I setup pihole and jellyfin on it and currently I'm working on a creative webrevival personal website to host on it.

Tips, feedback, and suggestions are highly appreciated.

I've recently migrated away from iOS to GrapheneOS and I need a way to have a family shared calendar and reminders. I'm thinking NextCloud because I don't really know of anything else.

I've been doing some research and I'm a bit overwhelmed since I have never self hosted before and I'm not too familiar with these technologies. I have an old HP ProDesk with an old i3, 4GB of RAM, and 120 GB SSD that I was hoping to use intermittently until I get a newer machine. I want to be able to expose the instance to the wider internet so we (my partner and I) can access it on the go, but I'm worried about messing it up. I was reading that I need a reverse proxy as bare minimum, but do I also need fail2ban, Anubis (or Go Away), and special UFW rules? I got as far as installing NextCloud with podman on Ubuntu Server 26.04.01 LTS and I can access it locally, but I'm not sure how to get move forward.

Ideally I would like to have a bash script that sets everything up with user data being handled by an external drive so I can easily reproduce it to a new machine later down the line and facilitate backups. I'm not married to Ubuntu and I am open to using something else.

I also want to run other self hosted open source services like Navidrome, Yamtrack, Standard Notes, etc. Any guidance would be appreciated.

Note that i made this for myself and I am just getting started sharing an application in lemmy platform.

What is ScreenGuard?

ScreenGuard is not just a screen time tracker But a Digital Wellbeing application, currently in the making.

Came up with this application with one aim in mind...To Control daily limit for myself as my doomscrolling had worsened quite a lot even while working. So decided to make this as an alternative to Digital wellbeing on Android.

Some Key features :

* focus mode

* per app daily limits

* background daemon

so far i was able to make it work only on GNOME mutter and all x11 because that is my system...will consider updating in future if this receives positive reviews

I use fedora 44 workstation and it runs perfectly for me...and also tied it on manjaro and linux mint on my VMs with x11 , worked there too....so please check for yourselves and do tell me how it goes

NOTE: if you are a dev then please feel free to contribute as this is a very tedious long term project. Any help is great help especially because I want to keep the main codebase clean from llm generation and maintain for basic debugging purpose only conduct in this project.

GitHub Repository link: https://github.com/adityakrishnan005-a11y/ScreenGuard

----

CLEAR AI EXTENT

Codebase: Manual

Implementation: Manual

Debugging:Assisted

Packaging: generated(specifically for Custom aarch repository due to issues with AUR)

Documentation: Assisted

Quick guide on how to safely upgrade Jellyfin to version 12 following the latest release just a few days ago.

Original content by The Unknown Universe, written by a human and not AI generated!

I built InSpectre (https://inspectre.cc/), an open-source, self-hosted platform designed to discover, track, fingerprint, and security-scan every device on a local network without relying on third-party cloud services.

As a homelab administrator and sysadmin, I wanted a single dashboard to keep track of active LAN devices, catch vulnerabilities before they become problems, track household presence, and manage container infrastructure without sending telemetry outside my local network.

Key features:

Device Discovery and Fingerprinting: Uses active ARP sweeps combined with a passive ARP/DHCP sniffer to spot new devices immediately. It auto-classifies devices using OUI, DHCP parameters, and port patterns.

Security and Vulnerability Scanning: Integrates Nuclei and nmap (-sV) for scheduled CVE scanning per device with a severity-grouped dashboard.

Traffic Control and Blocking: Allows you to pause network access or set recurring block schedules per device via ARP MITM.

Presence Tracking: Groups multiple devices (phone, laptop, smartwatch) under individual people to provide a unified Home/Away status and per-person schedule controls.

Docker and Proxmox Monitoring: Streams logs, scans images with Trivy for CVEs, and manages container updates with automated rollbacks.

Integrations: Native Home Assistant MQTT auto-discovery, 16 notification channels (ntfy, Gotify, Telegram, Pushover, Discord, etc.), and custom JSON/YAML plugins.

Architecture: The app runs as four lightweight Docker containers (frontend, backend, probe, and Postgres). By default, zero bytes leave your LAN unless you explicitly configure an external notification integration. It is dual-licensed under AGPL-3.0 and Commercial.

Project repository: https://github.com/thefunkygibbon/InSpectre

I would love to hear your feedback on the architecture, features, or performance. What tools do you currently use for LAN visibility, and what features would make this more useful in your setup?

