Self-Hosting like it's 2025

https://kiranet.org/self-hosting-like-its-2025/

by finnlab • 1 year ago

221 227 1 year ago

kiranet.org

ValdikSS• 1 year ago

Nah, that doesn't look fun. Self-hosting in 2025 should look like Yunohost or Sandstorm.

arnley• 1 year ago

You sir know how to appreciate the simplicity such service providers deliver.

pjc502• 1 year ago

I'd not heard of yunohost, so I went googling and found https://www.reddit.com/r/selfhosted/comments/1ey9ayp/what_ma...

Seems like Docker has won so comprehensively that even more convenient (But unfamiliar) options are pushed to use it.

crabmusket2• 1 year ago

I really like Sandstorm - it's a glimpse into an alternate world of how things could be.

brulard6• 1 year ago

I tried the demo, but I still don't get it. What is it? Is it supposed to be like a collection of productivity apps, like google docs/drive ? The demo worked poorly, I waited very long time for many interactions, some didn't work at all (like changing font on etherpad).

Helmut10001• 1 year ago

I tried portainer once, it looked nice and had a lot of features... for which I had no use. I always found `docker compose` much easier to use, it is often just an alias and a tab away, where for portainer I would have to open a browser tab and sometimes even touch my mouse!

Otherwise good article. If you want to go rootless (which you should!), Podman is the way to go; but Docker works rootless too, with some modifications [1]. I have found Docker rootless to be reliable and robust on both Debian and Ubuntu. It also solves permissions problems because your rootless user owns files inside and outside the container, whereas with rootful setups all files outside the container are owned by root, which can be a pain.

Also, you don't need Watchtower. Automatic `docker compose pull` can be setup using standard crontab, see [2].

[1] https://du.nkel.dev/blog/2023-12-12_mastodon-docker-rootless...

[2] https://du.nkel.dev/blog/2023-12-12_mastodon-docker-rootless...

kalaksi• 1 year ago

Can I suggest Lightkeeper (I'm the maintainer): https://github.com/kalaksi/lightkeeper. I made it for my own needs to simplify repetitive tasks and provide an efficient view, and it has hotkeys and trying to stay "agile". You can drop to a terminal with a hotkey any time.

BrandoElFollito• 1 year ago

You will love dockge then.

I run it alongside portainer because exactly of the compose.yaml file I want to have control over

lambdadelirium• 1 year ago

Muh kube

terminalbraid• 1 year ago

I am going to continue to stan for dokku for hosting web apps, docker images included

https://dokku.com/

SJC_Hacker• 1 year ago

Is that really self hosting though ?

Self hosting to me is, at the very least having physical access to the machines.

rubslopes2• 1 year ago

I think GP miswrote; Dokku does not host, it manages containers and makes deployment easier. It's like a self-hosted Heroku.

boxed• 1 year ago

Yes, it's self hosting. You have access to the machine.

rubslopes2• 1 year ago

coolify.io is also a great open-source alternative if someone wants a web interface.

brulard6• 1 year ago

Anyone with experience to compare Coolify vs. Dokku? (and maybe something else?)

oulipo• 1 year ago

Dokploy is really nice

thebiglebrewski• 1 year ago

Aw yes Dokku is still great in 2025! Hear hear!

sujaldev• 1 year ago

There's caprover too: https://caprover.com/

nodesocket3• 1 year ago

I recently discovered Beszel (https://github.com/henrygd/beszel) for monitoring all my homelab servers. It's quick, easy, and has a very clean and intuitive interface. Works especially well running inside of containers on hosts. I also wrote a very quick guide on getting it running inside of Kubernetes at https://github.com/henrygd/beszel/discussions/431.

While it's not nearly as powerful as say DataDog, it provides the core essentials of CPU, memory, disk, network, temperature and even GPU monitoring (via agent only).

hankchinaski• 1 year ago

The only thing that holds me back for self hosting is Postgres. Has anyone managed to get a rock solid Postgres setup self managed? Backups + tuning?

nodesocket3• 1 year ago

I run a few PostgreSQL instances in containers (Kubernetes via Bitnami Helm chart). I know running stateful databases is generally not best practice but for development/homelab and tinkering works great.

Bitnami PostgreSQL Helm chart - https://github.com/bitnami/charts/tree/main/bitnami/postgres...

candiddevmike4• 1 year ago

What is your RTO/RPO?

orthoxerox• 1 year ago

1s/0s

nijave12• 1 year ago

RTO - best effort RPO - wait? You guys have backups and test then??

lytedev• 1 year ago

I self-host Postgres at home and am probably screwing it up! I do at least have daily backups, but tuning is something I have given very little thought to. At home, traffic doesn't cause much load.

I'm curious as to what issues you might be alluding to!

Nix (and I recently adopted deploy-rs to ensure I keep SSH access across upgrades for rolling back or other troubleshooting) makes experimenting really just a breeze! Rolling back to a working environment becomes trivial, which frees you up to just try stuff. Plus things are reproducible so you can try something with a different set of machines before going to "prod" if you want.

homebrewer• 1 year ago

Put it on a zfs dataset and back up data on the filesystem level (using sanoid/syncoid to manage snapshots, or any of their alternatives). It will be much more efficient compared to all other backup strategies with similar maintenance complexity.

candiddevmike4• 1 year ago

Filesystem backups may not be consistent and may lose transactions that haven't made it to the WAL. You should always try to use database backup tools like pgdump.

Aachen8• 1 year ago

Why would tuning be necessary for a regular setup, does it come with such bad defaults? Why not upstream those tunes so it can work out of the box?

I remember spending time on this as a teenager but I haven't touched my MariaDB config in a decade now probably. Ah no, one time a few years ago I turned off fsyncing temporarily to do a huge batch of insertions (helped a lot with qps, especially on the HDD I used at the time), but that's not something to leave permanently enabled so not really tuning it for production use

zrail• 1 year ago

PostgreSQL defaults (last I looked, it's been a few years) are/were set up for spinning storage and very little memory. They absolutely work for tiny things like what self-hosting usually implies, but for production workloads tuning the db parameters to match your hardware is essential.

mfashby2• 1 year ago

I've got an openbsd server, postgres installed from the package manager, and a couple of apps running with that as the database. My backup process just stops all the services, backs up the filesystem, then starts them again. Downtime is acceptable when you don't have many users!

swizzler• 1 year ago

I was using straight filesystem backups for a while, but I knew they could be inconsistent. Since then, I've setup https://github.com/prodrigestivill/docker-postgres-backup-lo..., which regularly dumps a snapshot to the filesystem, which regular filesystem backups can consume. The README has restore examples, too

I haven't needed to tune selfhosted databases. They do fine for low load on cheap hardware from 10 years ago.

nijave12• 1 year ago

Inconsistent how? Postgres can recover from a crash or loss of power which is more-or-less the same as a filesystem snapshot

nijave12• 1 year ago

https://pgtune.leopard.in.ua/ is a pretty good start. There's a couple other web apps I've seen that do something similar.

