cross-posted from: https://lemmy.ml/post/54320214

[Question] [Help]

Hi everyone,

I am new to self-hosting and this is also my first post on Lemmy. I have a navidrome instance for my music (installed via docker compose) and a jellyfin instance for movies and shows (also installed via docker compose) running on a Raspberry Pi 4 8GB. I know I could also use music over jellyfin but I prefer to have it in navidrome.

The next thing that I want to achieve on my journey through the world of self-hosting is to run my own matrix server. The ideal eventual goal would be to have my own server on that same Raspberry Pi which I can then use to bridge Whatsapp to so I finally can get rid of that App from my primary phone. Receiving Whatsapp messages is unfortunately necessary for me to keep contact with certain people, although I would prefer to get rid of it completely as well, but who am I telling that, there are plenty of people out there facing the same issue.

As Whatsapp needs to run somewhere, which is required to have the bridge properly working, it would ideally run in an Android Virtual Device although that is no requirement as I know physical phones are recommended and emulated devices get blocked more often.

Ideally, the matrix server would also be installed using docker compose. It is intended to have one user only which is me but should of course be able to communicate with other servers to enable me to talk to others. The main limitation is that all three services should be running on that Raspberry Pi at the same time.

As my experience regarding such a project is virtually zero, my questions are:

Is such a setup is feasible and generally a good or bad idea (considering running jellyfin, navidrome and matrix on one Raspberry Pi)?

What issues should I consider before starting such a project?

If there's someone having a similar setup, what are your experiences?

Also important to note: The matrix server should be able to handle video and voice calls as well, not in large rooms of course, but rather in a context of 2 to 4 people max.

Any advice, information or personal experience is well appreciated! I want to properly inform myself before starting out and thought here might be a good starting point. If I forgot to mention any specific information that is needed please let me know.

Thanks a lot!

EDIT: Adjusted post title to better reflect the advise-seeking character of this post and adjusted question phrasing

Rather than Castopod for the podcast archive and Icecast for the live radio stream I would like to find something that can do both. Any ideas?

cross-posted from: https://discuss.online/post/46653613

Fully migrated: learning about policy, config files, defining groups, autogroup settings, preauthkey registration, using tags in place of users and now working through MagicDNS.

GitHub repository: https://github.com/mashiox/s3ql-time-machine/

Background and Motivation

A few years ago, before I fully understood the operational lock-in and caveats that come with S3QL, I deployed several encrypted, deduplicated filesystems directly on Amazon S3. The intent at the time made sense: use S3QL as a secure networked filesystem in the cloud to store sensitive disk backups, and data.

AWS is an exceptional platform. The reliability, API consistency, are second to none. However, AWS is extremely expensive for long-term storage and data egress. As data sizes grew into hundreds of gigabytes and terabytes, keeping static media files in S3 buckets across multiple regions became financially unreasonable.

My primary motivation was straightforward: change the hosting strategy to something more economic. I decided to transition my data off AWS and bring it into a local, self-hosted environment. That was where I ran into a my first blocker.

The S3QL Version Lock-in Problem

On my workstation running Arch Linux (btw), the native S3QL package is on version 6.2.2. When I first attempted to mount one of the legacy buckets, the tool failed immediately:

$ mount.s3ql s3://eu-central-1/eur-media /mnt/s3ql/eur-media/
ERROR: File system revision too old, please run `s3qladm upgrade` first.

S3QL breaks file data into compressed, deduplicated chunks and coordinates all filesystem structures through a central SQLite metadata database stored in S3 as an object named s3ql_metadata. Across major releases, S3QL frequently changes its internal database schema and metadata representation. Newer binaries strictly refuse to mount older filesystem revisions.

When I tried running the suggested upgrade command, I was blocked again:

$ s3qladm upgrade s3://eu-central-1/eur-media
To upgrade the filesystem, first download file system metadata using the previous
version of S3QL (eg. by running fsck.s3ql)

This created a classic chicken-and-egg problem. To upgrade the filesystem to work with modern S3QL, I needed the historical S3QL binaries to run fsck. Moreover, executing an irreversible schema migration directly against production S3 buckets is high-risk. A failed upgrade can permanently corrupt the metadata, turning encrypted data blocks into unrecoverable garbage.

I established clear constraints for this recovery operation:

• Non-destructive changes are mandatory.
• Do not downgrade or alter native packages on the host operating system.
• Do not mutate remote S3 objects into an unrecoverable state.
• Enable AWS S3 Bucket Versioning across all buckets as a fallback safety net.

The S3QL Time Machine Architecture

Instead of fighting host dependencies or risking an in-place database upgrade on AWS, I designed the "S3QL Time Machine" approach: run the required historical versions of S3QL inside isolated Docker containers.

