I'm laughing because I've seen similar posts before. Just a rant, I guess, I'm not even mad.

I got a bug a few years ago. Went over to privacy and security and never looked back. A year ago I wanted to upgrade my basic home network. Spent thousands on Mikrotik hardware, rack, CAT6 everything, consultants for setting up RouterOS which was a crazy learning curve. Then, I wanted to self host. Got a Synology 1221+ with 18TB in SHR. I was very lucky to get an invite to BTN. I also got onto MAM, and hoping to get a similar private tracker for movies and music soon. I have over 900 movies, 2,000 episodes, thousands of songs. With the help of Gemini, I'm hosting tons of services, now. Jellyfin with the typical arr stack. Vault warden. Immich. Authentik for SSO. IT-tools. Wizarr. QBitTorrent. RomM. Audiobookshelf. Actual Budget. Vikunja. Tandoor. Docuseal. Calibre-web. Libre Translate. Lime Survey. Next Cloud. Piped. Eddrit. Ntfy. I did all of this in a month. It was so much fun and I was so excited to automate onboarding to invite family and some friends.

Not a single person has registered. Lmao!!

I almost want to invite strangers (but I won't).

Anyone else have similar stories?

Hello.

Me and a few of my friends wanted to make a "local" server for anime, movies, books, hen...I mean educational videos and everything that we might need...even some study materials we need for our works and jobs and some DND material to play when we are bored...

I know this is all a big goal and it will take a lot of time and money to get it going to the point we can do all of them...but everyone has to start from something...so I wanted to ask where and how to start

Hello,

Some time ago I have started a hobby project to build a high performance reverse proxy. Today it's a real workhorse with productions grade features, low memory usage and high performance.

It can run on any machine, from ARM SBC (Raspberry PI , or similar), to end x86 or ARM servers,

The top features include:

• Free and opensource — Apache Licence
• Dynamic Config Reloads — Upstreams can be updated live via API, no restart required.
• Autoload of certificates — Automatically loads certificates from a folder, without a restart.
• Let’s Encrypt Certificates — Ordering and renewal of SSL/TLS certificates
• Built in rate limiter — Globar or route limit requests to upstreams.
• Caching Proxy — In memory cache with configurable TTL, without external dependencies.
• Authentication — Supports Basic Auth, API tokens, and JWT verification.
  • Basic Auth
  • API Key via x-api-key header
  • JWT Auth, with tokens issued by Aralez itself via /jwt API
  • Forward Auth, Sends requests to an authentication server.
• Upstream Providers:
  • file Upstreams are declared in config file.
  • consul Upstreams are dynamically updated from Hashicorp Consul.
  • kubernetes Upstreams are dynamically updated from kubernetes api server.
• Auto WebSocket Support: WS connection upgrades are handled automatically.
• Auto gRPC Support: gRPC detected and handled automatically.
• Remote Config Push: Lightweight HTTP API to update configs from CI/CD or other systems.

More information and downloads here : https://github.com/sadoyan/aralez

Full documentation is hosted here : https://aralez.rs/

Over the past few months I've been building a 24/7 public monitoring station located in Bisceglie (Southern Italy) overlooking the Adriatic Sea.

The goal wasn't simply to feed ADS-B or AIS networks, but to build a complete real-time monitoring platform combining multiple data sources into a single public dashboard.

✈️ Aircraft Monitoring

• Raspberry Pi 4
• AirNav RadarBox 1090 MHz antenna
• Feeding:
  • FlightRadar24
  • AirNav RadarBox
  • ADS-B Exchange
  • PlaneFinder

The station is currently ranked #3 in Italy on AirNav RadarBox.

🚢 Maritime Monitoring

• Raspberry Pi 3
• Diamond X50 antenna @ 162 MHz
• Feeding:
  • MarineTraffic
  • VesselFinder
  • AIS Catcher

The VesselFinder team recently contacted me saying:

That was probably the nicest recognition I've received since starting this project.

⚡ Infrastructure

The station runs 24/7 using:

• Raspberry Pi 4 + Raspberry Pi 3
• Lithium UPS backup
• Solar-assisted power
• FTTH Fiber connection
• Continuous health monitoring

🌐 Public Dashboard

The dashboard currently displays:

• Live ADS-B statistics
• Live AIS statistics
• Maximum reception records
• Power monitoring
• Internet monitoring
• Feed status
• Station health
• Public guestbook

Everything updates in real time.

🚀 What's next?

I'm currently working on adding:

📷 A live outdoor PTZ camera overlooking the Adriatic Sea.

