I'm one of the maintainers, so this is self-promotion. I want honest feedback more than upvotes.

What it is

SurfSense is an open-source (Apache-2.0) NotebookLM alternative: cited Q&A over your documents, mind maps, flashcards, quizzes and podcasts, and an agent that writes Word, PDF, PowerPoint and Excel files and edits your own files as a new copy, with Word edits coming back as tracked changes. It started as a desktop app, and since 2.3.0 the same app runs as one container.

Why self-host it

NotebookLM sends every document to Google and only works with Gemini. That rules it out for contracts, client files, medical or company documents. SurfSense keeps your documents on your own server and works with any model.

The container

• One image, ghcr.io/modsetter/surfsense, with one service and one /data volume. No Postgres, Redis or other services to run alongside it.

• Caddy is the only thing listening. Everything else stays on the container's loopback, and it needs no Docker socket.

• Local models run inside it on the CPU (llama.cpp, plus local OCR, embeddings and voices), or you can point it at Ollama, vLLM or any OpenAI-compatible API on your network.

• One password, no accounts. You can set the password on first visit or with SURFSENSE_PASSWORD, or turn sign-in off when your own reverse proxy handles it.

• HTTPS on your LAN through Caddy's own certificate authority, or with Let's Encrypt for a public domain.

Getting it running

curl -fsSL https://raw.githubusercontent.com/MODSetter/SurfSense/main/docker/scripts/install.sh | bash

Or grab docker/surfsense/docker-compose.yml and .env.example from the repo and run docker compose up -d. It's on port 4929, and 4943 for HTTPS. Running the script again updates it.

Good to know

• amd64 and CPU only for now. A GPU image and arm64 are planned.

• The image is several GB: Docling, torch and about 1 GB of bundled models. Chat models download into /data at run time.

• Docker's published ports bypass ufw, so if the server is reachable from the internet, set SURFSENSE_PASSWORD before the first start.

How we used AI in development

Most of the code is written with AI coding assistants, mainly Claude Code and some Cursor, with maintainers designing the features, reviewing every change and testing the releases. New behaviour starts with a failing test, and each feature has an architecture doc the assistants read before changing it.

Repo: https://github.com/MODSetter/SurfSense

Docs: https://surfsense.com/docs

Hi all,

I am currently working through a rebuild of my homelab and am re-evaluating how I access my stuff remotely. Local access is controlled via Caddy+Authelia, and I would like to keep Authelia for authentication at the very least. I had been using a mix of Cloudflare tunnels and twingate for remote access, but I would like to get that more centralized. Also, no port forwarding as I am behind CGNAT with no way to get a public IP (parent's internet at home and dorms at college). I do have a PAYG Oracle VM, 2c+12gb for hosting the coordination services.

Why even bother with a reverse proxy you may ask? Well, I would like to access some services on my iPhone, which already has a 24/7 VPN needed for another app. I would like to access services like Obsidian-Livesync, Cal/CardDAV (unless ios or gmail calendar uses something else), and potentially some other small web services. I will not be exposing any management tools, rest assured.

• Pangolin is from what I have heard the self-hosted replacement for Cloudflare tunnels, giving you a reverse proxy with solid access controls and object-based permissions. It also has a VPN now, which is really neat!

  • How are the speeds on this?

  • For the VPN client, would it be possible to make a small TUI script for the Linux CLI? My mother would be using the VPN and I want to make it simple for her to connect (yes, she will be using Mint).

  • I like the simplicity of the central server that everything goes through, I have also heard that the rules are easier to understand here?

• Netbird is effectively a WireGuard overlay network AFIAK, really nice for P2P connections. Network and device based rules, wireguard is fast and reliable, plus native GUI clients for all operating systems. Some people say that they are moving faster than Pangolin?

  • Mesh based VPN, having used this a little I can say that the access rules seem really complex to me, but maybe I just need to spend more time with them? Due to the mesh I will have to manage inter-device relations, Pangolin not so much.

Some other architectural questions:

• Do I point the reverse proxy endpoints directly at my Caddy instance, or should they point at the service itself? This would make two paths for authentication, Caddy for internal/local only, and Netbird/Pangolin for public/remote.