This is a little bit of a wall of text but I hope it will be a nice sample for such a setup.

cross-posted from: https://discuss.online/post/45217367

I'd like to extend API access to a designated domain for listeners of Linux Prepper podcast, and others interested in experimenting as a decentralized community. Current wiki page of ideas is at https://wiki.livingcartoon.org/resources/xyz

Looking for suggestions and other input in making this an experimental success.

cross-posted from: https://programming.dev/post/56231294

It's a tiny selfhosted service that determines the client's IP address or accepts an IP address through a query parameter, then returns geolocation and ASN information using the MaxMind GeoLite2 databases.

I often used services likr ipinfo.io for checking my IP, location etc. e.g. to make sure a VPN was working properly. These are also handy for figuring out which timezone to use etc. I wanted to selfhost it, but couldn't find one that satisfied my needs. So I decided to write one.

Check out the README for details.

Hello,

This project is designed to give you your own collaborative workspace over the Tor Network.

It’s designed to be a very minimal and lightweight distributed network in which each tmailplus node is in complete control of their own data.

Because of the minimal dependencies, it can even run on my favorite linux shell, termux.

The service is split into three isolated onion addresses.

-1. A public mailbox and place for publishing public PGP key.

-2. UI address. Authenticated hidden service access to the UI.

-3. Rotatable Sharepoint address. (for inviting guests to your docs and sheets)

To drive the realtime collaboration, websockets are utilized. We get very nice performance even including the latency of the tor network. In docs, every keypress is streamed. In sheets every cell update is streamed to connected collaborators.

On top of the encrypted connection that tor provides between the server and client, PGP can be utilized to ensure data is even encrypted at rest within the server DB.

The intended use case is for anybody who wants to be completly isolated from big tech platforms. This allows you to be your own tiny infrastructure.

Here are a few screen captures of the UI. I chose a very basic, plain interface. On linux, the font is ‘Liberation Mono’ which I thought was fitting.

I attempted to make tmailplus as easy as possible to setup. tmail.sh handles gathering dependencies on termux, macOS, or Debian platforms dynamically. Local ports are adjustable as well. You can even run multiple isolated tmailplus nodes on one machine if you wanted. The install script also duals as the server manager for your node which is shown in the last screenshot.

I'm looking for an IBM Power8 S822(L) or equivalent for other brands. Which are the better refurbished stores for these?

Thanks.

This is a post about my path from subscription to selfhosted. My little struggles (which is pretty much none) to what I use and my view on the digital property.

I also had discussed on the concept of property, in this case it's a grey area depending on your country if you can download youtube videos to listen later. But it's a idea to have in mind.

Either way, it's mostly about music.

All feedback is welcome.

I recently came across a video by Loyal Moses titled "They're Banning Your Home Server".

This got me thinking about what it means for anyone who likes running their own gear.

The industry lobby's framing around private servers feels like a major mask-off moment for big tech, treating user-controlled hardware as a threat.

I have written a short piece in reaction to the video and would love to hear your thoughts.

Original content by The Unknown Universe, written by a human and not AI generated!

Hi all, I am fairly new to self hosting and just used old parts to build myself a home-server (parts image above). I am using Zima OS to run my apps and up until recently Immich was working fine and than suddenly it stopped. First it looked like it was running but was not accessible remotely (via Cloudflare Tunnel) or over the local network so in my attempt to troubleshoot I tried to restart it but now it won't even start. All I can find online is an old update changed the port but that doesn't seem to be the case here. Any and all help is appreciated. Thank you! Edit: Added an image of logs. Update: In case someone else runs into a similar issue sudo systemctl start docker solved it for me.

I was reading on the web that clamav is not an "endpoint antivirus solution" but at the same time its called the best antivirus for gnu/linux and gnu/linux servers. Is worth for a home server?

What do others use for ensuring the authenticity of images after downloading them with docker pull?

We’ve setup our CI build process to use docker for consistent, cross-platform builds. To ensure that our builds don’t use a malicious docker image (because the surface area of attack with TLS is enormous if you’re using X.509), we’ve been using DCT (Docker Content Trust).