The container environment:

• Base image: Ubuntu 20.04 (providing Python 3.8 and stable compilation toolchains).
• Installed packages: fuse3, libfuse3-dev, cython3, sqlite3, libsqlite3-dev, cryptsetup, and psmisc.
• Python dependencies: apsw, pyfuse3, dugong, cryptography, requests, and google-auth.
• Target S3QL version: S3QL 3.8.1 (Filesystem Revision 24), compiled directly from release sources.

To allow the container to provide a FUSE mount back to the host, the container is launched with:

• --device /dev/fuse
• --cap-add SYS_ADMIN
• --security-opt apparmor:unconfined
• -v $AUTHINFO_FILE:/root/.s3ql/authinfo2:ro
• -v $(pwd)/pool:/pool:shared

The shared volume propagation ensures that when mount.s3ql attaches the remote filesystem inside the container to /pool/<bucket>, the unencrypted files immediately appear on the host system at ./pool/<bucket>. From there, I run rsync to copy the data directly to local disk.

Technical Obstacles Encountered and Debugged

During the recovery process across the different buckets, several subtle technical issues arose that required diagnosis.

A. S3 Object Metadata and Version Identification

To inspect bucket metadata without mounting, I wrote a Python inspection tool using boto3. Modern S3QL formats metadata using a custom raw2 format split across x-amz-meta-NNN HTTP headers. boto3 automatically strips the x-amz-meta- prefix, exposing keys as 000, 001, format, etc. While cleartext inspection easily confirms format_version: 2, encryption: AES_v2, and `compression: LZMA, for encrypted buckets S3QL intentionally hides the actual revision number inside the encrypted data attribute to prevent metadata leakage. This confirmed that spinning up a legacy container was the only way to inspect the internal revision.

B. Python ConfigParser Passphrase Syntax

When mounting another bucket, mount.s3ql crashed during argument parsing:

configparser.InterpolationSyntaxError: '%' must be followed by '%' or '(', found: '%B70nUcwE'

S3QL uses Python's configparser with BasicInterpolation enabled by default. Because the passphrase contained a literal percent sign (%), configparser tried to parse it as an interpolation variable. The solution under INI specifications is to escape the percent character by doubling it (%%) in ~/.s3ql/authinfo2.

C. Remote Stale Locks (Exit Code 31)

When attempting mounts on buckets that were previously aborted or not cleanly unmounted in 2020, mount.s3ql halted:

ERROR: Backend reports that fs is still mounted elsewhere, aborting.

S3QL tracks an is_mounted boolean flag in the remote metadata to prevent concurrent writers from corrupting the filesystem. Because earlier sessions died without a clean unmount, is_mounted remained True in S3.

Attempting to mount failed. Running modern fsck.s3ql on the host was out of the question. The fix was to execute fsck.s3ql inside the Time Machine container using the --force-remote flag:

docker exec s3ql_mount_<bucket> fsck.s3ql --log none --force-remote --authfile /root/.s3ql/authinfo2 s3://<region>/<bucket>

This scanned the SQLite metadata tables, corrected inode size inconsistencies, cleared the stale lock, and uploaded clean metadata back to S3, allowing subsequent mounts to proceed.

D. FUSE Ownership and Extraction Permissions

Once mounted, running rsync from the host hit Permission denied errors on directories and files. FUSE mounts default to restricting access to the user that mounted the filesystem (root inside the container). Adding the --allow-other flag to mount.s3ql opened access to the host user, and adding --exclude 'lost+found' to the rsync command allowed extraction of the actual data without stumbling on root-only system directories.

Outcome and Conclusion

Using this containerized isolation technique, I successfully recovered and extracted 4 buckets of encrypted data, totaling just over a 1TB footprint in S3.

The objective has been achieved. Investing the time to reverse-engineer the versioning constraints and wrapping the legacy runtime with Docker, I unlocked all of my archived data without paying ongoing AWS storage fees, without risking metadata corruption, and without destabilizing my host operating system.

However, AWS did manage to ding me one last time, charging me for the exfil bandwith!

AI Use Disclosure

An agentic coding harness was used in the creation of the s3ql time machine code. Architectual decision records, and deep research artifacts can be found in the repository's docs/ directory.

Repo: https://github.com/ontoplano/ontoplano

Demo: https://demo.ontoplano.com/

It is very scriptable and integrable: it comes a REST API, Webhooks and a MCP server; all that work with scoped permissions tokens.

cross-posted from: https://lemmy.world/post/52678244

As title says, i want to start self hosting but i have a lot of questions about it. For more context, i want to self host XMPP, matrix, Immich, an email, forgejo and a minimal website. i want to ask you:

1. Where should i buy my domain and are there any things i should be careful about?

2. does the end of my domain (idk the specific name but .XYZ) matter at all?