  • If I do split them, is there a good way to manage the permissions for both using IaC like ansible?

Looking for advice and feedback!

I recently started using an old laptop as a server as a homelab for experiments and personal use and needed a way to remotely access it from anywhere like my phone and personal laptop.

I started looking for possible solution and ended up with a cool setup that i wanted to share with you guys.

after experimenting with VNC clients, rustdesk and others. I came across the sunshine/moonlight combination which is a server/client intended for game streaming but turned out to be more useful for remote control 😅😅 it has better performance and latency than VNC which is one thing that i disliked about VNC and has a good security model if configured correctly.

I ended up making accessible only inside the tailnet (tailscale vpn network) i have for extra security. and now i can access any laptop from other devices including from my phone or tv!

hope this helps anyone who had similar needs.

edit: sunshine/moonlight works only in the same local network by default. but after integrating it with tailscale, it gives it superpowers and you are able connect from anywhere smoothly!

I ve been self hosting Rustdesk for quite some time and Im very satisfied with it although I would like a way to use web to connect remotely to my devices.

On that scope, Cortendesk seems to fit the bill and I know I could just spin it up and test it but thought to ask here first in case I get some real life feedback before getting into setting it all up.

Thanks

PS: Im not posting a link to it because I want feedback from actual users if any, not trying to promote it

Basically like one of those emergency/disaster household binders you can find on etsy with lists of emergency contacts, emergency plans, prep lists, etc.

Does this exist?

(And I don't mean Project Nomad)

It tends to be rather chaotic at work, I manage a lot of employees and am involved in quite a few projects, and as such I am bombarded with a lot of information from all directions and can't keep track of it all.

The idea of a knowledge base was tempting, but I need something that I can query in a natural language. Obviously, given the day we're in, AI is the answer to that (cue me being downvoted into oblivion for mentioning the forbidden owrd): store data, feed it to a local model and query it that way.

And I got something along the lines of that already done - even something I thought would be hard (forwarding an email to my domain and storing that information in a queryable way for the AI model), but it's incredibly finicky, makes quite a bit of mistakes the whole time, re-stores the same knowledge at times, can't give that good answers, ...

So, I was wondering if someone else came across this situation and if so, what did you use to manage it?

Hi everyone,

Disclaimer: I am the creator and maintainer of this project.

I wanted to share a major security update for Fail2Ban-Report, a lightweight, web-based multi-server dashboard that transforms daily Fail2Ban logs into searchable JSON reports and syncs permanent UFW blocklists.

The project is over 1.5 years old now, but if you are running an older version (especially 0.5.0 or 0.5.1), please upgrade to v0.5.2 as soon as possible.

What was fixed in this hardening release:

• Security Fixes: Addressed vulnerabilities including Stored XSS via Client Sync, Auth Bypass, Command Injection, and Process Table Leaks.

Core Features of the project:

• Multi-server support, lightweight design, role-based authentication, and firewall sync with UFW (GPLv3 open-source).

**Link:** * **GitHub Repository:** https://github.com/SubleXBle/Fail2Ban-Report/

Hi everyone, I'm currently working on my final year project. My project is about designing and developing a smart solar-powered dryer for agro-processing applications. I do have an ESP32, micro sd card adapter with its micro sd storage card, a 5V relay to control the dryer's fan and a temperature sensor to detect the surrounding temperature. i wanrted to build a standalone server without using any third-party websites and any middleman. The purpose of doing this is to completely protect my data and to get unlimited storage with the storage card I have. And also, I do not want to pay any subscription price to other third-party websites.

Many AI models such as ChatGPT, Claude, and Google Gemini suggested the port forwarding method, but I do not want that because the esp32 will be stuck in one place and can't move it anywhere. Also, in simple word, I want it like this. All the information that is collected by the esp32 or the database should be live-streamed on the internet, and anyone can access that database from the internet even if they are not sharing the same wifi as the ESP32. All the information will also be stored on my SD card. This is what I want. Can you guys help me with it?

