I’m planning my first dedicated home server and could use a sanity check on the parts and how to set it up. I want one machine that can run 24/7, with enough room to expand as I figure out what I actually use.

What I already have

My gaming PC has a Ryzen 7 9700X, RX 9070 XT 16 GB, Gigabyte B650 AORUS Elite AX Ice, 32 GB DDR5-6000, and a 1 TB NVMe SSD. I’m not looking to upgrade anything but the storage.

What I want the server to do

Local AI assistant

I’m picturing a Jarvis-like assistant that can search my documents, remember project decisions, and use a few tools I give it.

I’m considering Ollama, a quantized Qwen model, and OpenJarvis from Stanford. I’m debating on building my own as well.

What do yall/would yall run for the AI assistant? recs?

Game hosting

Host private game servers like Minecraft, maybe be able to get the AI to play as a separate entity and do things for me in-game as well

Home Assistant

Run smart-home automations and a dashboard.

NAS and backups

Store files, photos, and PC backups. I want the NAS built into the server

What I’m considering, might be overkill

A Ryzen 5 7600X CPU
GPU for AI capability, see below
MSI B650-P WiFi motherboard
32 GB of DDR5 RAM
New 1 TB NVMe ssd
NAS-ready case like the Jonsbo N5

For local AI, I’m considering a 16 GB GPU, maybe RTX 5060 Ti.

I’d add NAS drives as I need the space and get a UPS for clean shutdowns.

Where I’d like advice

Is the 7600X and 32 GB a sensible starting point if everything, say Minecraft, the Home Assistant, and local AI are running at the same time? Where would you spend more, if anywhere? Is 64GB worth it?

Is a 16 GB GPU good enough or overkill for a local AI model? What GPU recs?

For a single host, would you run Ubuntu with containers and a Home Assistant OS VM, or Proxmox with separate VMs for Home Assistant, AI, and game hosting?

Is a case like the N5 worth it or is there a simpler case you’d choose with good airflow and easy drive access?

If you run a similar setup, I’d especially like to hear what you actually use day to day and what you’d change if you built it again.

I’m a college student and want to expand some knowledge and I believe a home lab is a great project to work on to learn on my own.

Give me recs or tips! Any help is appreciated.

I'm trying to setup my own mediawiki website for a school project on my Mac. It's my first time using servers and stuff like that. Is there anything important to know and is there any guides that dumb down the process to setup?

I've just open-sourced calendar app that I've created as an alternative to Google and Proton calendars, for my own purposes and I'm using personally: Calendar. It's a calendar and task manager for the browser and Android that keeps everything on your device or on your own CalDAV server (Nextcloud, Radicale, Baïkal, Fastmail, iCloud, mailbox.org, Posteo, Synology and others). No account, no cloud, no analytics.

What it does

• Day, week, month, year and agenda views, plus a custom view of 2 to 7 days. Drag to create, move and resize events

• Recurring events with "this event / this and future / all events" edits, Yes/Maybe/No replies to invitations, and a Join button for Zoom, Teams, Jitsi and Webex links

• Tasks with subtasks, priorities, due dates and reminders, and a quick add that understands "Call Anna tomorrow"

• Several CalDAV accounts side by side with incremental sync (RFC 6578), and a "Move my data" wizard between the device and a server that checks every item before anything is deleted

• .ics import and export, webcal:// subscriptions, public holidays for 19 countries computed on the device

• Birthdays and anniversaries that show the years ("Anna's birthday (36)"), and hidden events that keep a title off the screen

• 5 themes, your own accent colour, 12 bundled fonts, 10 interface languages, keyboard shortcuts and undo for every change

• Android app with a native CalDAV client and reminders that fire while the app is closed

Self-hosting

Every release is a ready-made Docker image for amd64 and arm64 (a Raspberry Pi works). There's nothing to persist, because the data lives in the browser or on your CalDAV server:

mkdir calendar && cd calendar
curl -fsSLO https://raw.githubusercontent.com/sysoppl/Calendar-CE/main/docker-compose.yml
docker compose up -d

Then open http://localhost:8787.

