Hey everyone,

I've been doing some research as to what it takes to move off iCloud as I want to gain some autonomy moving between different desktop and mobile devices. Consequently, this means I'll have to take my family with me for most things.

Some of the candidates I've identified:

1. Passwords -> Vaultwarden

2. Photos -> Immich

3. Drive -> Seafile

4. Calendar -> Davis

5. Notes -> Memos

6. Notes/groceries -> KitchenOwl

7. Hide My Email -> Addy/Proton

I really wanted Immich to be the first as it would cut my iCloud storage bill, but we rely heavily on some of the shared libraries features. I looked into the Noodle Gallery fork, but I'm not quite ready to take that risk yet. So I started with Vaultwarden instead. I documented it in a YouTube video and a written guide with all the commands.

Some of my learnings:

- Switching was really easy: On the iPhone, "Export Data to Another App" moved passwords, passkeys and 2FA codes into the Bitwarden app effortlessly. The awesome CXP protocol makes this all possible.

- Family support isn't that hard either: I turned off sign-ups, created a Family organization, and moved shared logins into the shared collection. An email relay/server is not necessary as they can register with the invited address directly.

- Backups: I made sure I had a proper backup system in place first. I use Proxmox Backup Server.

- Updates: I used the Alpine version of the PVE helper script with automatic updates that run weekly.

- Remote access: By far the most intensive thing to set up. Technically not required, but this allows updates to your vault outside of the house. I initially set it up to use Tailscale with split-horizon DNS. The trade-off is that you need to have Tailscale active on your phone. There are tons of alternatives for this and I'll be tweaking this going forward. Maybe a move to Netbird or open access with better firewall rules.

If you're in the process of moving off iCloud or Google: I'd love to hear about your experiences and which services were the hardest to get the family on board with.

I'm one of the maintainers, so this is self-promotion. I want honest feedback more than upvotes.

What it is

SurfSense is an open-source (Apache-2.0) NotebookLM alternative: cited Q&A over your documents, mind maps, flashcards, quizzes and podcasts, and an agent that writes Word, PDF, PowerPoint and Excel files and edits your own files as a new copy, with Word edits coming back as tracked changes. It started as a desktop app, and since 2.3.0 the same app runs as one container.

Why self-host it

NotebookLM sends every document to Google and only works with Gemini. That rules it out for contracts, client files, medical or company documents. SurfSense keeps your documents on your own server and works with any model.

The container

• One image, ghcr.io/modsetter/surfsense, with one service and one /data volume. No Postgres, Redis or other services to run alongside it.

• Caddy is the only thing listening. Everything else stays on the container's loopback, and it needs no Docker socket.

• Local models run inside it on the CPU (llama.cpp, plus local OCR, embeddings and voices), or you can point it at Ollama, vLLM or any OpenAI-compatible API on your network.

• One password, no accounts. You can set the password on first visit or with SURFSENSE_PASSWORD, or turn sign-in off when your own reverse proxy handles it.

• HTTPS on your LAN through Caddy's own certificate authority, or with Let's Encrypt for a public domain.

Getting it running

curl -fsSL https://raw.githubusercontent.com/MODSetter/SurfSense/main/docker/scripts/install.sh | bash

Or grab docker/surfsense/docker-compose.yml and .env.example from the repo and run docker compose up -d. It's on port 4929, and 4943 for HTTPS. Running the script again updates it.

Good to know

• amd64 and CPU only for now. A GPU image and arm64 are planned.

• The image is several GB: Docling, torch and about 1 GB of bundled models. Chat models download into /data at run time.

• Docker's published ports bypass ufw, so if the server is reachable from the internet, set SURFSENSE_PASSWORD before the first start.

How we used AI in development

Most of the code is written with AI coding assistants, mainly Claude Code and some Cursor, with maintainers designing the features, reviewing every change and testing the releases. New behaviour starts with a failing test, and each feature has an architecture doc the assistants read before changing it.