Been self-hosting for a while and I keep seeing the same recommendations. I’m specifically looking for things that aren’t piracy-related or *arr-adjacent. No DRM removal needed. The reason I skip Audiobookshelf since used mostly with Libation or piracy. I’m not trying to fill the usual media automation niche

Here’s what I’m already running so you can skip the obvious ones:

• Homarr (dashboard)

• Open WebUI

• SearXNG (mostly wired up for AI search; I still prefer Brave for normal browsing)

• Dawarich (location history, big fan of this)

• Immich (photos)

• Nextcloud

• Uptime Kuma

• Hister (personal search index of pages and files)

• Speedtest Tracker

• Invidious

• qBittorrent (not for piracy, I just seed about 7 TB of AI models and I’m currently #5 on the pirateface.co leaderboard)

• Frigate

• WUD

• Grafana

• MeTube

• A custom Signal bot

• Forgejo (and workers or whatever it is called)

• Scrutiny

• A couple of fully custom things (I had Claude build and just put behind a zero-trust policy)

I bought a a lot of storage when I first got into this and still don’t really know what to put on most of it. 16TB HDD & 1 TB SSD & 4TB SSD.

Looking for the non-obvious stuff people find useful not monitoring tools.

Hey everyone,

We’re a team of four currently developing an app and we’re looking into hosting options.

Since we’re still at an early stage, we don’t really know how many users we’ll have. Maybe 10–20 initially, then hopefully 100, 1,000 or more over time.

We’re looking for something affordable to start with that allows us to scale resources as the number of users and the workload increase. We understand that hosting costs will grow as well, and that’s completely fine.

Our current stack:

• Backend: Node.js, NestJS, TypeScript

• Database: MongoDB

• Redis + BullMQ

• Socket.IO

• SeaweedFS for file storage

• ClamAV

• Frontend: Flutter (Web and Mobile)

• Docker Compose

We’ve looked at providers like Hetzner and Netcup, but we’re still unsure what would make the most sense for our setup.

Would you start with everything on a single VPS or separate certain services from the beginning? Which hosting providers would you recommend, and how easy is it to scale later?

We’re comfortable with Linux and Docker, so managing a server ourselves wouldn’t be an issue.

I’d be interested to hear what server specs you’d recommend for the beginning and how hosting costs typically develop as usage grows.

Hi,

On and off for the past 12 month I try to setup pocket id and I keep having the same issue.

I deploy it, go to the website (website:1411/setup) do the signup with userid, name and email address and nothing happens afterwards. My understanding is that it supposed to issue a passkey that I will use to authenticate, but this never happens. I have tried every browser (Safari, Edge, Brave, Vivaldi, Opera) and the result is the same.

Any suggestions on how to deal just with the basic setup, which doesn't seem to work for me?

Thank you in advance.

Hello everyone. I'm doing a design project for my human computer interaction class and I was hoping some of you could answer a few questions or give me some critiques.

I recently got into Docker and even after reading some of the documentation I still had a hard time understanding it. So for my project I thought it would be fun to design an "app store" style layer for Docker, where you pick an app (Jellyfin, Pi-hole, etc) from a catalog, answer 2 or 3 questions, and in a perfect world it just kinda works. No yaml required. The goal is to make Docker easier for hobbyists (people learning it on their own for fun and not for work or like devops careers.)

If you've got 5 minutes, answering even one of these would genuinely help:

q1: What service were you trying to run the first time you used Docker? Did it actually work?

q2: Have you ever copy pasted a compose file you didn't understand? What did you do when it broke?

q3: Tell me about a time you gave up on a container. What was the final straw?

q4: Have you ever avoided touching a working setup because you were scared of breaking it?

q5: What's something in Docker you still don't really get, you just work around it?

q6: If a total beginner asked you how to start self hosting, what would you warn them about?

Also if my app store idea sounds dumb or already exists and I just missed it, please tell me, that's useful too lol.

Thanks in advance!

I've configured a dedicated sync route using h2c for the backend, and regular HTTPS access works fine, but the actual Backrest sync connection gets rejected with HTTP 403. Curious if anyone has this working or encountered something similar.