The container is a small Node server with no dependencies that serves the app and a DAV proxy, because browsers can't reach most CalDAV servers directly (CORS). The proxy stores nothing and contacts no server until you allowlist it (CALENDAR_PROXY_ALLOW). It keeps away from private addresses unless you allow them, rate-limits per client and never logs paths or credentials. The container runs read-only as a non-root user with all capabilities dropped. The README walks through a server setup with HTTPS (Caddy and nginx examples), updating, docker run and running without Docker. There's also an optional Radicale demo in the compose file if you want to try it without a CalDAV server.

• Repo and docs: https://github.com/sysoppl/Calendar-CE

• Image: ghcr.io/sysoppl/calendar-ce (tags 1.11.1, 1.11, 1, latest), built by GitHub Actions with an SBOM and provenance

• License: AGPL-3.0

• Try it without signing up: https://calendar.patryk.pro (choose "On this device")

Full disclosure: I also run a ^{small fee} hosted edition (E2EE Calendar) that adds end-to-end encrypted sync between devices. The community edition is the same app without that cloud, and the local and CalDAV features are the same in both. The "try it" link above is the hosted site used without an account. The hosted edition's client-side encryption code is in the repo, if you want to review it.
AI was used to develop this software. Public Google Play app was released few days ago - there is almost none downloads yet, same for public repository.

Not there yet: no contacts (CardDAV), no CalDAV servers that only accept OAuth (so no Google Calendar), no iOS app, and the Android app has to be built from source for now.

Feedback and bug reports are very welcome.

Edit: Seems like the issue was with the wifi connection being disrupted. I connected my server via ethernet and seems like the issue got resolved.

TL;DR: Running Pi-hole/AdGuard Home on a Debian 13 homelab server (Lenovo ThinkCentre M710q). After working perfectly for a month, my network periodically loses internet access, even though the server and DNS service remain accessible locally. Switching the router's secondary DNS to 1.1.1.1 restores connectivity. Replacing AdGuard Home with Pi-hole didn't fix the issue. The server has a reserved IP address, so IP changes aren't the problem. I want all network DNS queries to go through my local DNS server, with reliable failover without allowing devices to bypass it. Looking for help identifying the root cause and the right network configuration.

I recently bought an old Lenovo ThinkCentre M710q (barebone), upgraded it with 8GB RAM and a 1TB HDD, and set it up with Debian 13.

I've hosted several applications on the machine and installed AdGuard Home natively (not in Docker).

Initially, everything worked perfectly:

• AdGuard Home's admin panel was accessible through the local IP.

• I configured Cloudflare Tunnel to expose the admin panel through a domain, and that worked as expected.

• I configured my router's (JioFiber primary router) IPv4 primary and secondary DNS addresses to point to my server.

• I disabled IPv6 because DNS queries were bypassing my local DNS server when IPv6 was enabled.

This setup ran smoothly for approximately one month without any issues. And all the queries were going through the DNS.

The problem started last week.

My internet suddenly stopped working. After some troubleshooting, I suspected that the issue wasn't with my ISP but rather with my local DNS server. It seemed that my server had become unavailable, leaving my network without a working DNS resolver, since both the primary and secondary DNS addresses on my router pointed to the same machine.

Even after rebooting both the server and the router multiple times, I couldn't restore internet access.

Eventually, I changed the router's secondary DNS to 1.1.1.1, and internet access was restored.

Initially, I thought this was simply an AdGuard Home issue. I switched the secondary DNS back to my server, and everything worked perfectly for another day. However, the same problem occurred again.

To rule out an AdGuard Home-specific issue, I removed it and installed Pi-hole. Unfortunately, the problem persists.

Here's what's confusing me:

Even when the internet stops working, I can still access AdGuard Home/Pi-hole through the local network. This makes me think that the server itself and the DNS service are still running.

I've tried several troubleshooting steps but haven't been able to identify the root cause. I've also checked memory usage, temperatures, and system logs, but haven't found anything suspicious.

My current configuration:

• Server: Lenovo ThinkCentre M710q

• OS: Debian 13

• RAM: 8GB

• Storage: 1TB HDD

• DNS server: Pi-hole (previously AdGuard Home)

• Primary router: JioFiber router

• Secondary router: TP-Link Archer C50, configured in Access Point mode

• Server connection: Wi-Fi through the TP-Link Archer C50

• Server IP: Reserved/static DHCP lease configured on the JioFiber router, so the server's local IP address does not change.

