this post was submitted on 11 Aug 2026
92 points (98.9% liked)

Selfhosted

61711 readers
573 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
ayyy@sh.itjust.works
curbstickle@anarchist.nexus
curbstickle_lw@lemmy.world
92
I need a new hobby, I'm going to set up my own Lemmy instance. Am I an idiot? (lemmy.world)
submitted 2 weeks ago by AngryishHumanoid@lemmy.world to c/selfhosted@lemmy.world
79 comments fedilink hide all child comments
 

Of the many useful things I could do with my spare time instead I'm setting up a Lemmy instance because why not. The scope of this is definitely greater than any self-hosting I've ever attempted, so please feel free to tell me just how much trouble I'm in. I'm just giving the broad strokes to see if I've made any crucial errors (other than deciding to do this at all).

And if this is a completely wrong place for a post like this or I'm missing data I'm supposed to include I apologize, I probably need a sanity check, in more ways than one.

First limitation, I'll be hosting it on an existing Linux Mint box acting as a file share mostly and occasional gaming PC/movie streaming box. Its hardware is overkill for this, I do not anticipate issues when it is in use. It receives regular updates and weekly reboots, instance will be set to automatically restart. NVMe with loads of space for local storage, RAID SSDs for data offload/backup.

Second limitation, I hate Cloudfare and Oracle. I do not want to use either of them.

Third limitation, money. Cheaper is better. I have a URL picked out and a registrar which will give me the cheapest long term option, in case I actually keep this thing going.

Last limitation, I'm already in over my head so I'll be relying on a lot of googling and probably some chat bots to figure things out as I go through the actual deployment process. What could go wrong?

So, Lemmy hosted on Linux Mint box using Docker containers. ISP is a good one for this I'm told, no CGNAT, largely stable public IP but I'll have a script running in case it does change. Confirmed ports 80/443 are open. Using Caddy for the HTTPS. Closed registration to start, if by some miracle I make it to actually wanting to allow additional users it will not be fully open, and I'll use Brevo for the email SMTP. Security wise I know I'm making it harder for myself by exposing my IP, I'm going to have UFW running and Crowdsec to help keep incoming bad traffic out.

Down the line I'll get Lemmy updates, backups, retention rules in place/automated, and make decisions on federation, etc. Thoughts?

top 50 comments
sorted by: hot top controversial new old
[–] Jimbabwe@lemmy.world 60 points 2 weeks ago (1 children)

Probably, yes, but I still love you

[–] AngryishHumanoid@lemmy.world 22 points 2 weeks ago (1 children)

You sound like my wife.

[–] Marthirial@lemmy.world 10 points 2 weeks ago (1 children)

Plot twist. You are not married...

[–] AngryishHumanoid@lemmy.world 18 points 2 weeks ago

Sure I am, but depending on how much of my free time goes into this we'll see if it stays that way....

[–] Decronym@lemmy.decronym.xyz 13 points 2 weeks ago* (last edited 1 week ago) (1 children)

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

Fewer Letters More Letters
CGNAT Carrier-Grade NAT
CSAM Child Sexual Abuse Material
DNS Domain Name Service/System
ISP Internet Service Provider
NAT Network Address Translation
TLS Transport Layer Security, supersedes SSL
VPS Virtual Private Server (opposed to shared hosting)
nginx Popular HTTP server

[Thread #76 for this comm, first seen 11th Aug 2026, 19:20] [FAQ] [Full list] [Contact] [Source code]

[–] OhVenus_Baby@lemmy.ml 5 points 2 weeks ago

We need more of this across all Platoforms for discovery and learning. Thank you!

[–] ianhclark510@lemmy.blahaj.zone 10 points 2 weeks ago (1 children)

Best of luck on your new hobby!

I didn’t see anything in your post that set off alarm bells

If you’re looking to save some cash and your ISP gives you a stable public address you could utilize a Dynamic DNS provider (ala duckdns) instead of registering a domain

[–] AngryishHumanoid@lemmy.world 3 points 2 weeks ago

Good point, that was purely a vanity issue: I have a specific name I want for my instance, and I wanted it to be as short a URL as possible so I was willing to spring for the domain. I'm not saying I'm doing all this just for the pun I have in mind, but I did spend far too long on that step of my deployment plan.

[–] PabloSexcrowbar@piefed.social 9 points 1 week ago (1 children)

I would NOT host a Lemmy instance at home unless you're going to obfuscate your IP address. If you make it public, you're inviting any whackjob that sees your username to find your physical location. Additionally, I wouldn't host it on a PC that you actually intend to use for day to day stuff, just in case the instance gets hacked and someone manages to escape the container it's in. If you wanted to do this, I would put it on its own box with Cloudflare in front of it, otherwise you're inviting trouble where there doesn't need to be any.

