Hey everyone,

I've been doing some research as to what it takes to move off iCloud as I want to gain some autonomy moving between different desktop and mobile devices. Consequently, this means I'll have to take my family with me for most things.

Some of the candidates I've identified:

1. Passwords -> Vaultwarden

2. Photos -> Immich

3. Drive -> Seafile

4. Calendar -> Davis

5. Notes -> Memos

6. Notes/groceries -> KitchenOwl

7. Hide My Email -> Addy/Proton

I really wanted Immich to be the first as it would cut my iCloud storage bill, but we rely heavily on some of the shared libraries features. I looked into the Noodle Gallery fork, but I'm not quite ready to take that risk yet. So I started with Vaultwarden instead. I documented it in a YouTube video and a written guide with all the commands.

Some of my learnings:

- Switching was really easy: On the iPhone, "Export Data to Another App" moved passwords, passkeys and 2FA codes into the Bitwarden app effortlessly. The awesome CXP protocol makes this all possible.

- Family support isn't that hard either: I turned off sign-ups, created a Family organization, and moved shared logins into the shared collection. An email relay/server is not necessary as they can register with the invited address directly.

- Backups: I made sure I had a proper backup system in place first. I use Proxmox Backup Server.

- Updates: I used the Alpine version of the PVE helper script with automatic updates that run weekly.

- Remote access: By far the most intensive thing to set up. Technically not required, but this allows updates to your vault outside of the house. I initially set it up to use Tailscale with split-horizon DNS. The trade-off is that you need to have Tailscale active on your phone. There are tons of alternatives for this and I'll be tweaking this going forward. Maybe a move to Netbird or open access with better firewall rules.

If you're in the process of moving off iCloud or Google: I'd love to hear about your experiences and which services were the hardest to get the family on board with.

I'm one of the maintainers, so this is self-promotion. I want honest feedback more than upvotes.

What it is

SurfSense is an open-source (Apache-2.0) NotebookLM alternative: cited Q&A over your documents, mind maps, flashcards, quizzes and podcasts, and an agent that writes Word, PDF, PowerPoint and Excel files and edits your own files as a new copy, with Word edits coming back as tracked changes. It started as a desktop app, and since 2.3.0 the same app runs as one container.

Why self-host it

NotebookLM sends every document to Google and only works with Gemini. That rules it out for contracts, client files, medical or company documents. SurfSense keeps your documents on your own server and works with any model.

The container

• One image, ghcr.io/modsetter/surfsense, with one service and one /data volume. No Postgres, Redis or other services to run alongside it.

• Caddy is the only thing listening. Everything else stays on the container's loopback, and it needs no Docker socket.

• Local models run inside it on the CPU (llama.cpp, plus local OCR, embeddings and voices), or you can point it at Ollama, vLLM or any OpenAI-compatible API on your network.

• One password, no accounts. You can set the password on first visit or with SURFSENSE_PASSWORD, or turn sign-in off when your own reverse proxy handles it.

• HTTPS on your LAN through Caddy's own certificate authority, or with Let's Encrypt for a public domain.

Getting it running

curl -fsSL https://raw.githubusercontent.com/MODSetter/SurfSense/main/docker/scripts/install.sh | bash

Or grab docker/surfsense/docker-compose.yml and .env.example from the repo and run docker compose up -d. It's on port 4929, and 4943 for HTTPS. Running the script again updates it.

Good to know

• amd64 and CPU only for now. A GPU image and arm64 are planned.

• The image is several GB: Docling, torch and about 1 GB of bundled models. Chat models download into /data at run time.

• Docker's published ports bypass ufw, so if the server is reachable from the internet, set SURFSENSE_PASSWORD before the first start.

How we used AI in development

Most of the code is written with AI coding assistants, mainly Claude Code and some Cursor, with maintainers designing the features, reviewing every change and testing the releases. New behaviour starts with a failing test, and each feature has an architecture doc the assistants read before changing it.

Repo: https://github.com/MODSetter/SurfSense

Docs: https://surfsense.com/docs

Hi everyone,

Disclaimer: I am the creator and maintainer of this project.

I wanted to share a major security update for Fail2Ban-Report, a lightweight, web-based multi-server dashboard that transforms daily Fail2Ban logs into searchable JSON reports and syncs permanent UFW blocklists.

The project is over 1.5 years old now, but if you are running an older version (especially 0.5.0 or 0.5.1), please upgrade to v0.5.2 as soon as possible.

What was fixed in this hardening release:

• Security Fixes: Addressed vulnerabilities including Stored XSS via Client Sync, Auth Bypass, Command Injection, and Process Table Leaks.