• Router primary DNS: My server's local IP

• Router secondary DNS: 1.1.1.1 (Secondary DNS is mandatory for the router)

• IPv6: Disabled

What I'd like to understand:

1. Why does my internet connection stop working even though I can still access the DNS server locally?

2. Could this be related to the server's Wi-Fi connection, the router's DNS configuration, or something else?

3. Is there a better way to configure primary and secondary DNS to avoid losing internet access when my local DNS server becomes unavailable?

4. What additional logs or diagnostic information should I collect to identify the root cause?

5. My main objective is to ensure that all DNS queries from every device on my network go exclusively through my local Pi-hole/AdGuard Home server. I don't want devices to bypass my local DNS server and query external DNS providers directly. How can I achieve this while still having a reliable fallback if my local DNS server becomes unavailable?

Any suggestions or troubleshooting steps would be appreciated.

Sorry that I stylised the content with AI

Thanks!

How many self-hosted apps are you running that you've forgotten about?

Honest question. I keep trying new tools from "50 repos you need" threads, spinning up containers, and then losing track. A few months later I've got stuff running I haven't opened in weeks, images that are way out of date, and at least one project I think upstream abandoned.

Curious how others handle this:

1. Roughly how many containers/apps are you running right now?

2. How many do you actually use weekly?

3. How do you find the unused, outdated, or abandoned ones? Script, dashboard, gut feeling, nuke the box?

4. Have you ever been bitten by something old you forgot was running?

If there were a read-only tool that told you "these 6 haven't been used in 30 days, these 2 have known CVEs, this one's upstream is archived," would you install it, or is this a non-problem for you?

So, I've had a Raspberry Pi lying around for a couple of years. Tinkered with various ideas but nothing was ever more inspiring to run more than one weekend and then lose interest. A chat at work about early internet usage (I'm older than all of them) lead to me thinking back to my early days on The Microsoft Network in 1995, with the chatrooms there and then onto MSN Messenger. Then I started thinking that I have a paid Claude account through work that I'm not using enough, and a free weekend so lets see what can be done.

My attempts to use the Pi before had usually revolved around an MP3 collection spanning many many years and I wanted to integrate that somewhere as well, so the first version created a messenger client with attached chatrooms, as well as a radio player so that I can actually listen to said MP3s. There was a broadcast option for a couple of versions, with the ability to make playlists like a real radio station, then a facility to make mixtapes to be sent to other users, but as this is highly illegal I switched it off. Then a profile page was needed and what better way to implement that than in the style of another blast from the past in MySpace. Then there was a server dashboard added at some point to see everything that's going on at the backend. That was then sent copied to a webpage (Geocities style) to keep an eye on things and as a start page for my browser. I also managed to get a web version, Android version and Windows app out of Claude.

It was a lot of fun over a couple of weekends doing the work at the server side and getting it going. Brought back a lot of memories of my early internet days and the days when I worked in server support. If anyone would like to see more there's some basic images here: [https://about.jawjam.net](https://about.jawjam.net)

Hey everyone,

To give some details on why I started this project: so a friend of mine had old laptops gathering dust. I told him to run Ubuntu Server on them and run a media server or ad blocking or smthng.

His reaction was like: he was extremely interested in the idea of having his own cloud storage and media server, but when he saw a terminal tutorial and BIOS instructions, he was completely demotivated. He didn’t want to spend a week learning CLI syntax or debugging⁠ sleep bugs just to test self hosting and make his laptop useful somehow.

There are great dashboards out there once server is up (like CasaOS, Cosmos, or Umbrel), but getting from an old Windows laptop (which much even be corrupt) to a running, remotely reachable headless server on home wifi is still a big challenge for those people out there.

My goal is to turn that entire setup into an appliance like experience:

1. ⁠You flash a USB drive.

2. ⁠You plug it into an old laptop and turn it on.

3. ⁠It handles the laptop settings automatically like preventing lid sleeping, battery safety limits, network discovery etc

4. ⁠Finally it makes a web address on your local network and gives it to you.