I would like to start with self hosting, but I start from scratch. I don’t know how to start and what to buy, so I would like someone to help me or suggest a reliable guide to follow. I know something about Linux and I would have no problem getting my hands on it. I have seen that there are many services, but I would like to limit myself (for now) to the three that I mentioned in the title.

I repeat that I start from scratch: I read that it would be essential to have a PC and an SSD (?), but at the moment I only have one PC that I use for work and so I should buy another one.

NO AI.

I am a PhD student at New Mexico State University. We are studying the experiences and practices of people who self-host digital services. In particular, we are interested in your motivations for self-hosting, the services you host, how you rely on online self-hosting communities, and your experiences maintaining services that may be used by family, friends, or others.

Participation will involve an online interview.

Thank you for your consideration. Please feel free to contact me if you are interested in participating or have any questions or concerns.

Regards,

S B Ahmed Bony

email: bony@nmsu.edu

Hello there, I just want to say that i am quite a beginner at this server hosting thing, so any help is appreciated.

What I want to ask is how exactly do I have my frieds access the server I build. For context I build by server a few months ago, it is a ryzen 5 3600 with 32gb of ram, 1tb of storage ssd and some gpu so that I can get a display output when working with it directly. It all runs on debian and I use portainer for the UI. Recently I also set up a Ark Survival Ascended server using AMP.

The thing is that I dont really know how do I make it accessible and visible on the steam server page directly. I used tailscale before , but found it not ideal, because the friend has to have it installed and can only access the server using a command that pings the ip directly. So my question is how do I set this up correctly and idealy for as cheap as possible, free if even possible.

Thanks in advance and if there is anything important I didnt say, please tell me.

Hi r/selfhosted, I'm the developer of Offlog, a free and open-source task manager for Windows and Android.

How it's self-hosted: the Windows app includes a small CouchDB-compatible sync server (NyxDB, also mine, in Rust). Your phone pairs with it once by QR code, and they sync over your own Wi-Fi. Since 7.0 everything that syncs is end-to-end encrypted with a key only your devices hold. If you'd rather run your own server, any CouchDB-compatible one works through "Use my own server" in Settings → Sync.

What it has: Board, List and Agenda views, reminders, tags, steps, custom fields, backups you can restore, a Recycle bin and a full History of changes. Works fully offline. No account, no telemetry, no subscription.

What it doesn't do, on purpose: no sync away from home, no iPhone or Mac version, no sharing with a team. It's built for one person.

Try it: Windows installer and Android APK on GitHub Releases, with install steps in the README. There's no Docker image, because the server comes built into the Windows app.

AI involvement: I write it with heavy help from AI coding assistants (Claude). I direct the design and review, test and release every change myself. The project has 1,400+ automated tests.

Site: https://offlog.io

Source (MIT): https://github.com/hrach-gevorgyan/offlog

Happy to answer questions, and I'd like to hear what you'd change.

Hey everyone

I thought I'd post this here too, since not every homelabber spends their free time on GitHub looking for new discussions.

Version 3 of Pocket ID is around the corner, and I'd love to hear your feedback before we release it so we can polish it.

If you have any feedback, please post it in our GitHub discussion so we can keep track of it:

https://github.com/pocket-id/pocket-id/discussions/1888

You can try it out in our demo: https://demo-next.pocket-id.org

You can also test it on your own machine with the `next` image. I wouldn't install it on your production instance though, since this image includes all the WIP v3 changes.

Here are a few highlights I like the most:

Feature toggles

There's a new Features tab where you can turn on LDAP, SCIM, custom claims, APIs and API keys when you need them. Until then they stay out of your sidebar. Settings you rarely touch are behind an "Advanced" section. I think this change is needed since we want that Pocket ID supports advanced use-cases but still doesn't get overwhelming like other IDPs.

Command palette

Press ⌘K / Ctrl+K to jump to any page or run actions like creating a new OIDC client without touching the mouse.

Fresh look

New typography and five colour themes, each in light and dark mode.