Not sure on "easy" backups besides just running pg_dump on a cron but it's not very space efficient (each backup is a full backup, there's no incremental)

bauerd• 1 year ago

Last thing I need is Kubernetes at home

nodesocket3• 1 year ago

I run Kubernetes on my homelab on 4x Raspberry Pi's then use Portainer to manage it. Works quite well, can use Helm charts when available, otherwise I use Portainer and deploy container apps manually. It's really not that bad.

dailykoder3• 1 year ago

I'm sure you find some joy in it or just like to explore what's possible. But just a reminder: Pieter Levels is running his million dollar businesses on a single VPS (if that's still correct). But yeah, if you like it, why not.

"Premature clustering is the source of all evil" - or something like that.

import• 1 year ago

Exactly. I am hosting 30+ services using docker compose and very happy. I don’t want to troubleshoot k8s in the early morning because home assistant is down and light dimmers are not working for some random k8s reason.

johnisgood2• 1 year ago

I am quite happy even without Docker, but I can see the appeal in some cases.

seba_dos13• 1 year ago

All my "smart home" stuff needs is mosquitto on a OpenWrt router and bunch of cgi-bin scripts that can run anywhere. I already went through a phase of setting up tons of services which ended up being turned off when something changed in my life (moving, replacing equipment etc.) never to be resurrected as I couldn't be bothered to redo it without the novelty effect, so I learned from that.

vbezhenar4• 1 year ago

Since I've migrated our company to Kubernetes, I almost stopped to worry about anything. It just works. Had much more troubles running it with spaghetti of docker containers and host-installed software on multiple servers, that setup definitely breaks like every week or every month. With Kubernetes I just press "update cluster" in some saturday evening once or twice a year and that's about it, pretty smooth sailing.

dailykoder3• 1 year ago

I guess it can be comfortable for some people.

But I just wanted to comment something similar. It's probably heavily dependend on how many services you self-host, but I have 6 services on my VPS and they are just simple podman containers that I just run. Some of them automatically, some of them manually. On top of that a very simple nginx configuration (mostly just subdomains with reverse proxy) and that's it. I don't need an extra container for my nginx, I think (or is there a very good security reason? I have "nothing to hide" and/or lose, but still). My lazy brain thinks as long as I keep nginx up to date with my package manager and my certbot running, ill be fine

mrweasel• 1 year ago

It is still my opinion that most businesses do not need Kubernetes, and neither should anyone self-hosting a service at home.

I can see running something in a Docker container, and while I'd advise against containers what ships with EVERYTHING, I'd also advise against using Docker-compose to spin up an ungodly amount of containers for every service.

You shouldn't be running multiple instances of Postgresql, or anything for that matter, at home. Find a service that can be installed using your operating systems package manager and set everything to auto-update.

Whatever you're self-hosting, be it for yourself, family or a few friends, there's absolutely nothing wrong with SQLite, files on disk or using the passwd file as your authentication backend.

If you are self hosting Kubernetes to learn Kubernetes, then by all means go ahead and do so. For actual use, stay away from anything more complex than a Unix around the year 2000.

dailykoder3• 1 year ago

I shared this sentiment. But since I just host some personal fun projects and I got really lazy when it comes to self-hosting, I found great pleasure in just creating the simplest possible docker containers. It just keeps the system super clean and easy to wipe and setup again. My databases are usually just mounted volumes which do reside on the host system

vbezhenar4• 1 year ago

I'd love to use Kubernetes for my self hosting. The only problem is it's too expensive.

ohgr2• 1 year ago

If it wasn't for Kubernetes we'd need 1/3rd of our operations team. We're keeping unemployment down!

ndsipa_pomu2• 1 year ago

You shouldn't be running multiple instances of Postgresql, or anything for that matter, at home.

It's not uncommon with self-hosting services using docker. It makes it easier to try out a new stack and you can mix and match versions of postgresql according to the needs of the software. It's also easier to remove if you decide you don't like the bit of software that you're trying out.

MortyWaves6• 1 year ago

There is a fairly well known/popular blogger who’s blog I was following because of their self hosting/homelab/nix adventures.

Then they decided to port everything to K8 because of overblown internet drama and I lost all interest. Total shame that a great resource for Nix became yet another K8 fest.

seba_dos13• 1 year ago

"apt-get install" tends to be enough once you stop chasing latest-and-greatest and start to appreciate things just running with low maintenance more.

skydhash3• 1 year ago

I totally agree! Containers are nice when your installation is ephemeral, deploying and updating several time in a short period. But using the package manager is as easy as you get.

alabastervlog• 1 year ago

I only host 3rd party daemons (nothing custom) and only on my local network (plus Tailscale) so Docker’s great for handling package management and init, since I get up-to-date versions of a far broader set of services than Debian or ubuntu’s repos, clean isolation for easy management, and init/restarts are even all free. Plus it naturally documents what I need to back up (any “mounted” directories)

Docker lets my OS be be boring (and lets me basically never touch it) while having up to date user-facing software. No “well, this new version fixes a bug that’s annoying me, but it’s not in Debian stable… do I risk a 3rd party back port repo screwing up my system or other services, or upgrade the whole OS just to get one newer package, which comes with similar risks?”

I just use shell scripts to launch the services, one script per service. Run the script once, forget about it until I want to upgrade it. Modify the version in the script, take the container down and destroy it (easily automated as part of the scripts, but I haven’t bothered), run the script. Done, forget about it again until next time.

Almost all the commands I run on my server are basic file management, docker stuff, or zfs commands. I could switch distros entirely and hardly even notice. Truly a boring OS.

ryandrake• 1 year ago

Same here. I've had the same setup for decades: A "homelab" server on my LAN for internal hobby projects and a $5 VPS for anything that requires public access. On either of these, I just install the software I need through the OS's package manager. If I need a web server, I install it. If I need ssh, I install it. If I need nfs, I install it. I've never seen any reason to jump into containers or orchestration or any of that complex infrastructure. I know there are a lot of people very excited about adding all of that stuff into the mix, but I've never had a use case that prompted me to even consider it!

raphinou3• 1 year ago

Exactly, my first reaction was "I should write a blog post about why I still use Docker Swarm". I deploy to single node swarms, and it's a zero boiler plate solution. I had to migrate services to another server recently, and it was really painless. Why oh why doesn't Docker Swarm get more love (from its owners/maintainers and users)?....

Edit: anyone actually interested in such a post?

mfashby2• 1 year ago

I moved us off docker swarm to GKE some years back. The multi node swarm was quite unstable, and none of the big cloud providers offered managed swarm in the same way they offer managed k8s.

It's a shame I agree because it was nicely integrated with dockers own tooling. Plus I wouldn't have had to learn about k8s :)

galbar• 1 year ago

I just want to add that I also have a Docker Swarm running, with four small nodes for my personal stuff plus a couple of friends' companies.