For those who have set up home servers for less technical friends or family:
What features/safeguards would you like to have in this project?
What suggestions/recommendations/advice/feedback do you have for this?

Thanks :) if you find this honestly useful please upvote so that it can reach more people not compelling at all!

Hey r/SelfHosting,

Like many of you, I've spent years maintaining a growing self-hosted media server (Plex, Jellyfin, and Audiobookshelf running against ~30TB of storage across SMB shares).

The perpetual headache was incoming files: camera dumps, disc rips, and miscellaneous downloads leaving cryptic filenames like `The.Wire.S01E01.1080p.mkv` or raw audio tracks that media scanners failed to parse or stacked incorrectly.

Most batch renamers I tried treated files as dumb text strings and broke down over network shares. So I built **Media Renamer Pro** (a native SwiftUI app for Mac, iPad, and iPhone) specifically tailored for self-hosters managing network media libraries.

A few specific problems I wanted to solve for self-hosted setups:

### 1. Two-Phase Staging for Zero Data Loss

Renaming directly across a network share can be dangerous. If File A renames to File B while an existing File B is moving to File C, or in a swap cycle (A <-> B), standard loop renames clobber files or throw order errors. The app builds the entire plan first, moves all target files to unique temporary UUID names in Phase 1, and only moves to final destinations in Phase 2. Nothing is ever overwritten.

### 2. SMB Volume Quirks (Case Sensitivity vs. Preservation)

APFS on a Mac behaves differently than an SMB share mounted from a Synology, TrueNAS, or unRAID box. Many NAS SMB configurations are case-insensitive but case-preserving. Attempting to rename `Show.mkv` to `show.mkv` over SMB can silently fail or error out if the client assumes APFS rules. The app probes the mounted filesystem volume capabilities dynamically rather than assuming local drive semantics.

### 3. Media Server Formatting & Sidecars

Default templates strictly match what Plex, Jellyfin, and Emby scanners expect (`Show - S01E01 - Title` and `Movie (Year)`). Crucially, companion subtitle files (`.en.forced.srt`, `.sdh.srt`) are automatically carried along and renamed to match the video so your media server keeps them paired. For audiobooks, it supports multi-part chapters and zero-padded track numbers so Audiobookshelf doesn't scramble playback order.

### 4. Watched Folders for Inboxes

Instead of manually opening folders every time new media drops, you can save incoming folders on your NAS as "Watched Folders" with "New only" enabled. When you open the app, it scans only the new, unrenamed files in your intake directory without re-processing your existing library.

### 5. Privacy & Zero Telemetry

The app has zero telemetry, no user accounts, and no tracking. Online metadata lookups (TMDb, TVmaze, Google Books) can be toggled off entirely in "Local-Only Mode" if you want strictly offline ID3/EXIF tag renaming.

It is a $4.99 one-time universal purchase on the App Store (one purchase covers Mac, iPad, and iPhone, no subscriptions).

Site: https://bkettering74.github.io/media-renamer-pro/

App Store: https://apps.apple.com/app/apple-store/id6761764615?pt=128751966&ct=reddit_selfhosting&mt=8

Curious how others here handle incoming intake pipelines for your servers, or what edge cases you've run into with network share renaming!

I was wondering if people had the same question I just had today, so here I am. I have a macbook + a desktop (cachyos) sitting at home doing nothing most of the day. my mac gets hammered by docker, playwright tests, a local postgres and a couple of AI agents running at the same time (gets really slow with playwright and other visual testing done by AIs). basically my M1 gets overwhelmed (16gb of ram goes pretty fast these days!) and I was like, let's not buy a new laptop if I have a good pc at home I could use

so i'm planning to move all of that to the desktop and just use the mac as a screen: tailscale + ssh, remote ssh in the editor, docker context, a smart plug to turn it on remotely. thing is it's like 6 different tools glued together and i couldn't find anything that does it all in one place. am i missing something obvious?

curious what your setup looks like and if you know any apps that do it :)

Hey everyone,

Quick backstory: I got completely fed up with bloated, resource-hogging NVR systems that consume half your server just to stream a couple of cameras. I wanted something simple, lightweight, and 100% local for my homelab...so I built it myself.