Unfortunately, I just discovered that the official docker documentation says that DCT is being deprecated. Apparently this was announced last year, and in June this blog post was published with advice:

• https://www.docker.com/blog/docker-content-trust-retirement-and-migration-guidance/

Cosign is not secure

We spent some time looking into cosign, but we discovered that the private keys aren't actually in the hands of the developer.

Rather, they use this complicated setup using very insecure X.509 to issue temporary certificates.

The result is that the OIDC identity provider (e.g., GitHub) extends the vector of attack significantly -- to probably tens of thousands of people -- that can publish a malicious image that will be accepted by cosign as "trusted"

Notation (Notary v2)

I also looked at Notation (aka “Notary v2”), but there’s no way to bootstrap the software safely, since (perplexingly) their tool for verifying the authenticity of images using cryptographic signatures itself can’t be verified using a cryptographic signature.

Alternatives

Are there any other alternatives that I can use to replace DCT to ensure the authenticity (using cryptography) of the container images that I download -- where the keys are actually held by the developer (thus significantly reducing the "insider threat" risk)?

What do you (or does your org do) to ensure that you’re not using maliciously-modified containers after pulling a new docker image?

This is a discussion on federated software for communities. From the digital to local, and how the problems about it. I hope you enjoy the reading.

All feedback and conversation is welcomed.

cross-posted from: https://reddthat.com/post/71512059

I'm planning to self-host a 24/7 radio show and need some architecture advice.

The vision:

• Monitor my RSS feeds and social media posts, then turn them into spoken-word segments.
• Follow a fixed daily schedule (e.g., news at 8 AM, sports/tech at 9 AM, music blocks, etc.).
• Serve the stream via a web player on my site.
• Keep audio files on disk for three days so I can catch up on anything I missed after airing, with the option to choose playback speed.

The confusion:
Are any of the tools I'm considering actually suitable for audio streaming and playlist management? Or am I approaching this the wrong way?

Current thinking:

• Use radio-dj or SUB/WAVE as the broadcast engine.
• Use Piper TTS for speech synthesis.
• Use Cron for scheduling.
• Write a custom Python script with Ollama (local) for content generation, in case I want an AI "host" to create a continuous flow from all the disparate sources.

Has anyone built something similar? What framework would you recommend? Am I overlooking a dedicated FOSS radio automation tool that already does this?

Thanks in advance!

Crosspost of [my post in !selfhosted@lemmy.world](https://lemmy.world/post/50560671).

Every time someone asks "will this run on a 1 GB VPS?" the answer is a guess, or a vendor minimum that was written to be safe rather than accurate. So I measured it.

Same box, same method, every app: install, start it, let it settle for 60s at idle with no clients connected, then sum the RSS of the whole process tree. No Docker overhead in the numbers — these are the apps themselves.

Things I did not expect:

• *The \arr apps are all the same size. Sonarr, Radarr, Lidarr and Prowlarr land within 5 MB of each other (188–193 MB). That is not a coincidence and it is not the app — it is the .NET runtime setting the floor. Which also means the folklore of "budget ~2 GB for an \*arr stack" is roughly right, and I say that as someone who started this expecting to debunk it.
• Go binaries are absurdly cheap. File Browser, Gotify, ntfy, PocketBase, Caddy and Navidrome together idle at about 181 MB — less than one Sonarr.
• Grafana's 512 MB minimum is honest. At 172 MB idle it has real headroom needs once dashboards start querying. Not every vendor minimum is padding.
• Node apps cost you. Uptime Kuma at 136 MB is ~8x File Browser for a job that is not 8x harder.

Caveats, because they matter: this is idle RSS, not what you need under load. Databases, media transcoding and indexing all blow past these numbers. Treat it as the floor, not the budget. My own rule of thumb from this: sum the idle figures, add ~300 MB for the OS, then add 30% headroom — that has matched what actually fits so far.

Raw data is free under CC BY 4.0 (CSV and JSON), plus per-app pages with the exact commands used so you can reproduce or dispute any number:

https://smeltworks.com/smallserver/

CSV direct: https://smeltworks.com/smallserver/smallserver-dataset.csv

Happy to take corrections — if a number looks wrong for your setup I would rather fix it than defend it. Also taking requests for what to measure next; Jellyfin and Immich are the two I keep getting asked for.

cross-posted from: https://scribe.disroot.org/post/10609833

Hello all,

Hubzilla version 11.4 was released recently, now has a new docker image built and should be ready for use.