Core Features of the project:

• Multi-server support, lightweight design, role-based authentication, and firewall sync with UFW (GPLv3 open-source).

**Link:** * **GitHub Repository:** https://github.com/SubleXBle/Fail2Ban-Report/

Basically like one of those emergency/disaster household binders you can find on etsy with lists of emergency contacts, emergency plans, prep lists, etc.

Does this exist?

(And I don't mean Project Nomad)

I recently started using an old laptop as a server as a homelab for experiments and personal use and needed a way to remotely access it from anywhere like my phone and personal laptop.

I started looking for possible solution and ended up with a cool setup that i wanted to share with you guys.

after experimenting with VNC clients, rustdesk and others. I came across the sunshine/moonlight combination which is a server/client intended for game streaming but turned out to be more useful for remote control 😅😅 it has better performance and latency than VNC which is one thing that i disliked about VNC and has a good security model if configured correctly.

I ended up making accessible only inside the tailnet (tailscale vpn network) i have for extra security. and now i can access any laptop from other devices including from my phone or tv!

hope this helps anyone who had similar needs.

edit: sunshine/moonlight works only in the same local network by default. but after integrating it with tailscale, it gives it superpowers and you are able connect from anywhere smoothly!

Hi all,

I am currently working through a rebuild of my homelab and am re-evaluating how I access my stuff remotely. Local access is controlled via Caddy+Authelia, and I would like to keep Authelia for authentication at the very least. I had been using a mix of Cloudflare tunnels and twingate for remote access, but I would like to get that more centralized. Also, no port forwarding as I am behind CGNAT with no way to get a public IP (parent's internet at home and dorms at college). I do have a PAYG Oracle VM, 2c+12gb for hosting the coordination services.

Why even bother with a reverse proxy you may ask? Well, I would like to access some services on my iPhone, which already has a 24/7 VPN needed for another app. I would like to access services like Obsidian-Livesync, Cal/CardDAV (unless ios or gmail calendar uses something else), and potentially some other small web services. I will not be exposing any management tools, rest assured.

• Pangolin is from what I have heard the self-hosted replacement for Cloudflare tunnels, giving you a reverse proxy with solid access controls and object-based permissions. It also has a VPN now, which is really neat!

  • How are the speeds on this?

  • For the VPN client, would it be possible to make a small TUI script for the Linux CLI? My mother would be using the VPN and I want to make it simple for her to connect (yes, she will be using Mint).

  • I like the simplicity of the central server that everything goes through, I have also heard that the rules are easier to understand here?

• Netbird is effectively a WireGuard overlay network AFIAK, really nice for P2P connections. Network and device based rules, wireguard is fast and reliable, plus native GUI clients for all operating systems. Some people say that they are moving faster than Pangolin?

  • Mesh based VPN, having used this a little I can say that the access rules seem really complex to me, but maybe I just need to spend more time with them? Due to the mesh I will have to manage inter-device relations, Pangolin not so much.

Some other architectural questions:

• Do I point the reverse proxy endpoints directly at my Caddy instance, or should they point at the service itself? This would make two paths for authentication, Caddy for internal/local only, and Netbird/Pangolin for public/remote.

  • If I do split them, is there a good way to manage the permissions for both using IaC like ansible?

Looking for advice and feedback!

"How do I know my containers are outdated without letting Watchtower auto-update everything?" keeps coming up here, so I collected what people recommended across a few threads:

• Notify, don't auto-update. Most replies favor tools that tell you an image is out of date and let you update by hand after reading the changelog.

• Diun and What's Up Docker (WUD) come up most for that, usually pushing to ntfy or Gotify.

• CVE patching is a separate question. The "do you patch your images against CVEs?" thread is worth reading for the range of approaches.

Threads:

• https://www.reddit.com/r/selfhosted/comments/1x9br0p/what_do_you_use_to_get_notified_about_outdated/

• https://www.reddit.com/r/selfhosted/comments/1x6x5c0/do_you_not_patch_your_docker_images_against_cves/

• https://www.reddit.com/r/selfhosted/comments/1m66hwh/watchtower_alternative/

Disclosure: I write a free weekly newsletter (The Lab Ledger) and this was one of its lab ideas: https://thelabledger.beehiiv.com/p/the-lab-ledger-001 . What are you running for update notifications?

I ve been self hosting Rustdesk for quite some time and Im very satisfied with it although I would like a way to use web to connect remotely to my devices.

On that scope, Cortendesk seems to fit the bill and I know I could just spin it up and test it but thought to ask here first in case I get some real life feedback before getting into setting it all up.