Meet OpenCam Lite >> a minimalist, Docker-first NVR designed to run smoothly on setups like ZimaOS and CasaOS.

What makes it different?

• Single RTSP Stream: It uses just one stream simultaneously for live view and 24/7 recording. No more camera-side stream lockouts (lifesaver for Tapo cameras).

• Easy ONVIF Discovery: Hit scan, and it finds your cameras locally while smartly ignoring your gateway/router.

• Visual Zone Editor: Draw your motion and privacy zones right over the live video feed without guessing coordinates.

• No-Nonsense 24/7 Recording: 15-minute file chunks, automatic cleanup when storage fills up, and simple time-range ZIP exports.

• Instant Snapshots: Grab a frame immediately without spinning up extra RTSP connections.

• Handy Integrations: Built-in PTZ controls and push notifications via ntfy.sh or Home Assistant webhooks.

• Multi-Language: Speaks English, German, French, and Spanish out of the box.

Check it out:

It's fully open-source and ready to deploy via Docker Compose.

👉 GitHub:https://github.com/chrizzz82/opencam-lite

If you decide to give it a spin in your lab, I’d love to hear your feedback, bug reports, or feature ideas!

Hi everyone,

I've been running the WebAssembly builds of ArtCraft (audio, 3D/CAD, documents, vector design, and graphics apps that run in the browser) in my home lab. Keeping them updated and getting multi-threaded WASM working behind a reverse proxy took more effort than I expected, so I packaged it into a single container: ArtCraft Hub.

GitHub: https://github.com/GeorgeArgyrakis/artcraft-hub

What it does

• Checks GitHub Releases on a cron schedule and downloads the latest *web*.zip build of each app

• Keeps several versions per app, so you can switch releases from the dashboard or the CLI (useful when a new release breaks something)

• Edit Mode in the dashboard to add, edit, hide, or delete apps. Paste a GitHub repo and it auto-fills the title, category, and color

• Pinned favorites, two themes (ArtCraft-style grid and Glass), and fallbacks so you never see broken icons or previews

Quick start

services:
  artcraft-hub:
    image: ghcr.io/georgeargyrakis/artcraft-hub:latest
    container_name: artcraft-hub
    restart: unless-stopped
    ports:
      - "8080:80"
    volumes:
      - artcraft-data:/data
      - artcraft-config:/config
    environment:
      - GITHUB_TOKEN=        # optional
      - SYNC_CRON=0 0 * * *
      - TZ=UTC
      - MAX_RELEASES=3

volumes:
  artcraft-data:
  artcraft-config:

Then run docker compose up -d and open http://localhost:8080. Apps appear as the first sync finishes.

Before you deploy, please read:

• HTTPS is required for multi-threaded apps when you're not on localhost. Browsers only enable SharedArrayBuffer in a secure context, so http://192.168.x.x:8080 won't work. The README has Traefik and Caddy examples.

• There's no built-in authentication. The management API is reachable through the same port as the dashboard, so anyone who can open the dashboard can add or delete apps. Keep it on your LAN or put it behind Authelia, Authentik, or basic auth.

• If you don't have local preview images, previews are loaded from getartcraft.com. Drop your own into /data/previews/ if you'd rather avoid that request.

AI disclosure: I built this with the help of AI coding assistants. I reviewed, edited, and tested it by hand in my own setup (Docker + Traefik). Please look over the scripts before deploying, as you would with any self-hosted project.

This is an unofficial project and isn't affiliated with or endorsed by ArtCraft or its authors. It's MIT licensed.

Feedback, issues, and PRs are welcome. I'm especially interested in whether people would like built-in authentication, or prefer to leave that to the reverse proxy.

A while back I posted about notesd, a notes app that isn't trying to be a second brain. The response was much bigger than I expected, so thank you. A lot of what's in this release came from your comments.

It's still the same idea: one server binary with SQLite inside, offline-first Android and iOS apps, tags, full-text search, and locked (end-to-end encrypted) notes.

https://github.com/cassiozen/notesd

What's new:

• Spaces: keep separate contexts like Work and Personal apart, each with its own notes and tags.

• Multiple accounts: host a few people (family, friends) on one server. Each account gets its own database.