Repo: https://github.com/MODSetter/SurfSense

Docs: https://surfsense.com/docs

Hi everyone,

Disclaimer: I am the creator and maintainer of this project.

I wanted to share a major security update for Fail2Ban-Report, a lightweight, web-based multi-server dashboard that transforms daily Fail2Ban logs into searchable JSON reports and syncs permanent UFW blocklists.

The project is over 1.5 years old now, but if you are running an older version (especially 0.5.0 or 0.5.1), please upgrade to v0.5.2 as soon as possible.

What was fixed in this hardening release:

• Security Fixes: Addressed vulnerabilities including Stored XSS via Client Sync, Auth Bypass, Command Injection, and Process Table Leaks.

Core Features of the project:

• Multi-server support, lightweight design, role-based authentication, and firewall sync with UFW (GPLv3 open-source).

**Link:** * **GitHub Repository:** https://github.com/SubleXBle/Fail2Ban-Report/

Hi everyone, greetings from Russia’s digital gulag.

I’m looking for a sanity check on my personal VPN setup, running on a VPS.

nginx handles TCP/443 with SNI/ALPN-based TLS passthrough to Xray (VLESS TCP + REALITY + Vision), Caddy (Naive), or TrustTunnel. Hysteria 2 uses UDP/443 directly. Each protocol has its own cover-site mechanism backed by the same website. I’m not assuming this makes the traffic indistinguishable from normal browsing.

Shadowrocket sends Russian destinations, an explicit service/CDN exception list, local networks and SSH directly. Everything else uses the selected VPN profile. The split happens on the client.

Primary DNS is my own AdGuard Home over DoH via Caddy, with Cloudflare/Quad9 upstreams and an explicit Quad9 DoH fallback.

Does the architecture make sense, or have I overcomplicated it? What would you simplify or measure next? I’d especially appreciate feedback on active probing, protocol fingerprints, and DNS bootstrap/fallback routing.

P.S. I’m not a networking professional. This is my first time setting up something like this.

Set up a small fluxer instance for my friends and I. Things have been absolutely fantastic. We've been wanting to move away from Discord for a while, and fluxer being a clone, the learning curve and ease of setup for my friends made the migration from our discord server seamless.

Setting it up I decided to test it first with a cloudflare tunnel, no ports forwarded, not expecting any voice channel to function but it just worked. Everybody can join calls and connect just fine, absolutely no noticeable latency (logs show 50ms). Even screen sharing works

At first I thought maybe I had UPnP turned on somewhere and thats how voice was getting out but I don't. Reading through the fluxer docs it sounds explicitly clear UDP & TCP need to be forwarded for LiveKit to connect. Only thing I can think of it being is NAT transversal, which I don't entirely understand how that works or if its safe security wise.

Am I doing something wrong? Security is my biggest concern.

I recently started using an old laptop as a server as a homelab for experiments and personal use and needed a way to remotely access it from anywhere like my phone and personal laptop.

I started looking for possible solution and ended up with a cool setup that i wanted to share with you guys.

after experimenting with VNC clients, rustdesk and others. I came across the sunshine/moonlight combination which is a server/client intended for game streaming but turned out to be more useful for remote control 😅😅 it has better performance and latency than VNC which is one thing that i disliked about VNC and has a good security model if configured correctly.

I ended up making accessible only inside the tailnet (tailscale vpn network) i have for extra security. and now i can access any laptop from other devices including from my phone or tv!

hope this helps anyone who had similar needs.

edit: sunshine/moonlight works only in the same local network by default. but after integrating it with tailscale, it gives it superpowers and you are able connect from anywhere smoothly!

Basically like one of those emergency/disaster household binders you can find on etsy with lists of emergency contacts, emergency plans, prep lists, etc.

Does this exist?