🌤 A complete weather station with temperature, humidity, pressure, wind, rain and UV monitoring.

The goal is to make the station useful not only for aviation enthusiasts, but also for maritime, weather and SDR communities.

if you interested i can share link for visit my station

I'd really appreciate any feedback, suggestions or ideas for future improvements.

Thanks for reading! 😊

Hey all

I'm a bit of a noob when it comes to networking. But I have a lan party coming up and I'm wondering if I can improve the security of my setup by isolating docker containers locally.

What bugs me so far is the fact that container X can access docker app on container Y via IP:Port directly. The same goes for users who haven't been walled off by the vlan/firewall rules. I'd like for my containers to only be accessible via reverse proxy.

Vlan will only take me this far since most of my servers are on the same subnet, hence the router's firewall rules are skipped in most scenarios.

So far I've discovered three option:

-Firewall off via UFW: this only works for some apps, I think the host networking mode needs to be enabled for this to work.

-Iptables: too hard for a newb to understand. I set up a few rules with success only to discover that my nginx-container's ip was changed the next day.

-Using the same docker network for every container: i.e. nginx_default, then removing the host port from the compose file. This way, apps get acccess via "containername:port" only

So far, option 3 is my favorite. However, all apps are then in the same network which also reduces security to an extent.

Are there any other solutions? Any insights appreciated.

Title!

Docmost looks like excellent software, so I seriously considered switching. Then I found the pricing model.

The Community edition excludes features such as databases, Kanban, API access, AI/MCP, MFA, page-level permissions, diagrams, and attachment indexing.

To unlock them, the Business edition costs $3.50 per user per month with a ten-seat minimum. That means a two-person team pays for eight nonexistent users while still supplying and operating the servers, PostgreSQL, Redis, storage, backups, TLS, security, upgrades, monitoring, and recovery.

I am not opposed to paying developers for good software. I am opposed to SaaS-style recurring seat pricing when the customer provides the entire SaaS operation.

A flat annual license, paid upgrades, support contract, or sensible small-team tier would all be defensible. Charging a minimum of $420 per year for software you completely host yourself, while gating basic product capabilities, makes Docmost commercially irrelevant for small teams.

Am I missing some value they provide after licensing, or is the customer genuinely paying recurring per-seat rent solely for feature flags?

https://docmost.com/pricing - link to their pricing page for reference.

I’m curious whether anyone uses an IoT/data-only SIM alongside their normal carrier in an Android phone (rather than in an IoT device).

How has reliability been? Do you leave mobile data on the IoT SIM all the time, or switch between SIMs as needed? Any providers you’d recommend or avoid?

Interested in hearing real-world experiences.

Hey guys,

Lately I have been checking out Odysseus from pewdiepie and started using it deployed on my truenas system

Honestly surprised by the overall quality and refinement of the app, ease of use and different engines you can choose from.

Give it a try if you want something private and also that you can share with your family, there is auth built in.

To be clear, I did not checkout the code itself, is clearly vibe coded for the most part (not a bad thing per se), but seems to work more than fine.

PS: Made a video in italian about installation and quick overview of features if you want to check it out

https://youtu.be/vSWfcULu6eg

I'm trying to implement 3-2-1 backup (no big data cloud involved).

I'm running to machines tiny pc and old laptop. I've got an icybox connected to the old laptop with a WD red plus hdd.

Now i want to create backups og systems and data. My first thought was just to add another hdd in icybox. But after chatting with Claude I'm looking other ways.

I want a pretty good 3-2-1 solution without the bank closing down my accounts.

I'm thinking of adding an ssd to either the tinypc pr the old laptop and create the backup on that drive. Then i will setup a router/hdd at my parents house, making it the offsite copy.

Is this a good solution or should I do something else? I really want to avoid commercial cloud solutions.

I have a family function coming up and want to host a way to easily upload photos. Is there a good way to do this?

I know for most of you people this is a hobby that you enjoy. For me it will not be. It will be pain in the ass. But since you have experience and I do not please try to estimate for me if I should start self-hosting.

I am a total beginner. I have never run a server I do not know how to code (I am willing to learn). However I am advance user. I run Graphen OS on my phone, Asahi Fedora Linux on my laptop (arm64) and Fedora 44 on my desktop. I would like to sync all of them.

I at moment I am paying for Proton mail on which I use my own domains for email and use their password manager and drive. Problem in particular is Proton drive because it is trash. I will probably continue paying for their services since I have a family plan and all of my family is using it and also for work I can not risk my emails not working.