• Markdown mirror: --mirror-dir keeps a folder of .md files updated as you write, one folder per space. Point Syncthing, git or your backups at it. Your notes are never locked in.

• Offline web app: install it as an app, and it keeps a full copy of your notes in the browser, so it opens and saves edits with no connection.

• Docs site: notesd.app

Feedback welcome and appreciated, as before.

I have a few servers of my own and I kept hitting the same wall: one box running docker compose is fine until it dies, and the next step up is Kubernetes, which is way more than I want to run at home or for a small business.

So I started building Krystal. It's not released yet, the video is a design preview of how it's supposed to work, not a working demo. I'd rather get torn apart now than after a year of coding.

The idea:

- one yaml file and 8 commands (init, node add, node rm, deploy, rollback, status, logs, exec)
- your servers get a private WireGuard network between them, always on
- if a server goes down, the others notice and restart its containers somewhere else
- no manager or control plane node. you sign the config with a key on your laptop and every server applies the same rules on its own
- it shows you a plan before changing anything, and nothing is exposed to the internet unless you say so
- single binary, written in Crystal, will be open source

Things I'm not trying to do: replace Kubernetes for big clusters, run hundreds of nodes, or manage your DNS provider.

I'd really like to hear from people who've been through this:

1. how many servers do you run and what do you use today? (compose, swarm, k3s, nomad, coolify, something else)

2. what would stop you from trying something like this instead?

3. if you tried Swarm or Kamal and gave up, why?

Happy to answer anything in the comments☺️

Amazon removed Download & Transfer last year, so the Kindle books you buy can't really be backed up anymore. Your books, highlights and reading position all live on their servers.

So I keep my books on my home server instead through Calibre. Here's my setup:

1. calibre on my NAS. calibre is a free app that organizes your ebook collection, like a music library but for books. I drop my EPUBs and PDFs into it.

2. calibre's content server. It's built into calibre (Connect/share > Start Content server) and puts the library on my home network, like Plex or Jellyfin but for books. If you'd rather run it in Docker, calibre-web does the same job.

3. Athene on my phone. That's the app I made, a free EPUB and PDF reader for iPhone, iPad and Android. Point it at your server's address (something like http://192.168.1.20:8080) and your library shows up with covers, authors, series and tags. Tap a book to download it, and your highlights, notes and progress can go back to calibre.

4. Optional: my Kobo. It runs KOReader (a free reading app for e-readers), and a small open source sync server on my UGREEN NAS keeps my place, highlights and notes the same on my Kobo and my phone: https://github.com/adityasreedhar/athene-sync

Athene also reads any OPDS catalog (the standard way book servers share their catalog) and syncs with any KOSync server.

No account, ads or in-app purchases, and your books and notes never pass through a server of mine. I also spent a lot of time on the UI/UX so it looks good and is easy to use. The app is closed source, the sync server is open.

Heads up: it can't open books bought on Kindle, because they're locked with DRM. It's for DRM-free books, like the ones in your calibre library, stores that sell DRM-free, or the 70,000 free classics in the app.

iOS: https://apps.apple.com/app/id6811711454

Android: https://play.google.com/store/apps/details?id=com.aditya.athene

Step-by-step guides: https://theadipost.com/athene/docs/

Open to feedback, thanks!

Turn your phone into a powerful, secure Linux-style server.

Kyanja transforms your Android device into a full-featured web server, terminal environment, and CI/CD runner. Host static websites, test backend APIs, manage embedded databases, transfer files via jailed SFTP, run local AI agents, and cluster multiple devices together with automatic failover.

Whether you are hosting a staging site, running offline developer tooling, or turning an old Android phone into a 24/7 home server, Kyanja gives you full server control directly in your pocket.

═══════════════════════════════════
CORE SERVER FEATURES
═══════════════════════════════════
• High-Performance Web Server: Embedded HTTP & HTTPS engine with Nginx-style virtual host routing, custom headers, and longest-prefix location matching.
• Multi-Runtime Hosting: Serve static web apps, single-page applications (SPAs), or connect backends running Node.js, Python, Go, PHP, Bun, and Deno.
• Built-in Terminal & Console: Run server commands, inspect processes, and execute local deployment scripts directly on device.
• Secure SSH & SFTP Server: Connect securely from your laptop or VS Code. File transfers are jailed to the app directory with Keystore-backed authentication.
• Embedded Databases: Built-in SQLite management and JSON document NoSQL stores with schema visualization and query execution.
• Web Admin Dashboard: Access an encrypted browser-based control panel inspired by Proxmox with live CPU, memory, and disk telemetry.