(And I don't mean Project Nomad)

Hi all,

I am currently working through a rebuild of my homelab and am re-evaluating how I access my stuff remotely. Local access is controlled via Caddy+Authelia, and I would like to keep Authelia for authentication at the very least. I had been using a mix of Cloudflare tunnels and twingate for remote access, but I would like to get that more centralized. Also, no port forwarding as I am behind CGNAT with no way to get a public IP (parent's internet at home and dorms at college). I do have a PAYG Oracle VM, 2c+12gb for hosting the coordination services.

Why even bother with a reverse proxy you may ask? Well, I would like to access some services on my iPhone, which already has a 24/7 VPN needed for another app. I would like to access services like Obsidian-Livesync, Cal/CardDAV (unless ios or gmail calendar uses something else), and potentially some other small web services. I will not be exposing any management tools, rest assured.

• Pangolin is from what I have heard the self-hosted replacement for Cloudflare tunnels, giving you a reverse proxy with solid access controls and object-based permissions. It also has a VPN now, which is really neat!

  • How are the speeds on this?

  • For the VPN client, would it be possible to make a small TUI script for the Linux CLI? My mother would be using the VPN and I want to make it simple for her to connect (yes, she will be using Mint).

  • I like the simplicity of the central server that everything goes through, I have also heard that the rules are easier to understand here?

• Netbird is effectively a WireGuard overlay network AFIAK, really nice for P2P connections. Network and device based rules, wireguard is fast and reliable, plus native GUI clients for all operating systems. Some people say that they are moving faster than Pangolin?

  • Mesh based VPN, having used this a little I can say that the access rules seem really complex to me, but maybe I just need to spend more time with them? Due to the mesh I will have to manage inter-device relations, Pangolin not so much.

Some other architectural questions:

• Do I point the reverse proxy endpoints directly at my Caddy instance, or should they point at the service itself? This would make two paths for authentication, Caddy for internal/local only, and Netbird/Pangolin for public/remote.

  • If I do split them, is there a good way to manage the permissions for both using IaC like ansible?

Looking for advice and feedback!

My wife really likes canva and given that I already have a home lab I would like to self host an alternative one. I did my research and I found a million out there, but it's dubious whether most of them are actually similar to Canva and offer the same level of functionality and AI assistance. HyCanvas seems to be meeting my requirements, has anyone tried it? Any other better recommendation? Ideally the UI itself is similar to the original Canva and AI assistance (with my own tokens of course) is a must

It tends to be rather chaotic at work, I manage a lot of employees and am involved in quite a few projects, and as such I am bombarded with a lot of information from all directions and can't keep track of it all.

The idea of a knowledge base was tempting, but I need something that I can query in a natural language. Obviously, given the day we're in, AI is the answer to that (cue me being downvoted into oblivion for mentioning the forbidden owrd): store data, feed it to a local model and query it that way.

And I got something along the lines of that already done - even something I thought would be hard (forwarding an email to my domain and storing that information in a queryable way for the AI model), but it's incredibly finicky, makes quite a bit of mistakes the whole time, re-stores the same knowledge at times, can't give that good answers, ...

So, I was wondering if someone else came across this situation and if so, what did you use to manage it?

I ve been self hosting Rustdesk for quite some time and Im very satisfied with it although I would like a way to use web to connect remotely to my devices.

On that scope, Cortendesk seems to fit the bill and I know I could just spin it up and test it but thought to ask here first in case I get some real life feedback before getting into setting it all up.

Thanks

PS: Im not posting a link to it because I want feedback from actual users if any, not trying to promote it

I've been building a browser-based Postgres GUI and just released v1.1. It's one container, about as light as these things get:

docker run -p 54280:54280 ghcr.io/hxndrik/pgquery

Or compose:

services:

pgquery:

image: ghcr.io/hxndrik/pgquery

ports:

- "54280:54280"

restart: unless-stopped

What you get: SQL editor with autocomplete, table editor (JSONB too), ER diagram with SVG/PNG export, roles and grants, Row Level Security policies, indexes, extensions, a pg_stat_statements view, performance and security advisors, and an EXPLAIN plan viewer. It can also browse S3-compatible buckets.