3. I get that i should use a used PC (i have none lying around), but how old?

4. Am i willing to self host too much stuff?

5. Can i use Gentoo, Devuan, or other non-systemd distros as an OS?

Sorry for the noob questions but i struggle to find answers online, feel free to tell me to RTFM ~_~;
Also, i have experience with Linux as a desktop OS, more specifically 3 years, one of which mostly in gentoo, but i’ve daily driven Arch, Artix, Debian, Void among others

What if your music server had a social network attached, and your social network could play music?

I setup pihole and jellyfin on it and currently I'm working on a creative webrevival personal website to host on it.

Tips, feedback, and suggestions are highly appreciated.

I've recently migrated away from iOS to GrapheneOS and I need a way to have a family shared calendar and reminders. I'm thinking NextCloud because I don't really know of anything else.

I've been doing some research and I'm a bit overwhelmed since I have never self hosted before and I'm not too familiar with these technologies. I have an old HP ProDesk with an old i3, 4GB of RAM, and 120 GB SSD that I was hoping to use intermittently until I get a newer machine. I want to be able to expose the instance to the wider internet so we (my partner and I) can access it on the go, but I'm worried about messing it up. I was reading that I need a reverse proxy as bare minimum, but do I also need fail2ban, Anubis (or Go Away), and special UFW rules? I got as far as installing NextCloud with podman on Ubuntu Server 26.04.01 LTS and I can access it locally, but I'm not sure how to get move forward.

Ideally I would like to have a bash script that sets everything up with user data being handled by an external drive so I can easily reproduce it to a new machine later down the line and facilitate backups. I'm not married to Ubuntu and I am open to using something else.

I also want to run other self hosted open source services like Navidrome, Yamtrack, Standard Notes, etc. Any guidance would be appreciated.

Quick guide on how to safely upgrade Jellyfin to version 12 following the latest release just a few days ago.

Original content by The Unknown Universe, written by a human and not AI generated!

I built InSpectre (https://inspectre.cc/), an open-source, self-hosted platform designed to discover, track, fingerprint, and security-scan every device on a local network without relying on third-party cloud services.

As a homelab administrator and sysadmin, I wanted a single dashboard to keep track of active LAN devices, catch vulnerabilities before they become problems, track household presence, and manage container infrastructure without sending telemetry outside my local network.

Key features:

Device Discovery and Fingerprinting: Uses active ARP sweeps combined with a passive ARP/DHCP sniffer to spot new devices immediately. It auto-classifies devices using OUI, DHCP parameters, and port patterns.

Security and Vulnerability Scanning: Integrates Nuclei and nmap (-sV) for scheduled CVE scanning per device with a severity-grouped dashboard.

Traffic Control and Blocking: Allows you to pause network access or set recurring block schedules per device via ARP MITM.

Presence Tracking: Groups multiple devices (phone, laptop, smartwatch) under individual people to provide a unified Home/Away status and per-person schedule controls.

Docker and Proxmox Monitoring: Streams logs, scans images with Trivy for CVEs, and manages container updates with automated rollbacks.

Integrations: Native Home Assistant MQTT auto-discovery, 16 notification channels (ntfy, Gotify, Telegram, Pushover, Discord, etc.), and custom JSON/YAML plugins.

Architecture: The app runs as four lightweight Docker containers (frontend, backend, probe, and Postgres). By default, zero bytes leave your LAN unless you explicitly configure an external notification integration. It is dual-licensed under AGPL-3.0 and Commercial.

Project repository: https://github.com/thefunkygibbon/InSpectre

I would love to hear your feedback on the architecture, features, or performance. What tools do you currently use for LAN visibility, and what features would make this more useful in your setup?

This is a little bit of a wall of text but I hope it will be a nice sample for such a setup.

cross-posted from: https://discuss.online/post/45217367

I'd like to extend API access to a designated domain for listeners of Linux Prepper podcast, and others interested in experimenting as a decentralized community. Current wiki page of ideas is at https://wiki.livingcartoon.org/resources/xyz

Looking for suggestions and other input in making this an experimental success.

cross-posted from: https://programming.dev/post/56231294

It's a tiny selfhosted service that determines the client's IP address or accepts an IP address through a query parameter, then returns geolocation and ASN information using the MaxMind GeoLite2 databases.

I often used services likr ipinfo.io for checking my IP, location etc. e.g. to make sure a VPN was working properly. These are also handy for figuring out which timezone to use etc. I wanted to selfhost it, but couldn't find one that satisfied my needs. So I decided to write one.