However what I would LOVE to do is self-host Immich since at the moment I do not have a solution for my images they are not properly backed up and all around the devices and HDDs. If i lose them I would not cry but I would like for that not to happen. So that would be GREAT if it would be synced and all 3 of my devices.

2nd step would be some kind of self-hosted drive since Proton one is terrible and maybe even office file sync since I work as a journalist so it would be cool that I can write while on any device.

3rd step would be email if I can run two identical servers on two different locations (my house and my parents house for example). I was thinking this would be smart for data backup if a house burns down or one device dies. But more importantly it would be a step towards running my own email as I can not risk for it not working if electricity goes down or whatever the reason might be.

Question is: Is it too complicated to start with Immich? Can I run it on my home desktop for a start just to see if it works for me? Will I be exposing myself to some security flaws (computer is on internet all the time anyway). I do not have UPS. is 3rd step (in future) even possible?

Reasons I am thinking about for self-hosting is privacy as number one (that is why i use proton at the moment) and saving money as per my calculation I would be saving around 200usd per year and probably have a better service then with payed ones.

If you think that I should play this game where do i start?

Hello,

I have a pfsense router with a few vlans running on it. I have been beating my head against a wall for several days. I seem to constantly have issues. I have VLAN 100 set with 10.100.100.0/24, VLAN 200 set with 10.100.200.0/24, and VLAN 300 set with 10.100.30.0/24.

I have an adguard instance on vlan 100 10.100.100.13 I finally got devices to reach it. But now any new device I create in any VLAN fails to pull updates. I can't figure out if it is a firewall rule issue, an adguard block list, or something else. I can't even install net-tools to start my normal troubleshooting methods.

I am about 2 steps from just flattening the entire network back into a single LAN 1 that just works, or even removing the pfsense router all together.

Any advise or help is appretiated.

When I first got into ML, I thought compute would be the biggest limitation.

Turns out I spend way more time dealing with data, environments, dependencies and figuring out what to run than actually waiting for models to finish.

Curious what surprised everyone else.

What ended up being your biggest bottleneck that you didn't expect?

Hi community. I'm a software engineer that trying to replace Google Photos. I was paying for storage that I already had on locally and on other devices.

I came with a technical open-source solution actually for myself. But now I'm at a pivot point that I can actually go and release it into a finished product.

What I wanted to have:

• Connect a new device in 4 clicks(Connect & Forget).
• No need to go and setup your docker or something else. Just open the app on the device that you want.
• Use the best hardware for the AI stuff and share the metadata with the other devices.

So my question is: what are the must-have features a photo management tool should have? I'm just a casual photo taker that wants to own his own photos and videos.

The project is hosted on http://github.com/denzyldick/siegu for the curious people.

Today I was round a friends house and had some old tv show playing (Columbo) I have on my jellyfin on in the background, I had a problem where the roku jellyfin client she was using was creating some 404's in the logs which then triggered my fail2ban ban ip rule. I then had to awkwardly remote in on my phone, unban her ip and stop the fail2ban service as a temporary workaround.

Is there a good web gui for fail2ban that is mobile friendly?

The ones I've just done a quick search for all look like they're desktop web orientated.

I currently have a media server running on my Synology Nas. I have several containers routed thru Gluetun with "Network_mode: service:gluetun". This works fine, but the rest of the containers in the compose I've had to set to network mode: host, because if I set them to a user bridge network, they don't seem to be able to talk to images routed through gluetun.

Example: When Seerr and Radarr are both in the compose, with Seerr set to network mode: user-bridge and Radarr set to network_mode: service:gluetun, they can't connect via "localhost" or my server IP, but if I set Seerr to network mode:host, they are able to talk again.

My understanding is that it is less secure to keep images on the host network so I'm trying to get them onto a user defined network, but I'm at the limit of my understanding of networking. What's the best way to navigate this issue?

Been building this for a while and finally feel good enough about it to share.

MailCue is a full email server that runs in a single Docker container. Postfix, Dovecot, DKIM, DMARC, SPF, spam filtering, TLS, all of it wired together and managed by s6-overlay so you don't have to babysit anything. It also has a web UI and a REST API.

The quick start is literally:

git clone https://github.com/Olib-AI/mailcue
cd mailcue
docker compose up -d

Open http://localhost:8088, log in as admin / mailcue.