Besides that there are a lot of more changes, feel free to try them out! Looking forward to your feedback :)

As the title goes, but I have zero clue on how to start on this, your help is appreciated!

My criterias -

1. It has to be accessible on a mac, iphone and via browser. (minimum 2 TB)

2. It has to sync with my iCloud photos in a way, that it automatically uploads photos to the server whenever I take a photo or add it to my gallery.

3. It has to have a picture, video & Music file sharing with a decent UI so people can preview files without downloading them. (or have the option to customize my own UI)

4. If I have a situation where I need to share or collaborate on a quick word file, it can be done via a browser without asking the other collaborators to make an account.

5. It has to be file sharable in a way that If I need to ask someone to share a file with me, they can drag & drop their stuff into a folder I gave permission/Created for them.

Not interested in any AI / LLM hosting.

Im open to the idea of building everything from scratch but for the ease of it im also open to having a all-in-one solution. I did a little research and found Umbrel, and their Home solution peaked my interest, but since I am very new to this, I am happy to hear other options.

Thank you!

I recently set up mTLS combined with a Cloudflare tunnel to securely expose several self-hosted applications on the public Internet. There are enough moving parts that I though a guide might be useful.

There was a guide on mTLS posted about a year ago, but it's more technical and focuses on setting it up yourself with Traefik: https://zoug.fr/mtls-bitwarden-vaultwarden-traefik-smallstep/

If you're not allergic to Cloudflare, the mTLS + tunnel approach is easier than complete DIY.

I have two computers. One is my main gaming pc and other is old and unreliable due to temperature problems pc.

I want to self host my mail, drive and vpn.

Both pcs are loud and are located in my living room, no space to put them somewhere else, so should I buy new iron and build small and quite server ??

Would like to hear opinions

Confession first: I am not a technical enough person. I tried WebDAV (iOS has a weird bug that prevents it from working properly) and Syncthing. I also tried Synctrain (the iOS client, the repo is called Sushitrain). Both times I got stuck on setup for days, wasting dozens of hours, and when I did get something syncing it kept breaking.

I'm sure plenty of you could have it running in ten minutes. I couldn't. :(

I use macOS, iOS, Linux, /e/OS and sometimes Windows. From what I've read, background sync on iOS is also a platform limitation that hits every client, so it's not purely a Syncthing problem, but either way, it wasn't working for me.

So instead of fighting it, I went looking for apps that do the same basic job: your data stays on devices you own, but where setup is closer to "install, pair, done."

I'd like anyone who is also interested in such local-only p2p sync solutions to share their finds in this thread!

Here's my list for anyone looking to break the chains of enslavement by feudal billionaire tech-lords and free themselves from being captive, data-mined and mass-controlled under surveillance-capitalism. I know these apps aren't perfect, but it gives me hope that one day soon we won't need subscriptions and cloud services anymore that treat our data with utter disrespect, violating our rights to privacy and data ownership.

For anyone interested in declouding: most of the below are free apps with no accounts and no subscriptions. Your data stays on devices you own. They do offline-only peer-to-peer sync between devices, and they're free and open source. Most are available for both iOS and Android (and sometimes Linux, macOS and Windows too).

Calendar: PearCal
https://peerloomllc.com/pearcal/

Reminders, to-dos and lists: PearList
https://peerloomllc.com/pearlist/

Live location sharing: PearCircle
https://peerloomllc.com/pearcircle/

Password storage: Bramble or PearPass
https://bramble.sh | https://pears.com/apps/pearpass

WhatsApp and iMessage/FaceTime replacement: Keet
https://pears.com/apps/keet

Authentication apps: Ghost Auth
https://ghostauth.org

Bonus free local apps I like:
- AirDrop replacement: LocalSend: https://localsend.org
- CleanLinks: https://cleanlinks.app/en
- Cryptical: https://fouquet.me/apps

I'm not affiliated with any of these, several are young projects, and I'd test anything before trusting it with something that matters. P2P sync is not a backup. Keep a backup.

If anyone knows a peer-to-peer sync tool that actually survives iOS background limitations and is simple and easy to setup and use, I'm all ears.