On a technical note, if your setup involves connection pooling regarding your database, you will need to set system.pdo_emulate_prepares to true within your htconfig.php. The 11.4 release of the docker image, has the appropriate line in the htconfig.php commented out, for your convenience; naturally if you edit your htconfig in other ways (CLI, etc) that will still work, as well. Whichever way you choose to deploy your instance, you have options available to you.

If you are unsure about connection pooling, techbuzz has a great article on the subject, that you can access via the link at the end of this post.

Special thanks to the Hubzilla devs, and contributors for their ongoing work.

You can find their work at: https://framagit.org/hubzilla/core

Please review the new release at: https://framagit.org/hubzilla/core/-/releases

And lastly, within the next hour or so, the docker image will be ready to go at: https://hub.docker.com/r/dhitchenor/hubzilla

I hope this finds you all well; please stay safe.

EDIT: Here is the TechBuzz Online article that I mentioned earlier https://techbuzzonline.com/database-connection-pooling-guide/

I have a Terramaster F6-424 and the vendor site says that the machine can support up to 32gb of RAM. I am running TrueNAS on it.

I have tried 4 different 32gb DDR5 sticks and the machine refuses to POST (or whatever the beep is when it turns on). The latest one I tried I chose specifically because it said it supported my exact machine, despite the price. I don't know if I'm just missing some specific spec on the memory that makes all 4 of the sticks I've tried incompatible with the F6-424, but at this point I'm doubting Terramaster's claim of supporting up to 32gb.

I wanted to post here and ask if anyone has succeeded in upgrading/replacing the RAM in a Terramaster NAS before I return this last one and try a 16gb stick.

Is there something I'm missing here? Does running TrueNAS instead of TOS matter? Has anyone had success with any specific RAM model with this setup?

Hey all, I'm Rick — presenting texttotalk.org v0.3.

Some of you, especially from 4chan, might already know about it. If you haven't heard of it: it's basically an anonymous imageboard-style community, minus a lot of the usual moderation.

What is texttotalk? A text-only board that combines 4chan-style open/custom boards with Reddit-style community structure and moderation tools.

Why text-only? Simple: no images means no image-based moderation headaches, and it gives the board a distinct identity that's different from every other imageboard clone out there.

Why Windows 7 theme? Because I think retro UI is fun and nobody else is doing it. It's a nice break from every board looking like Reddit or Discord.

How it's built: Pure PHP + MySQL. I built it with a lot of AI assistance (Claude, ChatGPT, DeepSeek, others) — I'm upfront about that. If you've got opinions on AI-assisted coding, I'm happy to hear them, but the site works and it's genuinely mine in terms of design and iteration.

Who's it for? Anyone who wants a lighter-moderation alternative to the big platforms, wants to run their own board/community, or just likes messing around on something different.

Come check it out, join a board, make your own. Feedback welcome.

cross-posted from: https://sh.itjust.works/post/63691946

Looking for advice on setting up a new whole home network and the direction to take of MoCA over existing cabling vs running new Ethernet Cat6A:

Recently in a new space that has an existing HomeConnect CSMAPDU9VPI with coax cables run throughout the home, which seems like a great candidate to just use MoCA and get up and running faster:

But I am also interested in "future proofing" the network setup and replacing the coax cables that are already run with Cat6A Ethernet, all connecting to a central 10G switch / homelab setup.

Is it worth the effort to re-run all of the cables and swap out the wall plates or just go with the simple thing an run with a MoCA setup? I'd really prefer to not spend on one setup with the plan to update in the future, but maybe that's the compromise solution to get setup and running sooner.

The CSMAPDU9VPI is currently completely isolated from the cable line to the modem (picture above is old and shows a cable connected to the IN port, this cable is no longer connected) so I don't think I have to worry about interference with my DOCSIS 3.1 service / modem.

Hey! I have a VPS with 4GB and noticed that authentik, my identity provider is eating up a big chunk of it (1.2GiB on average) limiting how many services I can run on my server. I've been considering migrating to a more lightweight identity provider as authentik feels bloated for my use case (I have hardly 5 users and don't need all these enterprise features). I'm mainly looking for an identity provider that:

• has good documentation
• supports OAuth2
• supports user creation through invites/registration links
• supports password and 2FA login
• lower RAM footprint

What are your recommendations? Thank you!