No issues whatsoever and it is so easy to manage. It just works!

gmm1990• 1 year ago

I'd be interested. Might be a strange question but I'll throw it out there, I seem to have a hard time finding a good way to define my self hosted infrastructure nodes and which containers can run on them, have you run into/have a solution for this? Like I want my database to run on my two beefier machines but some of the other services could run on the mini pcs.

resiros• 1 year ago

yes, please.

quectophoton• 1 year ago

I deploy to single node swarms, and it's a zero boiler plate solution.

Yup, it's basically like a "Docker Compose Manager" that lets you group containers more easily, since the manifest file format is basically Docker Compose's with just 1-2 tiny differences.

If there's one thing I would like Docker Swarm to have, is to not have to worry about which node creates a volume, I just want the service to always be deployed with the same volume without having to think about it.

That's the one weakness I see for multi-node stacks, the thing that prevents it from being "Docker Compose but distributed". So that's probably the point where I'd recommend maybe taking a look at Kubernetes.

StrLght• 1 year ago

I am very interested. I tried to migrate to Swarm, got annoyed at incompatibility with tons of small Docker Compose things, and decided against that. I'd love to read about your setup.

opsdisk• 1 year ago

Would love a blog post on how you're using Docker Swarm.

kiney• 1 year ago

bugs in it's infancy is what killed swarm for users.

ndsipa_pomu2• 1 year ago

Yep. I run a small swarm at work and have a 5-node RPi-4 swarm at home. Interested in why you'd run a single-node swarm instead of stand-alone docker.

jauntywundrkind• 1 year ago

K3s installs super fast.

Writing your first yaml or two is scary & seems intimidating at first .

But after that, everything is cut from the same cloth. Its an escape from the long dark age of every sysadmin forever cooking up whatever whimsy sort of served them at the time, escape from each service having very different management practices around it.

And there's no other community anywhere like Kubernetes. Unbelievably many very good quality very smart helm charts out there, such as https://github.com/bitnami/charts/tree/main/bitnami just ready to go. Really sweet home-ops setups like https://github.com/onedr0p/home-ops that show that once you have a platform under foot, adding more services is really easy, showing an amazing range of home-ops things you might be interested in.

Last thing I need is Kubernetes at home

Last thing we need is incredibly shitty attitude. Fuck around and find out is the hacker spirit. Its actually not hard if you try, and actually having a base platform where things follow common patterns & practices & you can reuse existing skills & services is kind of great. Everything is amazing but the snivelling shitty whining without even making the tiniest little case for your unkind low-effort hating will surely continue. Low signal people will remain low signal, best avoid.

bitsandboots2• 1 year ago

I clicked expecting a list of cool things to self host. Instead I got a list of ways I would never want to host. Mankind invented BSD jails so that I do not have to tie myself in a knot of container tooling and abstraction.

Gud2• 1 year ago

Indeed. I run a setup as you mentioned, with the various daemons in their own jail. Super simple set up, easy to maintain.

Lord knows why people overcomplicate things with docker/kubernetes/etc.

shepherdjerred• 1 year ago

I'm very happy with Kubernetes at home. Everything just works at this point, though it did take a fair bit of fiddling at first.

I think it's a great way to learn Kubernetes if you're interested in that.

megous4• 1 year ago

My peace of mind comes from my self hosting in 2025 looking the same as my self-hosting in 2005 (except a move to systemd). I haven't even re-installed my workstation OS since 2006 or so.

johnisgood2• 1 year ago

I see a lot of people mention some technology under this submission that you do not even have to look at when you are self-hosting. It all depends what you want to self-host, from nginx, fcgiwrap (with certbot), to an e-mail server, or a Matrix instance, or Zulip, or what have you these days. I maintain quite many servers and I do not use these new and fancy technologies.

I'm just a boomer (technically a millennial) who sticks to Arch Linux even when it comes to servers, I have zero friction, really. I have no issues self-hosting whatever me or a client requires, keeping it minimal and functional.

I self-host like it is 2000 (apart from a couple of some more modern stuff, if you could consider systemd and certbot, etc. modern). :D

MortyWaves6• 1 year ago

2006 is impressive. I can’t even imagine that. I reinstall Windows every 18 months or so.

Aachen8• 1 year ago

I don't think I've reinstalled since around 2014, when I switched to a different Linux distribution. It's just a pain and while it cleans up some unused packages, what's the point really? Why do you reinstall Windows every 18 months?

One change I made that may help with this, is to not install crap on the host that I don't plan to use for a long time. Trying out a new database server or want to set up an Android IDE for a temporary project? Use a VM, don't clutter up random files all over the host. Is this what is happening on your Windows perhaps?

megous4• 1 year ago

Yeah, it's basically an Arch Linux install. I just rsync it to a new workstation every 5-7 years (or move the disk) and go on. :)

nijave12• 1 year ago

I'm glad I'm not configuring php-fpm and compiling PHP add-ons from source. Someone else can shove that in a tarball (Docker image) for me

megous4• 1 year ago

I'm glad I don't have to deal with docker's bloat and networking to avoid writing a 8 line php-fpm config file. :)

vbezhenar4• 1 year ago

I'm slowly configuring my new VPS. Here's approach I'm taking:

1. RHEL 9 with Developer Subscription. Installed dnf-automatic, set `reboot = when-changed`, so it's zero effort to reliably apply all updates with daily reboots. One or two minutes of downtime, not a big deal.

2. For services: podman with quadlets. It's RH-flavoured replacement for docker-compose. Not sure, if I like it, but I guess that's the "future", so I'm embracing it. Every service is a custom-built image with common parent to reduce space waste (by reusing base OS layer).

So far I want to run static http (nginx), vaultwarden, postfix and some webmail. May be more in the future.

This setup wastes a lot of disk space for image data, so expect to order few more gigabytes of disk to pay for modern tech.

rullopat2• 1 year ago

What about Kamal? https://kamal-deploy.org/ Did anybody here use it for anything that is not a Ruby on Rails app?

MortyWaves6• 1 year ago

The thing that puts me off is its seemingly heavy focus on “web apps”. I have a bunch of services I either use or wrote myself and only a handful have anything to do with the web.

echoperkins2• 1 year ago

Yes, I have been using it and really enjoying it for deploying web apps. So far I have deployed web apps using: * fastapi (python) * Django ninja (python) * ghost cms (node)

I have been writing up my thoughts (and an example): https://andrewperkins.com.au/kamal/

The ability to deploy to both cloud servers and on-premises is a big win as I often work on projects that have a mix of both.