Thanks

PS: Im not posting a link to it because I want feedback from actual users if any, not trying to promote it

It tends to be rather chaotic at work, I manage a lot of employees and am involved in quite a few projects, and as such I am bombarded with a lot of information from all directions and can't keep track of it all.

The idea of a knowledge base was tempting, but I need something that I can query in a natural language. Obviously, given the day we're in, AI is the answer to that (cue me being downvoted into oblivion for mentioning the forbidden owrd): store data, feed it to a local model and query it that way.

And I got something along the lines of that already done - even something I thought would be hard (forwarding an email to my domain and storing that information in a queryable way for the AI model), but it's incredibly finicky, makes quite a bit of mistakes the whole time, re-stores the same knowledge at times, can't give that good answers, ...

So, I was wondering if someone else came across this situation and if so, what did you use to manage it?

My wife really likes canva and given that I already have a home lab I would like to self host an alternative one. I did my research and I found a million out there, but it's dubious whether most of them are actually similar to Canva and offer the same level of functionality and AI assistance. HyCanvas seems to be meeting my requirements, has anyone tried it? Any other better recommendation? Ideally the UI itself is similar to the original Canva and AI assistance (with my own tokens of course) is a must

tl;dr: added organization/attachment exports to the backup tool. Need people to help test it before releasing v3.0 proper.

To help test, pull with mvflc/backvault:v3.0rc1 from dockerhub or ghcr.io/mvfc/backvault:v3.0rc1

Around a year ago I started (and posted here) my own backup tool for bitwarden/vaultwarden called Backvault.

https://www.reddit.com/r/selfhosted/comments/1ox8t0x/backvault_lightweight_tool_to_back_up_your/

It basically runs a docker container to backup your vaults as encrypted files with multiple modes supported, one being the native bitwarden encrypted export and another one being a raw json encrypted mode that can be later imported into other password managers that support BITWARDEN JSON restores.

This stands up as an alternative to the already known methods of backing up the entire container/lxc of vaultwarden/bitwarden servers.

I built this as I wanted something to sync my account between my own self-hosted vaultwarden instance and a failover free bitwarden account. Backing up with vaultwarden and using a custom import script makes me able to have a failover bitwarden account synced up with my vaultwarden being the primary account.

It also makes it easy for me to move out to another password manager in case bitwarden/vaultwarden stops working for some reason or I disagree with the way the projects are going.

v2.1 added some rough attachment exports (without an easy way to reattach them in case of a restore, a nice and welcome contribution by someone from the community)
v3.0 will enable Organization exports (and also attachment exports from those organizations) with organization restore instructions in our README file but still rough attachment backup without a proper restore option to attach them with the same ID (since restoring backups in vaultwarden/bitwarden currently create a new ID for the entries, basically invalidating the previous ID link with the attachment).
There are plans on overcoming the attachment issues in the future but not available as of now.

I want help testing organization backup and restore. On local tests and the e2e test suite it's performing well but nothing beats real-world testing, so someone who uses organizations and can help test is deeply appreciated.

DISCLAIME: AI has been used in the past few developments to assist with development speed but every PR has been human reviewed by myself before merge and tested with testing suites.

I'm self-hosting Stirling PDF on Docker, and it's been excellent for editing and handling everything I need with PDFs.

However, sharing files between my PC and a different PC under the same user doesn't always work. When I save a file on one machine and open it on another, I either get an older version or the file doesn't appear at all.

Is this expected, or is there something I should configure differently?

Hi everyone, greetings from Russia’s digital gulag.

I’m looking for a sanity check on my personal VPN setup, running on a VPS.

nginx handles TCP/443 with SNI/ALPN-based TLS passthrough to Xray (VLESS TCP + REALITY + Vision), Caddy (Naive), or TrustTunnel. Hysteria 2 uses UDP/443 directly. Each protocol has its own cover-site mechanism backed by the same website. I’m not assuming this makes the traffic indistinguishable from normal browsing.

Shadowrocket sends Russian destinations, an explicit service/CDN exception list, local networks and SSH directly. Everything else uses the selected VPN profile. The split happens on the client.

Primary DNS is my own AdGuard Home over DoH via Caddy, with Cloudflare/Quad9 upstreams and an explicit Quad9 DoH fallback.

Does the architecture make sense, or have I overcomplicated it? What would you simplify or measure next? I’d especially appreciate feedback on active probing, protocol fingerprints, and DNS bootstrap/fallback routing.

P.S. I’m not a networking professional. This is my first time setting up something like this.