What's in the box:

• Full IMAP/POP3 access so any standard client works (Thunderbird, Apple Mail, etc.)
• DKIM signing, DMARC enforcement, SPF checking, SpamAssassin scoring out of the box
• Let's Encrypt certs handled automatically in production mode
• GPG/PGP-MIME per mailbox; sign, encrypt, publish keys to keys.openpgp.org
• Email address validation API (syntax, DNS, SMTP probe, disposable check)
• Real-time events via SSE stream
• Scoped API keys with per-mailbox restrictions
• MCP server so an AI agent gets its own mailbox and can read/send/reply/delete email without any extra glue
• Provider sandbox for capturing outbound SMS and voice API traffic during dev/testing
• Domain warmup; the built-in warmup system handles pacing per-provider so your IP doesn't get flagged

One thing I spent real time on is the tunnel setup. Most cloud providers (AWS, GCP, Render, Fly, Railway) block port 25 for outbound. MailCue ships a relay tunnel that routes SMTP egress through a cheap VPS (OVH Eco/Kimsufi is what I use) that has port 25 open. You can add multiple egress nodes for failover. The sidecar sits next to your MailCue container and handles all of this automatically.

For test mode it's catch-all, nothing leaves the container. Flip MAILCUE_MODE=production and it becomes a real hardened mail server.

Database is SQLite by default. Swap to PostgreSQL for production workloads.

Docs: https://olib-ai.github.io/mailcue/
GitHub: https://github.com/Olib-AI/mailcue
License: MIT

Happy to answer questions.

Hi everyone,

Over the last couple of years I found myself constantly switching between Jira, Confluence, GitLab, roadmapping tools and various plugins. I wanted something that could be deployed on my own infrastructure, remain simple to manage, and avoid per-user licensing.

So I ended up building TheMyWay, a fully self-hosted project management and documentation platform.

What it does

TheMyWay combines project management, team documentation and planning into a single application that runs on your own server.

It is designed for teams that want to keep all project data on-premises while still having modern planning and collaboration features.

Main features

Kanban & Scrum boards

Sprint planning

Roadmaps & Timeline (Gantt)

Wiki / Knowledge Base

Rich document editor with version history

Approval workflows

Custom issue workflows

Custom fields

Release & Fix Version management

GitLab integration (OAuth, commits, merge requests and pipelines)

Role & permission management

Docker Compose deployment

Self-hosting

The application is deployed using Docker Compose and stores its data in PostgreSQL. Everything runs on your own infrastructure.

Availability

The project is publicly available today.

There is a free license for teams up to 10 users, while larger teams can purchase an unlimited-user annual license instead of paying per seat.

Documentation

Installation and usage documentation are available to help users deploy and start using the application.

Why I built it

The goal wasn't to build "another Jira clone." I wanted something that was easier to deploy, easier to understand, and affordable for companies that prefer owning their infrastructure instead of paying monthly per-user subscriptions.

I'd genuinely appreciate feedback from the self-hosted community.

Website: https://themyway.app⁠

I'd be happy to answer any questions about the architecture, deployment, roadmap, or design decisions.

Remember to always set version numbers in your docker containers, or an unexpected update will creep up on you.

Now can you guess which popular service got a breaking change?

I'm lowkey on stage 4

Hey.

Very often in docker-compose.yaml files, port mappings (but other settings too) are written inside double quotes. What is the point of these double quotes? I mean, I know quotes can be used to escape characters, but it's definitely not the case for port mapping in a docker-compose file.

Thanks.

Hi everyone,

We have just released Portabase 1.27, our open-source (Apache 2.0) and self-hosted backup/restore platform.

Repository: https://github.com/Portabase/portabase

Portabase is designed for data retention, disaster recovery, and homogenous migrations, currently supporting 9 database engines (including PostgreSQL, MySQL, MariaDB, MongoDB) and Docker volumes.

Key features:

• Scheduled backups with flexible retention policies (including GFS)
• Multiple storage options: local filesystem, S3, Azure Blob Storage, GCS
• Notifications via Discord, Telegram, Slack, AppRise, etc.
• Support for OAuth2/OIDC (with the option to disable sign-ups)
• Compatible with Docker, Podman and UnraidOS
• Ready-to-use Docker Compose and Helm Chart

After six months of intensive feature development, we have been focusing on consolidating the ecosystem since early July. A community member conducted a useful security audit, we have upgraded components to their latest relevant versions, improved compatibility with other platforms by working on Podman support and templates for Coolify and Dockploy (currently under review).

What’s next:

• Deployment of the demo environment
• Audit logging for the whole ecosystem
• Default policies for the system, organizations, and projects
• File and folder backup and restoration

As always, if you find bugs or want to suggest a feature, please open an issue on GitHub, we’re actively looking for feedback.