Check out the README for details.

Hello,

This project is designed to give you your own collaborative workspace over the Tor Network.

It’s designed to be a very minimal and lightweight distributed network in which each tmailplus node is in complete control of their own data.

Because of the minimal dependencies, it can even run on my favorite linux shell, termux.

The service is split into three isolated onion addresses.

-1. A public mailbox and place for publishing public PGP key.

-2. UI address. Authenticated hidden service access to the UI.

-3. Rotatable Sharepoint address. (for inviting guests to your docs and sheets)

To drive the realtime collaboration, websockets are utilized. We get very nice performance even including the latency of the tor network. In docs, every keypress is streamed. In sheets every cell update is streamed to connected collaborators.

On top of the encrypted connection that tor provides between the server and client, PGP can be utilized to ensure data is even encrypted at rest within the server DB.

The intended use case is for anybody who wants to be completly isolated from big tech platforms. This allows you to be your own tiny infrastructure.

Here are a few screen captures of the UI. I chose a very basic, plain interface. On linux, the font is ‘Liberation Mono’ which I thought was fitting.

I attempted to make tmailplus as easy as possible to setup. tmail.sh handles gathering dependencies on termux, macOS, or Debian platforms dynamically. Local ports are adjustable as well. You can even run multiple isolated tmailplus nodes on one machine if you wanted. The install script also duals as the server manager for your node which is shown in the last screenshot.

I'm looking for an IBM Power8 S822(L) or equivalent for other brands. Which are the better refurbished stores for these?

Thanks.

This is a post about my path from subscription to selfhosted. My little struggles (which is pretty much none) to what I use and my view on the digital property.

I also had discussed on the concept of property, in this case it's a grey area depending on your country if you can download youtube videos to listen later. But it's a idea to have in mind.

Either way, it's mostly about music.

All feedback is welcome.

I recently came across a video by Loyal Moses titled "They're Banning Your Home Server".

This got me thinking about what it means for anyone who likes running their own gear.

The industry lobby's framing around private servers feels like a major mask-off moment for big tech, treating user-controlled hardware as a threat.

I have written a short piece in reaction to the video and would love to hear your thoughts.

Original content by The Unknown Universe, written by a human and not AI generated!

Hi all, I am fairly new to self hosting and just used old parts to build myself a home-server (parts image above). I am using Zima OS to run my apps and up until recently Immich was working fine and than suddenly it stopped. First it looked like it was running but was not accessible remotely (via Cloudflare Tunnel) or over the local network so in my attempt to troubleshoot I tried to restart it but now it won't even start. All I can find online is an old update changed the port but that doesn't seem to be the case here. Any and all help is appreciated. Thank you! Edit: Added an image of logs. Update: In case someone else runs into a similar issue sudo systemctl start docker solved it for me.

I was reading on the web that clamav is not an "endpoint antivirus solution" but at the same time its called the best antivirus for gnu/linux and gnu/linux servers. Is worth for a home server?

What do others use for ensuring the authenticity of images after downloading them with docker pull?

We’ve setup our CI build process to use docker for consistent, cross-platform builds. To ensure that our builds don’t use a malicious docker image (because the surface area of attack with TLS is enormous if you’re using X.509), we’ve been using DCT (Docker Content Trust).

Unfortunately, I just discovered that the official docker documentation says that DCT is being deprecated. Apparently this was announced last year, and in June this blog post was published with advice:

• https://www.docker.com/blog/docker-content-trust-retirement-and-migration-guidance/

Cosign is not secure

We spent some time looking into cosign, but we discovered that the private keys aren't actually in the hands of the developer.

Rather, they use this complicated setup using very insecure X.509 to issue temporary certificates.

The result is that the OIDC identity provider (e.g., GitHub) extends the vector of attack significantly -- to probably tens of thousands of people -- that can publish a malicious image that will be accepted by cosign as "trusted"

Notation (Notary v2)

I also looked at Notation (aka “Notary v2”), but there’s no way to bootstrap the software safely, since (perplexingly) their tool for verifying the authenticity of images using cryptographic signatures itself can’t be verified using a cryptographic signature.

Alternatives

Are there any other alternatives that I can use to replace DCT to ensure the authenticity (using cryptography) of the container images that I download -- where the keys are actually held by the developer (thus significantly reducing the "insider threat" risk)?

What do you (or does your org do) to ensure that you’re not using maliciously-modified containers after pulling a new docker image?

This is a discussion on federated software for communities. From the digital to local, and how the problems about it. I hope you enjoy the reading.

All feedback and conversation is welcomed.