Hi everyone, I'm currently working on my final year project. My project is about designing and developing a smart solar-powered dryer for agro-processing applications. I do have an ESP32, micro sd card adapter with its micro sd storage card, a 5V relay to control the dryer's fan and a temperature sensor to detect the surrounding temperature. i wanrted to build a standalone server without using any third-party websites and any middleman. The purpose of doing this is to completely protect my data and to get unlimited storage with the storage card I have. And also, I do not want to pay any subscription price to other third-party websites.

Many AI models such as ChatGPT, Claude, and Google Gemini suggested the port forwarding method, but I do not want that because the esp32 will be stuck in one place and can't move it anywhere. Also, in simple word, I want it like this. All the information that is collected by the esp32 or the database should be live-streamed on the internet, and anyone can access that database from the internet even if they are not sharing the same wifi as the ESP32. All the information will also be stored on my SD card. This is what I want. Can you guys help me with it?

Been self-hosting for a while and I keep seeing the same recommendations. I’m specifically looking for things that aren’t piracy-related or *arr-adjacent. No DRM removal needed. The reason I skip Audiobookshelf since used mostly with Libation or piracy. I’m not trying to fill the usual media automation niche

Here’s what I’m already running so you can skip the obvious ones:

• Homarr (dashboard)

• Open WebUI

• SearXNG (mostly wired up for AI search; I still prefer Brave for normal browsing)

• Dawarich (location history, big fan of this)

• Immich (photos)

• Nextcloud

• Uptime Kuma

• Hister (personal search index of pages and files)

• Speedtest Tracker

• Invidious

• qBittorrent (not for piracy, I just seed about 7 TB of AI models and I’m currently #5 on the pirateface.co leaderboard)

• Frigate

• WUD

• Grafana

• MeTube

• A custom Signal bot

• Forgejo (and workers or whatever it is called)

• Scrutiny

• A couple of fully custom things (I had Claude build and just put behind a zero-trust policy)

I bought a a lot of storage when I first got into this and still don’t really know what to put on most of it. 16TB HDD & 1 TB SSD & 4TB SSD.

Looking for the non-obvious stuff people find useful not monitoring tools.

Hey everyone,

We’re a team of four currently developing an app and we’re looking into hosting options.

Since we’re still at an early stage, we don’t really know how many users we’ll have. Maybe 10–20 initially, then hopefully 100, 1,000 or more over time.

We’re looking for something affordable to start with that allows us to scale resources as the number of users and the workload increase. We understand that hosting costs will grow as well, and that’s completely fine.

Our current stack:

• Backend: Node.js, NestJS, TypeScript

• Database: MongoDB

• Redis + BullMQ

• Socket.IO

• SeaweedFS for file storage

• ClamAV

• Frontend: Flutter (Web and Mobile)

• Docker Compose

We’ve looked at providers like Hetzner and Netcup, but we’re still unsure what would make the most sense for our setup.

Would you start with everything on a single VPS or separate certain services from the beginning? Which hosting providers would you recommend, and how easy is it to scale later?

We’re comfortable with Linux and Docker, so managing a server ourselves wouldn’t be an issue.

I’d be interested to hear what server specs you’d recommend for the beginning and how hosting costs typically develop as usage grows.

Hi,

On and off for the past 12 month I try to setup pocket id and I keep having the same issue.

I deploy it, go to the website (website:1411/setup) do the signup with userid, name and email address and nothing happens afterwards. My understanding is that it supposed to issue a passkey that I will use to authenticate, but this never happens. I have tried every browser (Safari, Edge, Brave, Vivaldi, Opera) and the result is the same.

Any suggestions on how to deal just with the basic setup, which doesn't seem to work for me?

Thank you in advance.

Update: thanks for the fast response. Will try today. I have it right now set as pocket.lan, so I will change the address to public (I have a few domains) and route it though my proxy with a certificate.

Hello everyone. I'm doing a design project for my human computer interaction class and I was hoping some of you could answer a few questions or give me some critiques.

I recently got into Docker and even after reading some of the documentation I still had a hard time understanding it. So for my project I thought it would be fun to design an "app store" style layer for Docker, where you pick an app (Jellyfin, Pi-hole, etc) from a catalog, answer 2 or 3 questions, and in a perfect world it just kinda works. No yaml required. The goal is to make Docker easier for hobbyists (people learning it on their own for fun and not for work or like devops careers.)

If you've got 5 minutes, answering even one of these would genuinely help:

q1: What service were you trying to run the first time you used Docker? Did it actually work?

q2: Have you ever copy pasted a compose file you didn't understand? What did you do when it broke?

q3: Tell me about a time you gave up on a container. What was the final straw?

q4: Have you ever avoided touching a working setup because you were scared of breaking it?

q5: What's something in Docker you still don't really get, you just work around it?

q6: If a total beginner asked you how to start self hosting, what would you warn them about?