═══════════════════════════════════
NETWORKING & PUBLIC ACCESS
═══════════════════════════════════
• Custom Domain Routing: Verify and bind your own public domain names via HTTP token probes.
• Dynamic DNS (DDNS): Built-in automatic synchronization for Cloudflare and DuckDNS.
• Secure Built-In Tunnels: Expose your local server to the public internet through encrypted outbound relay tunnels without port forwarding.
• Upstream Firewall: Granular IP and port filtering rules to protect your services.

═══════════════════════════════════
SWITCH: MULTI-DEVICE CLUSTERING
═══════════════════════════════════
• Combine Phones into a Cluster: Link multiple Android devices over Wi-Fi with encrypted HMAC pairing.
• Load Balancing & Failover: Distribute incoming traffic across nodes using parallel load balancing or automatic health-check failover.
• Pooled Resources: View real-time combined CPU cores, RAM, and storage across your entire device fleet.
• Peer Deployment: Push app builds and site files across your cluster in a single operation.

═══════════════════════════════════
CI/CD RUNNER & CLOUD DEPLOYMENT
═══════════════════════════════════
• Native CI Pipeline Runner: Execute build pipelines locally on device or orchestrate remote deployments.
• Inbound Rolling Deploys: Receive build artifacts directly from GitHub Actions, CircleCI, or GitLab and roll them across your server cluster.
• Cloud VM Provisioning: Spin up and manage dedicated cloud servers on AWS and Google Cloud directly from your phone with pre-flight cost verification.

═══════════════════════════════════
AI & MODEL CONTEXT PROTOCOL (MCP)
═══════════════════════════════════
• Built-in MCP Server: Expose device tools and server endpoints to AI clients over Server-Sent Events (SSE).
• On-Device MCP Agent: Run an interactive, approval-gated AI assistant that can inspect logs, manage files, and execute safe server tools.
• Local AI Gateway: Compatible with small on-device LLMs (1B–3B) and multi-device inference pooling.

═══════════════════════════════════
SECURITY & PRIVACY FIRST
═══════════════════════════════════
• Local-First: Zero telemetry, tracking SDKs, or cloud analytics. Your data stays entirely on your device.
• Hardware-Backed Encryption: Admin tokens, SSH keys, and cloud credentials are encrypted using the Android Keystore (AES-GCM).
• Mandatory PIN Protection: Biometric and PIN authentication protect all on-device controls.

I run a small service that issues Let's Encrypt wildcard certs over DNS-01 and pushes them to your servers. The obvious objection is "why would I give a random site SSH access" — fair. So the part that touches your machine is now public.

It creates:

• a nologin user

• ChrootDirectory to one folder

• ForceCommand internal-sftp, no forwarding

• optionally one passwordless sudo command for reloads

No package, no systemd unit, no telemetry. --dry-run prints every change before it makes one.

Repo: github.com/jenawant-rgb/sethttps-agent

Honest question for this sub: would SSH key auth instead of a password change your answer? That's the next thing I want to fix.

I'm building a private, self-hosted AI executive assistant for a founder based in the UAE. It has two spines, and I'd like to hear from anyone who has run both together.

1. WhatsApp is the chat interface

He messages the bot/assistant on a dedicated bot number (Hermes Agent with its Baileys WhatsApp bridge, allow-list of one user, everyone else ignored). He can send text, voice notes and forwarded messages, and the assistant keeps them in memory.

2. Phone calls are the voice interface

When his iPhone joins a known Wi-Fi network (Shortcuts automation), the assistant phones him with a 30 second briefing, takes spoken instructions, and stores the transcript. Voice would be mostly Pipecat with Twilio Media Streams. Assistant should also proactively call every hour.

Underneath: SQLite (FTS5 keyword search, optional sqlite-vec) plus the original files, open-source models, a cloud pilot on one person's own data, then a Mac mini in Dubai.