As the sibling comment says, it’s focussed on web servers. In my use case that is fine!

rullopat2• 1 year ago

Great! Are you also deploying DB servers or any other kind of additional servers that are dependencies of those webapps?

jagermo2• 1 year ago

i really like this software-centric approach, but I am a bit stuck when it comes to the hardware. Are there some sources around servers that don't suck up too much energy and are fairly quiet? What CPU is a good all-round solution?

brulard6• 1 year ago

Depends on your needs. For some Raspberry Pi (ideally with 8-16GB RAM) + SSD can be enough if you are after low power consumption.

If you need more power: I had success with HP ProDesk Mini (or any other one-litre PC), you can get these second hand from like $150 and extend RAM and SSDs however you like. You can even pick processor / generation to fit your needs best. These can have consumption from like 30W if I'm not mistaken.

I have no experience with real and expensive server hardware, but most people don't need that for a homelab.

Aachen8• 1 year ago

For some Raspberry Pi (ideally with 8-16GB RAM) + SSD can be enough

Wut? For many, a Raspberry Pi with 1 GB RAM and the regular sdcard can be enough, you really don't need to go fancy if you don't want to run anything particularly heavy. Or if it's cpu-intensive then you might need the newest Pi or something even beefier but still only the lowest RAM and smallest/slowest storage options (like for WordPress). As you say, it depends on needs

I always recommend using an old laptop to start out with because you've already got it anyway and it's already low power yet very powerful: if it can run graphical software from 2020 then it'll be fine as server until 2030 for anything standard like a web server (with half a dozen websites and databases, such as a link shortener, some data explorers, and my personal site), torrent box, VPN server, mail server, git server, IRC bouncer, Windows VM for some special software, chat bot, etc. all at once. At least, that's what I currently run on my 2012 laptop and the thing is idle nearly the whole time. Other advantages of a laptop include a built-in KVM console and UPS, at least while you still trust the old battery (one should detach and recycle that component after some years)

Gracana• 1 year ago

You can get Mini-ITX server motherboards with IPMI and ECC memory if you want something robust and remotely-manageable while staying small and low power. I have a SuperMicro A2SDi-4C-HLN4F, which has a 16W intel atom C3558 and is quite old at this point, but it's fine for my little home network tasks.

jagermo2• 1 year ago

that sounds doable. I have a raspberry pi with an SSD for my pihole (bit of overkill, but i had stuff lying around) but for things like Immich it seems to be not beefy enough.

skydhash3• 1 year ago

I use an old mac mini. The two times the fan has come up was with me building ffmpeg and transcoding my music library. I us it as a file server, music server, amd jellyfin. And trying stuff.

TrayKnots• 1 year ago

I am actually worried about the self-hosting pandemic. We self-hosters will stop flying under the radar. Wonder how long it will take until our matrix instances require to be backdoored, our immich are scanning our pictures with AI.

On an unrelated note, an article of how to rent a VPS in China would be interesting :)

pjc502• 1 year ago

an article of how to rent a VPS in China would be interesting

Given that apparently it's quite difficult to even get a WeChat account without a national ID, I suspect that step 1 is "learn mandarin" and step 2 is "get a Chinese national ID".

thenthenthen• 1 year ago

Also your home modem/router is often tied to your ID and then there is ofc the firewall. IIRC You can get vos hosting and ICP code through Ali Cloud somewhat automagically. Agree it would be nice to give it a try some time.

vbezhenar4• 1 year ago

I didn't have any problems creating wechat account. May be I was lucky, I don't know, I just typed my phone number and it went pretty smooth, like whatsapp. Also was able to connect my visa card. I did it in the Kazakhstan and then was able to pay in China, no problems. May be they got exception for Kazakhstan specifically, we recently got visa-free travels there.

TobTobXX2• 1 year ago

Did you try? It's a few years ago when I had to create one, but it was just as simple as WhatsApp (just a few more CAPTCHAs). And no VPNs or whatever, straight from a Swiss IP.

ciupicri• 1 year ago

Why would you rent a VPS in China?

throwaway48476• 1 year ago

Jurisdictional arbitrage.

anticrymactic• 1 year ago

Isn't that the beauty of self hosting? How could anything be enforced on user-controlled servers? Practically everything self-hosted is open source and how would enforcing anything would even work?

madeofpalk• 1 year ago

The problem lies with people who are technical enough to self-host, but might not be confident enough to fork/make changes. Maybe you could switch services, but there's still just enough friction/soft-lock in to actually migrate.

You are right though, it gives significantly more control to users. It's just realising 100% of the benefits that might be trickier.

diggan4• 1 year ago

How could anything be enforced on user-controlled servers?

New laws comes to mind. If a government decides to try to outlaw encryption again, cloud/hosting companies located there wouldn't have a choice but to comply, or give up on the business. The laws could also be made in such way that individuals are responsible for avoiding it, even self-hosters, and if people are using it anyways, be legally held responsible for the potential harms of it.

Aachen8• 1 year ago

Matrix server backdoors aren't an issue though? It's about the client where decryption happens. If those aren't required to upload decrypted contents, you can always overlay some encryption protocol like OTR over any chat mechanism. I remember using it on MSN via Pidgin

Don't worry about the servers. Worry about mandated software on the client

infecto• 1 year ago

I suspect you would have trouble hosting long term in China. I don’t recall the specifics now but IIRC every website hosted in China needs a special government ID which requires getting approval. My memory is hazy but it does feel like one of the poorer choices to host unless you live in mainland. There are many better options in the world that both do not restrict information as well as not requiring paperwork.

candiddevmike4• 1 year ago

If any self hosters are burnt out by the state of config management tools and YAML, consider giving Etcha a shot (https://etcha.dev).

It's stateful (cleans up things when they're no longer in your config), procedural (you control the flow and can trigger things as needed), and supports flexible deployment models (push or pull). Full disclosure, I created it and use it across my business and personal devices.

simoncion2• 1 year ago

It's started (cleans up things when they're no longer in your config)...

Would you please call this something else?

"It automatically reconciles", perhaps? I know that a multi-word phrase isn't nearly as snappy, but not only are "it's started" and "started" overloaded with a bunch of meanings, approximately zero of them mean what you want them to mean in this new context.

candiddevmike4• 1 year ago

Sorry, autocorrect changed stateful to started.

qudat• 1 year ago

I’ve been self hosting small web apps using an SSH service https://tuns.sh and it helped me replace my DO droplet pretty successfully. What’s nice is it also has built-in usage analytics, alert notifications when a tunnel goes down, and fully manageable with a remote TUI which means I don’t have to install anything to use it.

oliwary• 1 year ago

Does anyone have any experience with coolify? https://coolify.io/ I am considering switching the hosting of my online games to it.

James_K• 1 year ago

I tell you the real problem with self hosting: people using monospace fonts for body text.

MortyWaves6• 1 year ago

But mono fonts let the reader know they are reading Serious Technical Content ™

sceptic1233• 1 year ago

Why is the snark here downvoted, but not the original message?

Youden2• 1 year ago

I've been through just about everything to get where I am and I've ended up with Hashicorp Nomad and Consul with Traefik, managed by OpenTofu (open-source Terraform).