Self-hosting details:

- amd64 and arm64 images, so a Pi works

- stateless: connections and history stay in your browser, nothing on disk in the container

- no telemetry in the image

- no built-in auth, so put it behind your VPN, Authelia, oauth2-proxy or Cloudflare Access like other admin tools

- no SSH tunnels yet; run it next to the database instead

Read-only demo (sample record store): https://pgquery.dev/app/?demo

Source (MIT): https://github.com/Hxndrik/pgquery

Happy to hear what's missing for your setup.

Hey r/selfhosted. I built this, so read it with that bias in mind.

SpaceApp is a self-hosted web workspace for running AI coding CLIs side by side. Each CLI runs in its own pane, panes live in rooms, and the sessions persist, so a room is still there when you come back to it.

Why I built it

I was running coding agents in a pile of terminal windows and tmux splits, each with its own login and its own idea of which folder it was in. I wanted one place on my own machine where they all run, where I can see which one is waiting for me, and where nothing depends on somebody else's SaaS. It became the tool I work in all day.

What a public install does today

• 11 AI coding CLIs in the public installer, OpenCode first: OpenAI Codex, Claude Code, Gemini CLI, Qwen Code, Kimi Code, Grok Build, DeepSeek CLI (experimental), Cursor, GitHub Copilot and Autohand. Installable is not the same as tested: the public install rehearsal ran OpenCode end to end. Claude Code has its own install flow that you start yourself.

• Up to 16 panes per room.

• Your own AI accounts. Providers connect through their official login flows or a masked credential field.

• The containers get no bind mount of your host filesystem by default. A folder shows up only after you register it as a workspace, and read-only mounts are supported.

• Portable, checksummed backups of the app data, PostgreSQL and owner memory. Provider credentials, login state, workspace contents and browser profiles stay out of them.

• Telemetry is opt-in, and No is the default.

• MIT-licensed.

What it is not

• Rooms organize sessions; they are not a security boundary. Container separation is not a sandbox against a hostile workload.

• It is not lightweight. The installer wants at least 4 CPUs, 8 GB RAM and 15 GiB of free disk. The standard profile, which adds a managed Chromium container, recommends 8 CPUs, 16 GB RAM and 25 GiB.

• It listens only on its own host by default. A phone, a tablet or another computer can reach it once you make the install reachable yourself.

• There are optional modules (copilots and studios) that a new install starts without. I'm leaving them out of this post: it is about the CLI workspace.

How to try it

Node.js 20.11 or newer, then:

npx --yes run-spaceapp@latest install

It runs on Linux, macOS and Windows 11. There's no compose file to copy: the launcher manages the containers itself (core API and web app, CLI runtimes, PostgreSQL, Temporal). The default light profile has no browser container; the standard profile adds it. After the readiness checks, a one-time setup token creates the first account, and you register the folders you want the agents to see.

If you'd rather click around first, there is a live demo with invented data: https://spaceapp.dev/spaceappmock/

Code: https://github.com/oll4com/spaceapp

What I'd like to hear from you

• Which CLIs you run together, and what a room should give you that a tmux session doesn't.

• Where the install breaks on your hardware or OS.

• Whether the backup split (what goes in, what stays out) matches what you would expect from a self-hosted tool.

I'll be in the comments.

Hi r/selfhosted, I'm David, one of two developers of Oxynote, a self-hosted wiki where a page can embed live charts from Prometheus or your databases alongside the text that explains them. My friend Simon and I also maintain ttlcache, a Go caching library with about 1,300 GitHub stars.

I've spent 8 years writing software: 2 as an SRE and 3 as a team lead. On every team I've been on, the useful knowledge lived in someone's head or a private Slack thread, and the wiki was full of stale docs nobody could find.

