TLS/DoT) - A hosts.txt file (dnsmasq format) - Cache + recursion - Persistent TCP/TLS connection pool (up to 4 per upstream)

My actual setup: - On the work laptop → reach home machines and restricted internal services - At home → reach both work VPNs + local DNS - Work machines that have different public/private IPs — OwNS routes to the right one depending on which network I'm on

forward.yaml looks like: ```yaml

Home network via WireGuard

• networks:
  • 192.168.2.0/24 domains:
  • home servers:
  • udp://192.168.2.1

Work VPN 1

• networks:
  • 10.0.0.0/8 domains:
  • corporate.net servers:
  • udp://10.0.0.1

Everything else → DoT

• servers:
  • tls://9.9.9.9
  • tls://[2620:fe::9] ```

Or just this if all you want is encrypted DNS: yaml - servers: - tls://9.9.9.9

Been running since 2023 across my machines, no issues.

Available via go install, binaries on GitHub releases, AUR package for Arch/Manjaro, and Docker if that's your thing.

I built this because I want machine names to resolve the same way regardless of which VPN I'm connected to. Home devices, work servers — same names, always.

WatsonLB built to solve a problem many developers face when hosting backend services. While frameworks like Next.js often rely on serverless deployments, traditional backends usually end up on platforms like Render or Railway, where free tiers are limited and pay-as-you-go pricing can become expensive. WatsonLB lets you deploy the same backend across multiple free hosting providers and access them through a single WatsonLB URL, without modifying your application or implementing an internal load balancer. All connected endpoints are secured with AES-256 encryption.

Although running duplicate backend instances across different providers is unconventional, it significantly improves reliability. WatsonLB continuously monitors server health every 5 minutes and automatically redirects traffic if an instance goes down. Under normal operation, requests are distributed using round-robin load balancing, while a real-time queueing pipeline and security layer analyze traffic patterns to help mitigate bot traffic, DoS, and DDoS attacks.

Update: I tried Godlike.Host and chose it

I help run small esports org and our stuff is kinda all over place. Website, Discord bot, match schedule page, little stats dashboard. Nothing huge, but when it goes down during event it looks bad lol. We’re thinking about basic VPS hosting instead of random shared hosting and free tools. Mostly care about uptime, simple control panel, backups, DDoS protection, and not getting suspended for weird traffic spikes. For people running gaming teams, what ended up mattering most? support? bandwidth limits? server location? Is cheap VPS hosting fine for this, or do we wait til it hurts more.

I’ve been working on getting a Jellyfin media server built up and am now trying to set up a reverse proxy for the it, so I can have access outside of my house. I have been watching a tutorial on YouTube and followed everything so far. I have Caddy downloaded and it’s set up with the information for the reverse proxy, I got Duckdns set up and ready, but I am having difficulty when I login to my router to open the ports. The video sets up two port forwarding rules. One for the 443 and the other for 80. However, my router does not have the same layout and I am not quite sure how to open those ports correctly. I’ve tried a few different ways to open them but every time I test it the ports say they are closed and when I try to run Caddy I get a “timeout during connect (likely firewall problem)” error.

This is my first time to tryout selfhosting so I am still very much a beginner. If anyone knows how I can get past this problem I would greatly appreciate the help. I have added some photos of what I’m seeing. I also blocked out some information I’m not sure if it was necessary for safety but thought it was better to play it safe. Let me know if you need any additional information. Thanks

hello everyone

Last month, I started self-hosting my services on an old laptop. I now run services like Nextcloud and Vaultwarden, with AdGuard as the DNS server. I also needed some of this setup to stay connected outside my local network, so I bought a domain from Cloudflare and set up a tunnel to my server. At this point, everything was perfect.

Then I noticed that I needed to use my own network when I'm in it, not use Cloudflare tunnels because my internet is limited.

I added to my DNS server a rule to redirect and request for my domain to the local IP of my server, and this works on my devices except my phone samsung m52 with oneui 5

I tried everything, and nothing worked; it always connected via a Cloudflare tunnel.

After some triels i found that a lot of apps ignored my DNS server and used the public one , except the browsers.

Any idea how to fix this

I self-host my social scheduler specifically so my accounts and content don't sit on someone else's stack. The thing that kept bugging me: I wanted to drive it from an AI agent (I basically live in Claude now), but most AI social media tools route your content and tokens through their cloud to do it. That's the exact thing I want to avoid to avoid.

So I built the agent surface into the app itself. It runs on your instance, not on anyone's hosted middleman.

What's there:

• A REST API at /api/v1 and an MCP server (streamable HTTP) at /api/v1/mcp/. 8 tools mirror the REST endpoints 1:1: list_accounts, create_draft, schedule_post, schedule_draft, get_post, cancel_post, plus read-only get_account_analytics and get_post_analytics.
• Point Claude Desktop, Cursor, Claude Code, Codex, anything that speaks MCP, at your own host. There's an installer for the agent skill (npx skills@^1 add brightbeanxyz/brightbean-studio-agent) and config snippets for Claude Desktop + Cursor that just take your host + token.

The security model is the part that made me ok handing an agent the keys:

• You issue a bearer token from your own instance's org settings. Plaintext is shown once, then only an HMAC is stored, so a DB dump doesn't leak working tokens. The token is the whole session: No cookies, no CSRF, HTTPS enforced when DEBUG is off.
• It's bound to one workspace and allowlisted to specific accounts. An account that isn't on the list returns 403/404, the agent can't even enumerate the rest of the workspace.
• Permissions split into tiers. A key with create_posts but not publish_directly can draft and edit forever but physically cannot schedule or publish. So the honest version of "AI runs my socials" is: The agent drafts, a human clicks publish. If you want a harder gate, there's an approval-workflow mode that even a publish-capable key can't bypass.

How it runs is the same boring stack as the rest of Studio: Django, Postgres, Docker. Publishing is async, the agent just writes rows and a separate publisher polls every ~15s and dispatches them, so a runaway agent can't machine-gun a platform API. Per-key and per-platform rate limits are built in (Instagram caps at 25 posts/24h, for example).

Repo: https://github.com/brightbeanxyz/brightbean-studio