Things that haven't worked for me:

- Standalone Docker: Doesn't work great on its own. Containers often need to be recreated to modify immutable properties, like the specific image the container is running. To recreate the container, you need to store some state about how it _should_ work elsewhere.

- Quadlet: Too hard to manage clusters of services. Podman has subtle differences to Docker that occasionally cause problems and really tempting features (e.g. rootless) that cause more problems if you try to use them.

- Kubernetes: Waaaay too heavy. Even the "lightweight" distributions like k3s, k0s etc. embed large components of the official distribution, which are still heavy. Part of the embedded metric server for example periodically enumerates every single open file handle in every container. This leads to huge CPU spikes for a feature I don't care about.

With my setup now, I can more or less copy-paste a template into a new file, tweak some strings and have a HTTPS-enabled service available at https://thing.mydomain.mine. This works pretty painlessly even for services that need several volumes to maintain state or need several containers that work together.

JojoFatsani• 1 year ago

Docker Compose is very suitable for the homelab scenario. I use it on my pi.

quickslowdown• 1 year ago

Do you run a Nomad cluster? Or just on a single host? This is my desired state, I've set up Nomad a number of times but always get stuck in one place or another. I've gotten much further with Nomad than Kubernetes, but I've kind of always gone back to ol' faithful, writing a docker compose file and running everything that way.

Youden2• 1 year ago

Just a single host. The main thing that I couldn't figure out is how to turn off "bootstrap" mode, so I've just left it on.

0xEF3• 1 year ago

I love the idea of self-hosting, especially since I keep a number of very tiny websites/projects going at any given time, so resources would not really be too much of an issue for me.

What stops me is security. I simply do not know enough about securing a self-hosted site on real hardware in my home and despite actively continuing to learn, it seems like the more I learn about it, the more questions I have. My identity is fairly public at this point, so if I say the wrong thing to the wrong person on HN or whatever, do I need to worry about someone much smarter than me setting up camp on my home network and ruining my life? That may sound really stupid to many of you, but this is the type of anxiety that stops the under-informed from trying stuff like this and turning to services like Akamai/Linode or DO that make things fairly painless in terms of setup, monitoring and protection.

That said, I'm 110% open to reading/watching any resources people have that help teach newbies how to protect their assets when self-hosting.

doublerabbit3• 1 year ago

A VPS with a software firewall is more than enough.

Block port 22, secure SSH with certificates only. Allow port 443 and configure your web server as a reverse proxy with a private backend.

You don't need an IDS, you don't need a WAF and you don't need Cloudflare.

Unless you become the next Facebook that's when you start to become concerned about security.

XorNot• 1 year ago

I'm less worried about SSH access then I am abotya vulnerability in some front-end web service though.

I've contented myself using TLS client certs on my family's Android phones (which do not work at all on iOS for something like Home Assistant).

palata4• 1 year ago

A VPS with a software firewall is more than enough.

So you don't self-host at home, right?

I have been considering setting up a physical DMZ at home, with two routers (each with its own firewall), such that my LAN stays unmodified and my server can run between both routers. Then it feels like it would be similar to having a VPS in terms of security, maybe?

mhitza• 1 year ago

A VPS with a software firewall is more than enough.

You want VPS-provider firewall. Docker's going to punch holes through your software firewall.

palata4• 1 year ago

I agree with this: I personally don't need tutorials for hosting stuff, rather tutorials about securing it properly.

Aachen8• 1 year ago

Could you give an example of a guide that helped you self host a system or service by telling you how to do the security? One that shows what information would be missing from a regular setup tutorial?

I'm a security consultant so this is not a problem I have. To me it seems very straightforward and like most things are secure by default (with the exceptions being notorious enough that I'd know of it), so I'm interested in the other perspective

segu• 1 year ago

You should encrypt and backup your assets regularly. We recently published a tutorial on how to to do so using B2 and Infisical so that your private key doesn't live on the server: https://infisical.com/blog/self-hosting-infisical-homelab

fm26063• 1 year ago

I'm right there with you, except at times I have thrown caution to the wind and made my sites available.

My current setup is to rent a cheap $5/month VPS running nginx. I then reverse ssh from my home to the vps, with each app on a different port. It works great until my electric goes out and comes back on the apps become unavailable. I haven't gotten the restart script to work 100% of the time.

But, I'd love to hear thoughts on security of reverse SSH from those that know.

_mitterpach• 1 year ago

Maybe try running your services in docker, I don't know how difficult that would be to implement for you, but if you run it in containers you can get it to start up after an outage pretty reliably.

the_snooze• 1 year ago

I do something similar with my home server, but with a WireGuard split tunnel. Much easier to set up and keep active all the time (i.e., on my phone).

Nginx handles proxying and TLSing all HTTP traffic. It also enforces access rules: my services can only be reached from my home subnet or VPN subnet. Everywhere else gets a 403.

cenamus2• 1 year ago

I suppose also no public IP on your home connection?

Because since my new provider only provides cg-nat, I've been using a cheap server, but actually having the server at home would be nice.

nijave12• 1 year ago

Don't expose anything to the Internet. Use a tunneling tool (Tailscale et al) or VPN

crtasm• 1 year ago

I think they want to host public websites.

diggan4• 1 year ago

You'll have a hard time hosting websites/projects meant for the public to view, if you don't allow public internet traffic :)

Brian_K_White2• 1 year ago

A few days after a remark on hn, while the thread was still active, I received a mysterious package I didn't order from a weird drop shipping service where the original sender is unknown and undiscoverable to you the recipient. It didn't contain anything bad just a single surgical mask (during covid, common valueless item basically). The message was just that they could find my home address. It was a stupid message since I obviously do not hide my identity on hn. But it means you're not wrong to be careful, both in general, and on hn in particular.

raphman• 1 year ago

Hmm, my first guess would have been that you have been a target of "brushing" [1]. In a Reddit thread from 2020 [2], multiple people mention that they received surgical masks they did not order.

[1] https://www.bbb.org/article/news-releases/20509-amazon-brush... [2] https://www.reddit.com/r/tulsa/comments/hpe8s1/just_got_a_su...

0xEF3• 1 year ago

It's always scary, no matter how innocuous. I'm glad it did not escalate into something else for you!

Without getting too deep into it, there are some things I know how to do with computers that I probably shouldn't, so my thought is this; if I, a random idiot who just happened to learn a few things, can do X, then someone smarter than me who learned how to attack a target in an organized way probably has methods that I cannot even conceive of, can do it easier, and possibly without me even knowing. It's this weird vacillation between paranoia and prudence.