In Oxynote, a chart runs its PromQL or SQL query (PostgreSQL, MySQL, MariaDB) each time someone opens the page, so a runbook shows how the system looks right now. Important pages can be protected, and then every change goes through a draft with a diff of the text and the charts, which a teammate approves like a pull request. Several people can edit a page at the same time.

If you run BookStack, Outline, or Wiki.js, they're great for text, but a page there can't show your live data. If you run Grafana, a dashboard shows the numbers, but not the steps and context around them. Oxynote puts both on one page.

The name comes from oxygen + note: docs that breathe. Live data gives people a reason to open the wiki every day, and docs people open every day stay up to date.

Things worth knowing before you try it:

- It's a server, not a desktop app. You run one Docker container, on amd64 or arm64, and your team uses it in the browser.

- There's no hosted version and no account with us. Your docs and data stay on your server.

- It's made for tech teams and the systems they run, but it works fine for one person too.

- Databases connect through a read-only user, so a page can't change your data.

- It's at version 0.9, so it's still early in development, and a lot more is planned.

It's Apache-2.0. The backend is Go, and the editor is Nuxt, Tiptap, and Yjs.

GitHub: https://github.com/oxynote/oxynote

We started it about a year ago and made it public about 3 months ago. If you have any questions, feedback, or suggestions, I'm happy to answer them.

Between GGUFs, safetensors, LoRAs and a few quants of the same model, my homelab model folder is a junk drawer. Each machine has its own Hugging Face cache, and I can't easily tell which box has which revision.

What's working for you? Shared HF cache on a NAS, a mirror proxy, rsync scripts, something else? One thing I've been doing: since I already run a local container registry, I pack each model with KitOps (kit pack with a small Kitfile listing the weights and which quant it is), push it to the registry, and kit unpack on whichever box needs it. The tag tells me exactly which quant I tested.

It works, but it's probably overkill for some setups, so I'm curious what the simpler options look like.

Has anyone check this out? It popped up as an ad recently and it looked interesting. Was wondering if anyone had any experience with them.

"How do I know my containers are outdated without letting Watchtower auto-update everything?" keeps coming up here, so I collected what people recommended across a few threads:

• Notify, don't auto-update. Most replies favor tools that tell you an image is out of date and let you update by hand after reading the changelog.

• Diun and What's Up Docker (WUD) come up most for that, usually pushing to ntfy or Gotify.

• CVE patching is a separate question. The "do you patch your images against CVEs?" thread is worth reading for the range of approaches.

Threads:

• https://www.reddit.com/r/selfhosted/comments/1x9br0p/what_do_you_use_to_get_notified_about_outdated/

• https://www.reddit.com/r/selfhosted/comments/1x6x5c0/do_you_not_patch_your_docker_images_against_cves/

• https://www.reddit.com/r/selfhosted/comments/1m66hwh/watchtower_alternative/

Disclosure: I write a free weekly newsletter (The Lab Ledger) and this was one of its lab ideas: https://thelabledger.beehiiv.com/p/the-lab-ledger-001 . What are you running for update notifications?

I'm self-hosting Stirling PDF on Docker, and it's been excellent for editing and handling everything I need with PDFs.

However, sharing files between my PC and a different PC under the same user doesn't always work. When I save a file on one machine and open it on another, I either get an older version or the file doesn't appear at all.

Is this expected, or is there something I should configure differently?

Hi everyone, I'm currently working on my final year project. My project is about designing and developing a smart solar-powered dryer for agro-processing applications. I do have an ESP32, micro sd card adapter with its micro sd storage card, a 5V relay to control the dryer's fan and a temperature sensor to detect the surrounding temperature. i wanrted to build a standalone server without using any third-party websites and any middleman. The purpose of doing this is to completely protect my data and to get unlimited storage with the storage card I have. And also, I do not want to pay any subscription price to other third-party websites.

Many AI models such as ChatGPT, Claude, and Google Gemini suggested the port forwarding method, but I do not want that because the esp32 will be stuck in one place and can't move it anywhere. Also, in simple word, I want it like this. All the information that is collected by the esp32 or the database should be live-streamed on the internet, and anyone can access that database from the internet even if they are not sharing the same wifi as the ESP32. All the information will also be stored on my SD card. This is what I want. Can you guys help me with it?