[–] lemmyvore@feddit.nl 3 points 1 week ago

I keep seeing "escape the container" mentioned like it's a very common occurance. Is it really? I've looked up escape CVE's and they seem to be few and far apart, they're usually tricky to pull off, and when one comes out it's a big deal and they get fixed right away (obv).

Actually my issue isn't "do escape CVE's exist", it's more like, should I really waste my time planning for it? It's like planning for file permissions not to work, or logins to be bypassed.

I get that shit happens and why defense in depth is a thing but how do you defend from something so fundamental? If you operate under the assumption that containerization can be by bypassed, and virtualization can be bypassed, where do you draw the line and what do you do, run each app on a standalone physical box?

[–] irmadlad@lemmy.world 8 points 2 weeks ago (1 children)

Just in general or because you're setting up a Lemmy instance?

[–] AngryishHumanoid@lemmy.world 4 points 2 weeks ago (1 children)

Well in general I know I'm an idiot, so for the moment I'll just stick with Lemmy instance feedback cause that's at least easier for me to address without expensive therapy.

[–] irmadlad@lemmy.world 3 points 2 weeks ago (1 children)

allow additional users it will not be fully open

Just for trusted friends or randos? If randos, have you ever been a mod? Never set up a Lemmy instance, but I have been a mod of quite a few Reddit subs. It's a headache I will never engage in again.

[–] AngryishHumanoid@lemmy.world 2 points 2 weeks ago (1 children)

Not complete randos, but yeah it'll likely be a very minimal group of people if at all. And I'm not looking forward to modding so I doubt I'll go the route if having a lot of comms in my instance, but we'll see what happens.

load more comments (1 replies)
[–] ranslite@pie.dasneuland.de 6 points 2 weeks ago

Not lemmy, but piefed. The easy way, try yunohost.

[–] shadshack@feddit.online 6 points 1 week ago (2 children)

The only thing I'd say is look into whatever tooling and scripts people have made for removing CSAM from your instance. I messed around with a Lemmy instance for a bit, but when I heard about how hard it was to deal with the pedos, I got a little scared about inadvertently hosting CSAM and decided to shut it down. Since then I think I remember hearing about some better automated tooling for that kind of thing though so hopefully you can set that up.

load more comments (2 replies)
[–] BuckFutter@timeyak.com 5 points 2 weeks ago (3 children)

Best of luck to you!!! I just went through this last week and wow it was a challenge. I went the docker route not using ansible…and yah by far the worst install I ever went through of all the self-hosting projects I have setup…but my setup was largely complicated by the fact I had an Apache reverse proxy setup in front of the nginx proxy that has an example config provided…finally figured it all out, but yah fun times 😂 happy to help if you get stuck.

[–] tko@tkohhh.social 2 points 2 weeks ago (1 children)

Not sure what your solution was, but I eliminated the reverse proxy from the official compose stack and configured my existing reverse proxy to point directly at the lemmy containers. It works well for me.

[–] BuckFutter@timeyak.com 1 points 2 weeks ago (1 children)

Thanks. Yah that was what I tried to accomplish using Apache but couldn’t get the correct proxypass statements in Apache that would do the correct passing depending on the header received. Tried asking an LLM for help but never got it to work, so ended up doing a basic/straight pass through apache to a local VM running nginx as an outer proxy which proxy’s to the nginx internal proxy…its messy as all hell but it works 🤷

[–] tko@tkohhh.social 1 points 2 weeks ago (1 children)

I don't know enough about Apache to say one way or the other, but based on what you described, you SHOULD be able to get rid of the internal proxy. Since both the inner and outer are both NGINX, getting the settings right shouldn't be a problem.

But, on the other hand, if it works it works!

load more comments (1 replies)
load more comments (2 replies)
[–] Shimitar@downonthestreet.eu 4 points 2 weeks ago

Cool man... I did the same last year, best decision ever.

Pretty easy too

[–] Steve@startrek.website 4 points 2 weeks ago

Maybe. Do it anyway?

[–] ohshit604@lemmy.halstead.host 4 points 2 weeks ago* (last edited 2 weeks ago) (2 children)

My instance has been online for about a month, the supplied docker-compose.yaml was quite straightforward, had a little headache with Nginx but nothing overly complicated.

The long-con so to speak is federation, you have to subscribe to each community manually to begin federating with them, i have noticed timing issues with other instances such as Lemmy.world and have not been able to resolve them.

[–] joker54@lemmy.dbzer0.com 2 points 2 weeks ago

I'll write a script you can use to seed with top communities. I already have most the work done.

load more comments (1 replies)
[–] valar@lemmy.ca 4 points 2 weeks ago (1 children)

Thought about doing something very similar, I'll be curious to hear the feedback and your experience

[–] AngryishHumanoid@lemmy.world 2 points 2 weeks ago

If at some point in the near future you step outside and hear a weird screaming sound echoing around the globe, that's me.