For me, it's really about acknowledging what I know I don't know. I do some free courses, muck about with security puzzles, etc, even try my own experiments on my own machines, but the more I learn, the more I realize I don't know. I suppose that's the draw! The problem is when you learn these things in an unstructured way, it's hard to piece it all together and feel certain that you have covered all your vulnerable spots.

spencerflem3• 1 year ago

Take a look at sandstorm.org - its set of apps is fairly limited compared to the docker based options but it goes incredibly far wrt security. It was designed by the now head of Cloudflare Workers and pitched as a selfhosting platform for medical and other highly regulated industries. There's still nothing else quite like it

diggan4• 1 year ago

pitched as a selfhosting platform for medical and other highly regulated industries

From first hearing about Sandstorm since the first open beta 10 years ago (https://news.ycombinator.com/item?id=10147774) and reading about it on/off since then, this is first time I hear anyone pitching it for "medical and other highly regulated industries". Where exactly does this come from?

There's still nothing else quite like it

Plenty of other similar self-hosted platforms, YunoHost is probably the closest, most mature and most feature-packed alternative to Sandstorm, at least as far as I know,.

UK-Al05• 1 year ago

Isn't 95% of it just blocking every port except the service you want to expose, and then making sure everything is up to date and the service is built in a secure way.

WAF's etc just hide the fact the code in your service is full of holes.

sceptic1233• 1 year ago

What's the 5% that's not blocking ports for services you want to expose?

Ensuring your infra is built in a secure way is as important as ensuring your service is built in a secure way.

nosebear• 1 year ago

I agree - I always wonder should I go overkill and put everything in its own VM for separation? Is it ok to just use containers?

If using Podman, should I use rootless containers (which IMO suck because you can't do macvlan so the container won't easily get its own IP on my home network)? Is it ok to just use rootful Podman with an idmapped user running without root privileges inside the container and drop all unneccessary capabilities? Should I set up another POSIX user before, such that breaking out of the container would in the end just yield access to an otherwise unused UID on the host?

If using systemd-nspawn, do all the above concerns about rootful / rootless hold? Is it a problem that one needs to run systemd-nspawn itself with root? The manpage itself mentions "Like all other systemd-nspawn features, this is not a security feature and provides protection against accidental destructive operations only.", so should I trust nspawn in general?

Or am I just being paranoid and everything should just be running YOLO-style with UID 1000 without any separation?

All of this makes me quite wary about running my paperless-ngx instance with all my important data next to my Vaultwarden with all of my passwords next to any Torrent clients or anything else with unencrypted open ports on the internet. Also keeping everything updated seems to be a full time job by itself.

Karrot_Kream2• 1 year ago

This is a good concern to have. I feel like the emotional currency around self-hosting on tech forums makes too many people excited to talk about self-hosting and forget about practical things like security. Remember: defense in layers.

Things I do:

* Make sure domain WHOIS does not point to me in any way, even if that means using some silly product like "WHOIS GUARD"

* Lock down any and all SSH access. Preferably only allow key-based authentication.

* Secure the communication substrate. For me this means running a Zerotier network which all dependent services listen on. I also try to use Unix sockets for any services colocated on the same operating system and restrict the service to only listen on sockets in a directory specifically accessible by the service.

* Try to control the permission surface of any service as much as possible. Containers can be a bit heavyweight for self-hosting but make this easy. There's alternatively like bubblewrap and firejail as well.

* Make use of services like fail2ban which can automate some of the hunting of bad actors for you.

* Consider hosting a listener for external traffic outside of your infra. For redundancy, load-shedding, and for security I have an external VPS that runs haproxy before routing over Zerotier to my home infrastructure. I enforce rate limits and fail2ban at the VPS so that bad actors get stopped upstream and use none of my home compute or bandwidth. (I also am setting up some redundant caches that live on the VPS so if my home network is down, one of my services can failover.)

* Segregate data into separate databases and make sure services only have access to databases that they need. With Postgres this is really simple with virtual databases being tied to different logins. I have some services that prune databases that run in a cron-like way (but using snooze instead) and they have no outbound net access.

If your network layer is secure and your services follow least-privilege, then you should be fairly in the clear.

3abiton• 1 year ago

Beside fail2ban, I also recommend endlessh. Simple yet beautiful piece of software.

raxxorraxor2• 1 year ago

I think a normal patched Debian/Ubuntu with ufw rule for port 80/443 and 22, ssh certificate auth only and a simple nginx configuration is still very safe.

Of course there can be security issue on your webserver as well, but for a simple site this setup is learnable in an hour or two and you are ready to go.

You can hook that up on a pie attached to your router or pay a bit to have it hosted somewhere. Domain is perhaps 2-5$ and an TLS cert you can get from Let's Encrypt.

No idea how to put everything into a container that it makes sense. I just run this quite often on small hosted machines elsewhere. I just install everything manually because it takes 5 minutes if you have done it before.

loughnane• 1 year ago

Since my setup is for personal use I just use a VPN. My home router is running OPNsense and this setup wasn't too bad. I also pay my ISP for a static IP address.

https://docs.opnsense.org/manual/how-tos/wireguard-client.ht...

Then on my phone I just flick on the switch and can access all my home services. It's a smidge less convenient, but feels nice and secure.

kuon2• 1 year ago

If you self host, do not use containers and all those things.

Just use a static site generator like zola or hugo and rsync to a small VPS running caddy or nginx. If you need dynamic thing, there are many frameworks you can just rsync too with little dependencies. Or use PHP, it's not that bad. Just restrict all locations except public ones to your ip in nginx config if you use something like wordpress and you should be fine.

If you have any critical stuff, create a zfs dataset and use that to backup to another VPS using zfs send, there are tools to make it easy, much easier than DB replication.

Aachen8• 1 year ago

What I'm reading is not to use containers for a web server, which makes sense because web servers have had vhosts since forever and you can host any number of sites on there independently already

But what about other services, like if you want a database server as well, a mail server, etc.?

I started using containers when I last upgraded hardware and while it's not as beneficial as I had hoped, it's still an improvement to be able to clone one, do a test upgrade, and only then upgrade the original one, as well as being able to upgrade services one by one rather than committing to a huge project where you upgrade the host OS and everything has to come with to the new major version

skydhash3• 1 year ago

That’s when you favor stability and use an LTS OS. You can also isolate workload by using VMs. Containers is nice for the installation part, but the immutability can be a pain.

kuon2• 1 year ago

I manage about 500 servers. Critical services like DNS, mail, tftp, monitoring, routing, firewall... are all running openbsd in N+1 configuration, and in 15 years we had zero issue with that.

Now most servers are app servers, and they all run archlinux. We prepare images and we run them with PXE.

Both those are out of scope for self host.

But, we also have about a dozen of staging, dev, playground servers. And those are just regular installs of arch. We run postgres, redis, apps in many languages... For all that we use systems packages and AUR. DB upgrade? Zfs snapshot, and I follow arch wiki postgres upgrade, takes a few minutes, there is downtime, but it is fine. You mess anything? Zfs rollback. You miss a single file? cd .zfs/snapshots and grab it. I get about 30minutes of cumulated downtime per year on those machines. That's way enough for any self host.