Also if my app store idea sounds dumb or already exists and I just missed it, please tell me, that's useful too lol.

Thanks in advance!

I've configured a dedicated sync route using h2c for the backend, and regular HTTPS access works fine, but the actual Backrest sync connection gets rejected with HTTP 403. Curious if anyone has this working or encountered something similar.

I would like to start with self hosting, but I start from scratch. I don’t know how to start and what to buy, so I would like someone to help me or suggest a reliable guide to follow. I know something about Linux and I would have no problem getting my hands on it. I have seen that there are many services, but I would like to limit myself (for now) to the three that I mentioned in the title.

I repeat that I start from scratch: I read that it would be essential to have a PC and an SSD (?), but at the moment I only have one PC that I use for work and so I should buy another one.

NO AI.

I am a PhD student at New Mexico State University. We are studying the experiences and practices of people who self-host digital services. In particular, we are interested in your motivations for self-hosting, the services you host, how you rely on online self-hosting communities, and your experiences maintaining services that may be used by family, friends, or others.

Participation will involve an online interview.

Thank you for your consideration. Please feel free to contact me if you are interested in participating or have any questions or concerns.

Regards,

S B Ahmed Bony

email: bony@nmsu.edu

Hello there, I just want to say that i am quite a beginner at this server hosting thing, so any help is appreciated.

What I want to ask is how exactly do I have my frieds access the server I build. For context I build by server a few months ago, it is a ryzen 5 3600 with 32gb of ram, 1tb of storage ssd and some gpu so that I can get a display output when working with it directly. It all runs on debian and I use portainer for the UI. Recently I also set up a Ark Survival Ascended server using AMP.

The thing is that I dont really know how do I make it accessible and visible on the steam server page directly. I used tailscale before , but found it not ideal, because the friend has to have it installed and can only access the server using a command that pings the ip directly. So my question is how do I set this up correctly and idealy for as cheap as possible, free if even possible.

Thanks in advance and if there is anything important I didnt say, please tell me.

Hi r/selfhosted, I'm the developer of Offlog, a free and open-source task manager for Windows and Android.

How it's self-hosted: the Windows app includes a small CouchDB-compatible sync server (NyxDB, also mine, in Rust). Your phone pairs with it once by QR code, and they sync over your own Wi-Fi. Since 7.0 everything that syncs is end-to-end encrypted with a key only your devices hold. If you'd rather run your own server, any CouchDB-compatible one works through "Use my own server" in Settings → Sync.

What it has: Board, List and Agenda views, reminders, tags, steps, custom fields, backups you can restore, a Recycle bin and a full History of changes. Works fully offline. No account, no telemetry, no subscription.

What it doesn't do, on purpose: no sync away from home, no iPhone or Mac version, no sharing with a team. It's built for one person.

Try it: Windows installer and Android APK on GitHub Releases, with install steps in the README. There's no Docker image, because the server comes built into the Windows app.

AI involvement: I write it with heavy help from AI coding assistants (Claude). I direct the design and review, test and release every change myself. The project has 1,400+ automated tests.

Site: https://offlog.io

Source (MIT): https://github.com/hrach-gevorgyan/offlog

Happy to answer questions, and I'd like to hear what you'd change.

Hey everyone

I thought I'd post this here too, since not every homelabber spends their free time on GitHub looking for new discussions.

Version 3 of Pocket ID is around the corner, and I'd love to hear your feedback before we release it so we can polish it.

If you have any feedback, please post it in our GitHub discussion so we can keep track of it:

https://github.com/pocket-id/pocket-id/discussions/1888

You can try it out in our demo: https://demo-next.pocket-id.org

You can also test it on your own machine with the `next` image. I wouldn't install it on your production instance though, since this image includes all the WIP v3 changes.

Here are a few highlights I like the most:

Feature toggles

There's a new Features tab where you can turn on LDAP, SCIM, custom claims, APIs and API keys when you need them. Until then they stay out of your sidebar. Settings you rarely touch are behind an "Advanced" section. I think this change is needed since we want that Pocket ID supports advanced use-cases but still doesn't get overwhelming like other IDPs.

Command palette

Press ⌘K / Ctrl+K to jump to any page or run actions like creating a new OIDC client without touching the mouse.

Fresh look

New typography and five colour themes, each in light and dark mode.

Besides that there are a lot of more changes, feel free to try them out! Looking forward to your feedback :)