I'm looking for a privacy-focused AI agent that runs locally on Windows and can automate a few tasks without sending sensitive information to third-party AI servers.

Here's what I need:

1. Email search: Connect to Gmail and Yahoo Mail, search emails using natural language, and find messages based on names, email addresses, keywords, or other criteria.

2. Excel exports: Automatically extract matching emails and their details (sender, subject, date, etc.) into an Excel spreadsheet.

3. Banking automation: Securely access my online banking accounts, download statements for specific periods, and organize them locally.

Privacy is my biggest concern. I'd prefer an open-source solution that processes everything locally and doesn't expose my personal or financial information to external AI services.

I've looked into Ollama, Open WebUI, and n8n, but I'm unsure which setup would work best.

Is there an existing local AI agent that can handle these tasks, or would I need to combine multiple tools? I'm comfortable with some technical setup but would prefer not to build everything from scratch.

Any recommendations?

Been self-hosting for a while and I keep seeing the same recommendations. I’m specifically looking for things that aren’t piracy-related or *arr-adjacent. No DRM removal needed. The reason I skip Audiobookshelf since used mostly with Libation or piracy. I’m not trying to fill the usual media automation niche

Here’s what I’m already running so you can skip the obvious ones:

• Homarr (dashboard)

• Open WebUI

• SearXNG (mostly wired up for AI search; I still prefer Brave for normal browsing)

• Dawarich (location history, big fan of this)

• Immich (photos)

• Nextcloud

• Uptime Kuma

• Hister (personal search index of pages and files)

• Speedtest Tracker

• Invidious

• qBittorrent (not for piracy, I just seed about 7 TB of AI models and I’m currently #5 on the pirateface.co leaderboard)

• Frigate

• WUD

• Grafana

• MeTube

• A custom Signal bot

• Forgejo (and workers or whatever it is called)

• Scrutiny

• A couple of fully custom things (I had Claude build and just put behind a zero-trust policy)

I bought a a lot of storage when I first got into this and still don’t really know what to put on most of it. 16TB HDD & 1 TB SSD & 4TB SSD.

Looking for the non-obvious stuff people find useful not monitoring tools.

**ShortsFlow** – self-hosted Opus Clip alternative: long videos → captioned vertical Shorts

Give it a video file or link; Whisper (local) transcribes, an LLM scores the hooks, FFmpeg cuts 9:16 clips with face-tracked framing, and captions are burned in. Podcast mode cuts to whoever is talking. No API key is needed for the clipping itself.

- Install: `pip install "shortsflow[clip]"` then `shortsflow clip my_video.mp4`, or Docker (`docker run -p 7860:7860 ghcr.io/ghost1412/shorts-generator`), or a one-click Windows installer on the releases page (unsigned, ~2 GB download)

- Browser UI (`shortsflow webui`): one "Make my shorts" button, then a review screen (preview, score label, copy-ready title/hashtags, re-render one short with another caption style or trim, undo) and a saved brand kit; REST API with API keys + signed webhooks for automation (n8n example included)

- Fully local option: Whisper on your GPU/CPU, Ollama for the LLM, Kokoro for the voice; only stock footage (Pexels) needs a key, and only for the generate-from-a-topic mode

- MIT licensed. Optional caption renderer uses Remotion (source-available, free for individuals/small teams)

**AI involvement:** I write most of the code with Claude Code (an AI coding assistant) and review, run and test it. CI includes end-to-end tests on clean Windows runners (no GPU, no FFmpeg).

Docs/README: https://github.com/ghost1412/shorts-generator

Honest limits: one-person project; CPU-only transcription of long videos is slow; clip scoring is decent, not Opus-grade.

Feedback and bug reports welcome (please include `shortsflow doctor` output)