We use arch because we try the latest "toys" on those. If you self host take an LTS distribution and you'll be fine.

nijave12• 1 year ago

Containers are fine. Run them on a Linux host to save yourself some headaches

auxym2• 1 year ago

It seems you're talking about about self-hosting a website or web-app that you are developing for the public to use.

My vision of self-hosting is basically the opposite. I only self-host existing apps and services for my and my family's use. I have a TrueNAS box with a few disks, run Jellyfin for music and shows, run a Nextcloud instance, a restic REST server for backing up our devices, etc. I feel like the OP is more targeted this type of "self hosting".

aborsy2• 1 year ago

I can self host many applications, but their security must be outsourced to a company. I don’t have time to keep on top of vulnerabilities.

Cloudflare Tunnels is a step in the right direction, but it’s not end to end encrypted.

The question is then, how to secure self hosted apps with minimal configuration, in a way that is almost bulletproof?

Aachen8• 1 year ago

security must be outsourced to a company. I don’t have time to keep on top of vulnerabilities.

If the software you host constantly has vulnerabilities and something like apt install unattended-upgrades doesn't resolve them, maybe the software simply isn't fit for hosting no matter what team you put on it. That hired team might as well just spend some time making it secure rather than "keeping on top of vulnerabilities"

aborsy2• 1 year ago

The concern is zero days. There are probably lots of easy zero days, patched across a host of software, once discovered in one.

The solution is a secure software in front. It could be Wireguard, but sometimes you don’t know your users or they don’t want to install anything.

nijave12• 1 year ago

There's only a handful of web apps packaged in the OS repo. Even wildly popular software like WordPress and Drupal you need to use their built in facilities or manually apply outside the OS update manager

interloxia• 1 year ago

I don't need public access to my stuff so my strategy is to use zerotier taking care that services are only able to use the virtual network.

It's easy to manage and reason about.

FloatArtifact3• 1 year ago

Self-Hosting like it's 2025...uhhgg...

Don't get me wrong I love some of the software suggested. However yet a another post that does not take backups as seriously as the rest of the self-hosting stack.

Backups are stuck in 2013. We need plug and play backups for containers! No more roll your own with zfs datasets, back up data on the filesystem level (using sanoid/syncoid to manage snapshots or any other alternatives.

marceldegraaf• 1 year ago

Best decision of last year for my homelab: run everything in Proxmox VMs/containers and back up to a separate Proxmox Backup Server instance.

Fully automated, incremental, verified backups, and restoring is one click of a button.

FloatArtifact3• 1 year ago

Yes, I'm considering that if I can't find a solution that is plug-and-play for containers Independent of the OS and file system. Although I don't mind something abstracting on top of ZFS. ZFS Mental overhead through the snapshot paradigm can lead to its own complexities. A traditional backup and restorer front end would be great.

I find it strange that, especially with a docker which already knows your volumes, app data, and config, can't automatically backup and restore databases, and configs. Jeez, they could have built it right into docker.

nunez• 1 year ago

rclone is great for this.

One could set up a Docker Compose service that uses rclone to gzip and back up your docker volumes to something durable to get this done. An even more advanced version of this would automate testing the backups by restoring them into a clean environment and running some tests with BATS or whatever testing framework you want.

nijave12• 1 year ago

Rclone won't take a consistent snapshot so you either need to shutdown the thing or use some other tool to export the data first

nijave12• 1 year ago

Why not zfs snapshots? Besides using Hyper-V machine snapshots, that's been the easiest way, by far, for me. No need to worry about the 20 different proprietary tools that go with each piece of software.

Each VM or container gets a data mount on a zvol. Containers go to OS mount and each OS has its own volume (so most VMs end up with 2 volumes attached)

FloatArtifact3• 1 year ago

Well, one argument not to use ZFS is simply the resources it takes. It eats up a lot of ram. Also I'm under the impression that one should never live-snapshot a database without risk of corruption.

zephyreon• 1 year ago

I host tons of web-facing apps behind a reverse proxy. I used to have it all running in a swarm cluster with several underlying vms but decided to move everything to Unraid a while back for simplicity.

Would highly recommend.

https://unraid.net

raphinou3• 1 year ago

As mentioned in another comment, I'm currently still happy with (single node) Docker Swarms (with the reverse proxy as described on https://dockerswarm.rocks/ ). I like that I can basically use the docker compose files published by a lot of project to deploy. How does Unraid compare in your experience?

And I like that I can deploy images which basically don't have any requirement to be deployable to Docker Swarm. Is that also the case with Unraid?

martin_a2• 1 year ago

Still "rsync"ing the result of "hugo build" to a subfolder on a shared webhost. Works like a charm, hope it will do so forever. :-D

finnlab4• 1 year ago

I'll eventually set this up to automatically deploy from git, don't worry haha

martin_a2• 1 year ago

I wrote a deploy.sh to help me with the parameters, almost feels like automatic deployment... ;-)

notpushkin2• 1 year ago

I feel like I’ve been plugging it way too many times... but if you’re looking for a more humane alternative to Portainer, check out my project, Lunni: https://lunni.dev/

(Docker Swarm only for now, though I’m thinking about adding k8s later this year)

finnlab4• 1 year ago

this looks really cool, I love to see some competition in this space

notpushkin2• 1 year ago

Thank you so much!

cullumsmith• 1 year ago

Still running everything from my basement using FreeBSD jails and shell scripts.

Sacrificing some convenience? Probably. But POSIX shell and coreutils is the last truly stable interface. After ~12 years of doing this I got sick of tool churn.

bitsandboots2• 1 year ago

Not just stable - also easy to understand when, if ever, something goes wrong. There's very little magic, very little layers of complexity.

Gud2• 1 year ago

Same. Why add the complexity of docker/kubernetes/?

FreeBSD and jails is so easy to maintain its unbelievable.

ltr_• 1 year ago

just want to say that, to self host feels like the 2000's, and that's a refreshing good thing, you feel in control, away for all the enshittification we are experiencing right know. I'm having a blast with a group of friends with netbird/tailscale, creating little projects in our forgejo instance with full CI/CD for the infra, and day by day we are adding more and more stuff, our own little internet. we learn things and talk about technical stuff while setting up and implementing them, its my favorite social network now. also f big tech.

q2dg• 1 year ago

Cockpit-podman can be an interesting Podman-centered alternative to Portainer et al.

TimPC• 1 year ago

I think the reasons not to self-host are the difficulty of implementing any type of dynamic scaling. For instance when clicking on this article I get a result that their site is down. Instead of benefiting from the traffic their engagement got them, they are crashing.

mr_mitm• 1 year ago

This site redirects to localhost:1313. Is this some sort of April fool's joke that I'm not getting?