[–] fartographer@lemmy.world 4 points 1 week ago

I keep considering the same thing, except only letting myself register so that I can have my own stupid instance name.

[–] DeadDigger@lemmy.zip 3 points 1 week ago (1 children)

The problem is not the setup but the administration

[–] AngryishHumanoid@lemmy.world 2 points 1 week ago

So I'm discovering, heh. I got the instance up in a relatively short period of time, I'm spending far more time on email, domain, logging, backups, decisions, etc. I know I could just be a barebones "who cares about any of that" instance since it's largely gonna be my own personal playground, but where's the fun of that?

[–] spirinolas@lemmy.world 3 points 2 weeks ago

Yes, you are, but aren't we all?

[–] BlueEther@no.lastname.nz 3 points 2 weeks ago (5 children)

Yes you are mad, I know as I did that over 3 years ago. Went from at home => a cheep VPS => paid for Oracle VPS.

If you go down the lemmy route (vs piefed) then I would deply with Lemmy-Easy-Deploy by @ubergeek77. this makes setting Caddy and mail simple

load more comments (5 replies)
[–] Die4Ever@retrolemmy.com 3 points 2 weeks ago* (last edited 2 weeks ago)

Lemmy eventually plans on having an invite system, you could maybe use that when it comes out

https://github.com/LemmyNet/lemmy-ui/issues/4128

(You can also do this manually with the application answer field)

[–] hendrik@palaver.p3x.de 2 points 2 weeks ago* (last edited 2 weeks ago) (1 children)

Why not host a PieFed instance instead? Similar but more features and easier to maintain. Does have some scraper countermeasures built in, so maybe you don't even need Cloudflare. Also as a next project after that, you could learn Python and contribute to the project.

[–] AngryishHumanoid@lemmy.world 5 points 2 weeks ago (4 children)

Good question, mostly just cause I use Lemmy so wanted to stick with what I know more of at this point.

load more comments (4 replies)
[–] aReallyCrunchyLeaf@lemmy.ml 2 points 2 weeks ago* (last edited 2 weeks ago) (2 children)

You should not host anything that's going to be public facing on your home network in 2026, period. Get a cheap German VPS and go nuts with it. There's simply too much at stake opening up your home router/firewall for such little gain. Plus, being a residential IP behind NAT might just make it straight up impossible.

I host my own email and a matrix server. I would never think of exposing my home network to the internet. I use tailscale to get into the homelab, anything exposed to the net lives somewhere far, far away.

I use netcup for my email and matrix. It's extremely reasonable.

[–] tko@tkohhh.social 11 points 2 weeks ago (9 children)

I don't get this perspective. A reverse proxy pointing at containerized applications gives you plenty of buffer between the scary internet and your personal files. Don't bind mount your entire host file system to the container, and only open/forward the ports you need.

There are things you have to get right, but there's no reason to discard the idea altogether.

[–] Carl@anarchist.nexus 3 points 2 weeks ago (2 children)

I’m somewhere in the middle, because comments like yours actually reinforce my concerns. A reverse proxy isn’t really doing anything to make you more secure, unless you’re using it for some sort of access control. It hides which ports you’re using, and allows you to encrypt your traffic with TLS… But it doesn’t add any additional security to the services you are exposing.

Maybe if you use it for access control, to add a secondary username/password to the services. But that breaks most legitimate things (apps, mostly) that try to reach the double-password-protected service. Because a user on a web browser may be able to type in two passwords, (one for the reverse proxy, and then one for the service itself) but an app will try to pass that info automatically using headers.

Any vulnerabilities in the services will still become potential attack vectors. Anyone who remembers the Huntarr debacle will know exactly what I’m talking about, because a single service being vulnerable can do a lot of damage. Yes, containerization does a lot to help mitigate damage by excluding access to everything except what you give it. But it won’t completely stop things from going wrong.

[–] 9tr6gyp3@lemmy.world 2 points 2 weeks ago

Those devices should most certainly be on two separate networks. Internet facing devices should be on a DMZ and not be allowed to talk to your internal network. You can then allow your internal network reach your DMZ devices, but only allow return traffic from the DMZ.

load more comments (1 replies)
load more comments (8 replies)
[–] valar@lemmy.ca 3 points 2 weeks ago

I also don't get this fear. Assuming you aren't blindly exposing your entire filesystem or opening tons of ports what is the risk?

[–] moldy_rice@piefed.keyboardvagabond.com 2 points 2 weeks ago

Yes. Do PieFed.

Also, don't do cloudflare. If you must use something, make sure it's self hosted.

[–] onlinepersona@programming.dev 2 points 2 weeks ago

Do it. You'll learn something new. Maybe you'll even contribute to the code.

load more comments
view more: next ›