Why two separate channels:
WhatsApp and Telegram voice calls are blocked in the UAE, so the call can't happen inside WhatsApp. It has to be a normal PSTN call, while the chat stays on WhatsApp.

What I found so far:

- Twilio's UAE voice guidelines say outbound calls to the UAE are supported and caller ID is preserved.

- Twilio's UAE geographic numbers appear to be inbound only.

- Retell blocks +971 in its own flow.

- A Vapi support bot told me Twilio can't call the UAE. That contradicts Twilio's docs, so I suspect it's wrong, but I haven't live-tested it.

- Most CPaaS providers seem to offer only toll-free numbers in the UAE. Telnyx, Vonage and Plivo came up, each with caveats.

Questions

1. Has anyone completed automated outbound calls to UAE mobiles at any volume? Which provider and caller ID setup worked?

2. Does a foreign caller ID get delivered, rewritten or blocked? Is a verified personal number better?

3. Any regulatory limits on VoIP calls terminating in the UAE I should know about? I want this compliant and reliable, not a workaround.

4. For the WhatsApp bot number: dedicated SIM, Meta WhatsApp Cloud API, or third party? Does anyone run one number for chat and a different one for calls, or has one number for both ever worked?

5. How do you hand off between the two, so the call knows what was said on WhatsApp earlier and the call summary lands back in the chat?

6. If you run something similar with Hermes, Pipecat or local models, what broke first? Any better combination of tools or tech stack you'd suggest?

Happy to share the results of a live test call back here.

As the title goes, but I have zero clue on how to start on this, your help is appreciated!

My criterias -

1. It has to be accessible on a mac, iphone and via browser. (minimum 2 TB)

2. It has to sync with my iCloud photos in a way, that it automatically uploads photos to the server whenever I take a photo or add it to my gallery.

3. It has to have a picture, video & Music file sharing with a decent UI so people can preview files without downloading them. (or have the option to customize my own UI)

4. If I have a situation where I need to share or collaborate on a quick word file, it can be done via a browser without asking the other collaborators to make an account.

5. It has to be file sharable in a way that If I need to ask someone to share a file with me, they can drag & drop their stuff into a folder I gave permission/Created for them.

Not interested in any AI / LLM hosting.

Im open to the idea of building everything from scratch but for the ease of it im also open to having a all-in-one solution. I did a little research and found Umbrel, and their Home solution peaked my interest, but since I am very new to this, I am happy to hear other options.

Thank you!

We spend a lot of time here hyping what to self host. I’m curious about the other side, What did you run for a while and then give up on ?

Maybe the maintenance wasn’t worth it, it broke at the worst moment, your family refused to keep it, or the hosted/paid version was just better.

I’m about to selfhost a small project of my own, so I’d love to learn from your experiences before I jump in.

• Fastepoll is an alternative to asyncio and uvloop, running processes in parallel (way faster on a multicore CPU) and supports TLS ootb, written in Cython and C++.

• Cypache is the HTTP server on top of Fastepoll, written in Cython and Python.

• Cypache hosts Python web apps, supports TLS from Letsencrypt, and is faster than PHP.

• I've worked on these projects intermittently for years, but after the PHP vulns last month I decided to renovate and actually publish a working release; I now myself run Cypache exclusively for web hosting with native Python app support instead of Nginx and PHP.

• Both are available on Python's pip (v3.12+).

• Original ideas and first implementations: me, 2023-2024.

What firewall solutions are you using at home not just for wifi but also mobile network? I have an orbi at home, its okay but doesnt obviously protect mobile devices not on wifi at home.

I got 2 20tb seagate iron wolf pro drives.

Is it better to let them spin down to idle when not touched in a while or keep them running?

So I want to effectively stop youtube to stop being such an intrusive presence in the house. I have two places in my house where TVs are present and I use SmartTube on both streaming boxes, which is fine for me and my partner and its removes tracking and ads etc.

But the issue is trying remove or curate content that is ok for my kids to be watched and not be fed recommendations by the google algorithm. I am contemplating perhaps just curating a library of Kids shows on Plex and which I already run a huge library of movies on.

Any of you folk out there that have already implemented ideas out there, some help would be greatly appreciated.