    $ curl https://kiranet.org/self-hosting-like-its-2025/
    <!DOCTYPE html>
    <html lang="en">
      <head>
        <title>//localhost:1313/posts/self-hosting-like-its-2025/</title>
        <link rel="canonical" href="//localhost:1313/posts/self-hosting-like-its-2025/">
        <meta name="robots" content="noindex">
        <meta charset="utf-8">
        <meta http-equiv="refresh" content="0; url=//localhost:1313/posts/self-hosting-like-its-2025/">
      </head>
    </html>

k8sToGo2• 1 year ago

Now it's suddenly returning 404

finnlab4• 1 year ago

my bad, works now. Don't test in production...

montroser• 1 year ago

Yeah... Is this performance art? Intentional or otherwise? It's a jungle out there on the Internet -- we should take self-hosting as an opportunity to _simplify_. It doesn't probably need to scale way up, and doesn't need to scale across many teams of people, so it's a good time to shed a few of those layers of abstraction and get back to basics.

drKarl2• 1 year ago

Lol that's hilarious, the url resolves to https://localhost:1313/posts/self-hosting-like-its-2025/, how ironic!!

finnlab4• 1 year ago

tried to push an update in production like a true self-hoster...works now

captaincrunch2• 1 year ago

It sure is self hosted! https://localhost:1313/posts/self-hosting-like-its-2025/

captaincrunch2• 1 year ago

April fools I guess!!

spencerflem3• 1 year ago

Sandstorm.org has picked back up the pace of development recently, and is an excellent platform wrt sharing securely between multiple users

SuperSandro2000• 1 year ago

some notes: - uptime kuma scales very bad, even with just 20 entries - Docker/Kubernetes is a trap, use something more suitable for a home lab like NixOS

drKarl2• 1 year ago

I found this which is kind of hosted self-hosting: https://www.pikapods.com/

dismalpedigree• 1 year ago

Proxmox on a NUC. Separate RPI running HaProxy to route requests. Public 443 forwards to haproxy. All on separate vlan from home network. Router allows ssh across vlan for specific IPs. Ssh only available from the specific IPs. Some of the VPS on proxmox run Nebula protocol (like tailscale but self hosted) and there is a lighthouse on a $2 VPS. This allows me to access specific resources only from mesh network when away from home.

smjburton• 1 year ago

This is a great introduction to self-hosting, good job OP. As some of the other comments mentioned, discussion about self-hosted security and the importance of back-ups would be good to include. Also, you link to some great resources for discovering self-hosted applications, but it would be interesting to hear some of the software you enjoy self-hosting outside of core infrastructure. As I'm sure you're aware, self-hosters are always looking for new ideas. :)

espdev2• 1 year ago

Funny how the author doesn't give a single link in the post. The reader has to go searching, spend time to find the things the author writes about. Well, a simple example: Awesome-Selfhosted. Is it that hard to give a link? Is it some kind of phobia or religion that doesn't allow direct links on the internet? Really? Come on, it's hypertext! Where are the hyperlinks?

TobTobXX2• 1 year ago

The headers are hyperlinks.

espdev2• 1 year ago

Yes, the links are now in the headers. The author has updated the post.

tvaughan• 1 year ago

For our startup, I decided we’d self-host as much as possible. We have one server in our office with Traefik for “firewall” and SSL termination, and our backend services are handled by Incus. Our only paid services are Tailscale and Postmark. We run things like forgejo and mattermost for our internal development work, as well as things like elasticsearch and kibana for observability into our products (100ish embedded devices distributed globally). So far so good.

72deluxe• 1 year ago

This seems overkill. You only need a Pi. I have a Pi4 fanless running:

1. lighttpd exposing a website, using letsencrypt and a cron job to run certbot and restart lighttpd.

2. mox (https://www.xmox.nl) to run a mail server, with PTR records set up by my ISP. I am not with a CG-NAT ISP else none of this would be possible. mox makes it easy enough to set up DMARC and SPF etc. with appropriate output given that you can add to your DNS records.

3. I grab the list of IPs from https://github.com/herrbischoff/country-ip-blocks and add them to an iptables list (using ipset) every week so that I can block certain countries that have no legitimate reason to be connecting, with iptables just dropping the connection. I think I also use https://github.com/jhassine/server-ip-addresses to drop certain ranges from cloud servers to make annoying script kiddies go away.

4. peer-calls (https://github.com/peer-calls/peer-calls/) to be able to video call with my family and friends (with a small STUN server running locally for NAT traversal as I recall).

5. linx (https://github.com/andreimarcu/linx-server) to share single links to files (you can get an Android app to upload from your phone)

6. filebrowser for sharing blocks of files for users (https://github.com/filebrowser/filebrowser).

7. pihole runs on it so blocks adverts.

8. Wireguard runs on the Pi and I open the VPN ports on my router. I use the VPN on my phone so adverts are blocked when I am out and about (traffic gets routed through the Pi).

9. navidrome runs on it and I use subtracks on Android to stream (or just download albums for when I have spotty connection).

10. mpd runs on the Pi and it plays music to some speakers in the house, so I can control it with M.A.L.P on Android.

11. I use goaccess (https://goaccess.io) to look at my server logs and see what is hitting me.

12. I use maxmind geoip data so I know which countries are hitting me.

13. minidlna runs on the Pi so I can stream films to my TV.

14. I run CUPs on it too so that my rubbish wireless Samsung printer can be printed to from Android and my wife's Apple devices without having to buy an AirPlay-compatible printer.

15. xrdp running so I can log into a visual desktop on the Pi if required.

My router doesn't expose SSH ports, just appropriate ports for these web services and the VPN. SSH keys are useful. SSH is not open to the world anyway and you have to VPN into the network first.

This all sits happily and quietly in a cupboard and uses a feeble amount of power.

gaeb69• 1 year ago

Nice blog! following.

crivlaldo• 1 year ago

This article motivated me to upgrade my hosting approach.

I've been running a DigitalOcean VPS for years hosting my personal projects. These include a static website, n8n workflows, and Umami analytics. I used manual Docker container management, Nginx, and manual Let's Encrypt certificate renewals. I was too lazy even to set up certbot.

I've migrated to a Portainer + Caddy setup. Now I have a UI for container management and automatic SSL certificate handling. It took about two hours.

Thanks for bringing me to 2025!

johnmw• 1 year ago

I recently came across another new one that looks really nice - Canine [0].

I haven't tried it myself yet. Has anybody else given it a spin?

[0] https://canine.sh/

pentagrama• 1 year ago

As a non-developer, I find it difficult to step into the self-hosting world. What I recommend for people like me is the service PikaPods [1], which takes care of the hard part of self-hosting.

I have now switched from some SaaS products to self-hosted alternatives:

- Feed reader: Feedly to FreshRSS.

- Photo management/repository: Google Photos to Imich or Imgich (don't remember).

- Bookmarks: Mozilla's Pocket to Hoarder.

And so far, my experience has been simple and awesome!

[1] https://www.pikapods.com

Self-Hosting like it's 2025

Related Stories