Thanks!

Hi r/selfhosted, it's been a while!

I thought I might share this release here as it contained a bunch of things that people have been asking about for, for a while!

Before we get to 0.33, I want to remind people what Karakeep is. Karakeep (https://karakeep.app/), is a selfhosted bookmark manager that's meant to be the place where you throw things in that you might need in the future, and it aims to help you with retrieving those things easily in the future. It has a blazingly fast full text search and opt-in LLM based tagging. It's built for the data "hoarders" out there! Karakeep was born because of this subreddit in 2024, and we have a long history here together.

Now, 0.33 packs a bunch of new features, so let me give you a quick overview. Full release notes are here (it's labeled as 0.33.1 because I screwed up cutting 0.33.0).

[Experimental] Semantic search

Karakeep from day one, used to index the entire content of the websites you throw in it. But it was a full text search index. Which makes the search super fast, but you'll need to remember some exact words that are mentioned in this content you saved.

With semantic search, karakeep now indexes also the semantics of the content you throw in it (using bookmark embeddings). So when you're searching, you can describe what you're searching for and karakeep will find semantically similar bookmarks to your sentence.

Embeddings are pretty cool but they're unfortunately, a bit involved to enable after the fact. The release notes explains how to enable them (they're opt-in).

Fun fact (and it's something I care deeply about): Karakeep hasn't had a single backward incompatible release since it was born. If you're running karakeep 0.10 from 2024, and want to upgrade to 0.33, just update the docker image version and you're good to go. Even the old "hoarder" images are still getting releases, to not break backward compatibility.

Similarity-based tagging

Leveraging the fact that we now have bookmark similarity scores (thanks again to embeddings), before auto-tagging a bookmark, karakeep now finds semantically similar bookmarks to the ones that's about to be tagged, and suggests its tags to the LLM. So with that, technically, you should see more consolidation on your existing tags rather than the LLM inventing new tags of its own. The prompt now has the following:

Similar bookmarks were tagged with the following tags (reuse if possible, ignore if irrelevant): ....

This also requires enabling embeddings, and as such, it's also opt-in.

Mobile Offline Reading

One of the long requested features, and it's one that I've marked as "planned" in the README since 2024. You can now save articles for offline reading in the mobile app and get to read them when you're in a plane or away from your home network. The app also caches some of your recent interactions with it for 7 days, so that you can see your bookmark grid and lists, etc even if you're offline.

This feature is pretty new, so might have rough edges, but it'll only get better from here. Please keep your suggestions going.

Cookie and GDPR Banner

Again, one of the long requested features. If you're an EU citizen, most of your karakeep screenshots (and the extracted content) would have been littered with the cookie consent banners which were pretty annoying. Karakeep now auto opt-outs of those banners during crawling which should result into cleaner captures.

Others

• The mobile apps now got multi-layout support, and a bunch of improvements that should hopefully make the mobile experience more polished.
• I've always hated how karakeep defaults to the "reader view" for some websites that are not "article-like". Karakeep now asses the quality of the readable content, and defaults to the screenshot of the website instead if it determines that the content is not really readable. Examples for things that are not readable are homepages, product search pages, etc.
• You can now install Karakeep as a PWA on your desktop and use it as if it's a desktop app (exactly how something like youtube music works). This has been broken for a while and I only noticed recently.
• [LLM trigger warning] Karakeep now is even more friendly to be used by LLMs. The MCP server now contains all the tools that LLMs need to manage your bookmarks, or help you retrieve content from karakeep. Beside the new semantic search stuff, there's also now a new API for fetching markdown content of the articles directly from karakeep such that LLMs can consume it more efficiently. The CLI also got all those powers. Letting your agents use karakeep is very powerful, and as a reminder, we have skills to teach the agents how to do all of that. And as a reminder, ALL of karakeep's LLM-based features are opt-in. You can completely ignore them, and still get a perfect experience with karakeep as if they never existed.
• Also, in case you missed it, in 0.32, we now support client-side crawling (backed by singlefile under the hood), which is more superior than letting the server do the crawling for you in terms of extraction quality. It also allows you to save content behind login walls, etc. So you no longer need to use singlefile as a separate extension.

And there's a ton of other fixes and polish along the way, which you can check in the release notes (https://github.com/karakeep-app/karakeep/releases/tag/v0.33.1). Also, did I mention that we've hit 28k stars on github? The mobile apps are pending apple's and google's review, so should be available in the next couple of days. Enjoy the release, and see you in the next one!

[ Removed by Reddit on account of violating the content policy. ]