Selfhosted

My automatic weekly backup ran for the first time last night. Everything worked nicely.

Everything behind a VPN now, Wireguard is my single point of failure...

Decided to get back into podcasts recently, but baked-in ads and sponsor reads make standard listening unbearable.

I spent the weekend spinning up MinusPod, an open-source tool that detects ad reads and strips them using ffmpeg. It uses Whisper for local transcription, then feeds the transcript to an LLM to identify exact timestamps for sponsor segments and commercial breaks before slicing them out. I routed the text processing through Gemini Flash, which runs about $0.07 per episode. Clean, ad-free audio feeds with zero manual editing.

Got a static IP routed in from https://getrealip.net/ so I can go back to hosting my own servers at home again properly without needing to hack up everything to route through Cloudflare with Tailscale. CGNAT is really messing up the internet. The service even supports reverse DNS, yay.

After the recent plex player debacle I'm once again trying to come up with a way for me and my diaspora to share media using Jellyfin, but without relying on Tailscale. We have several media libraries, and some of the library hosters are not too tech savvy, so coming up with a solution to replace the ease-of-use of plex hasn't been easy.

I'm into this as a regular thing!

Pinned, I think a lot of us really enjoy seeing what others have been doing to take back and make improvements to our own setup.

Nothing really cool per se, but I installed Radicale on my local network as I am slowly moving away from my cloud providers.

Once I find some hardware to host Immich, I'll be fully self supporting on all my tech.

I'm considering trying to host my own mail (receive and internal send only, at least at first), as I have a friend who's hosting all the useful services and mail's the only one left.

Also experimenting with (rootless) podman, I'm finding the permission mapping a bit confusing tbh.

I recently got around to setting up OIDC for my internal apps using Pocket ID.

Sonarr v5 adds OIDC support, currently only in beta

Jellyfin SSO plugin

Nextcloud with the Nextcloud OIDC app

Mealie, Paperless, and Immich natively support OIDC

Calibre-Web I migrated to AutoCaliWeb, which supports generic OIDC

Sadly Navidrome doesn't natively support OIDC and forward auth is a bit jank due to the subsonic API

Feeling better every day having my stuff under my control and away from prying eyes of trackers and other unsavory stuff.

I have electric baseboard heaters so i like to heat my home with my server in the winter. I dont use it enough in the summer to warrant the power draw, but i'm looking forward to doing so this winter.

I'm hoping the AI bubble pops soon... i'd really like to pick up a decent accelerator card for AI for my desktop. My current server doesn't have the PCIe slots left (all filled with U.2 drives on PCIe adapters or HBAs) so it would need to go in my desktop... i thought 64GB was a lot when i built this 3 years ago but now i'm wishing I put 128GB in it...

My server has 238GB though (ordered a 256GB kit and one stick was dead. Caught that on the 4th test cycle with memtest86+ pro which I 100% paid for.) Since I use it for not only ZFS but also all of my random containers and game server VMs.

Procrastination. Want to move may lab off my pi onto my mini PC.

I have done the backup off the pi, just need to restore it but motivation doesn't line up when the family is out of the house.

A while ago I made my first attempt at setting up a SSO for some of the things I host. I figured out things that have built in support, like Immich, but struggled with getting it done through Proxy for things that don't have baked in OAuth or OIDC support.

I revisited it yesterday and figured everything out so I'm happy about that. Navidrome was one of the more difficult ones to figure out because I need SSO authentication for the web-ui, but username/password for the API. That was actually pretty easy once I wrapped my head around it.

I picked Authentik based on general positive things I've heard about it, and I use Nginx Proxy Manager for reverse proxy.

I finally ran a hardware accelerated ML container for immich.

My immich is in a VPS and my GPU is in my home server. Cheaper to run that than to rent GPU compute.

Thanks for this post, something I miss from earlier selfhosting communities.

I have simply running two SFF Lenovo Thinkcentres—one for all local services and another for all online services. They could run on one but I keep them separate for security and stability reasons. I often crash the local one by running out of space…

I finally got to building a second backup recently which I am happy about.

Honestly, since moving and downsizing from several services at home and at work, this solution works. I run out of space frequently but it forces me to not hoard things I will not actually use. My previous rack server seeded something like 50tb as I kept everything I leached to benefit the community, now less possible.

This has also made me move away from services that are not needed.

• [ ] I would like to offload all my home videos to an external drive as I am running out of space for actual services and Jellyfin media.

• [ ] I would like to consolidate all of my local and online databases rather than run a new one for each container stack.

Finally took the leap and wiped my NUC to start doing things over. Originally had a family member who works in IT set everything up, but he did the absolute bare minimum and I screwed some stuff up along the way the first time around, so I figured now was as good at time as any to teach myself to set things up from scratch!

I also have moved from Portainer, to Dokploy, to Arcane for docker management, and I actually really like Arcane. I've also accomplished something I'm really damn proud of, which is getting HTTPS working on Tailscale (so, for example, arcane.(my subdomain).ts.net but with HTTPS!) alongside Pocket ID for all of it. Maybe it's just me, but I had trouble finding clear documentation on how to do this, no matter how much I searched. But I documented it for myself, at least. And it's probably that I lack a lot of knowledge in this field, too.

I have some questions, and although I know there's a chance this gets buried, I figured I'd try asking anyway. Little skittish about making a thread myself.

My NUC is running Debian 13, and I was wondering some security things. Everything is behind Tailscale and I don't plan on exposing anything to the internet (even through Tailscale Funnel, I'm using Tailscale Serve for the HTTPS.)

• How valuable is a firewall in this case? I've never used one, and I'm wondering if it'll just make adding services more of a hassle than it's worth for the security since everything is staying local.
• Similarly, what about Fail2Ban? I have it on my RPi and it's not a big deal to set up, but I was reading a firewall is more important?
• Is it okay to run unattended updates for security OS stuff on the NUC? I don't always check updates, admittedly I'm easily distracted and forgetful. I'm a little worried about auto restarting it to finish the updates up just because I utilize a NAS and sometimes it's annoying to get them to reconnect to each other (even with the fstab edited) when there's a restart for either of them.
• Thoughts on auto updates on docker containers? I know this is pretty personal preference, but I mostly ask because I'm forgetful and distractable. I know this is kinda my own problem, but I want to know other people's thoughts if possible.

Thank you for reading my very long update! And any answers to my questions are very appreciated. Hope everyone else is doing well!

Upgrading one of my powerhouse Dell R410 proxmox nodes to 128GB of smoking hot PC10500 DDR3 ECC Ram from 64.

Now it's cutting edge.

Last week I had to update everything to make sure that it didn't fall back on DST because the fucking idjits in my backwoods province decided that they needed to create a new time zone.

Just completed my set of needed services by adding nextcloud to the list. Now life is good. Jellyfin: check. Navidrome: check. Pihole: check. Invidious: check. Nextcloud: check. What else? lol

Ordered a cheap Coral TPU for my server (an older HD mini PC with AMD CPU, no discrete GPU), just waiting on it to show up.

Last week, I finally got my Tapo cameras + Frigate + Home Assistant all working together, but now my server's CPU idles between 65% and 90%, hence the TPU.

I am trying to find affordable 2x16Gb ram modules that are just right to run on my asrock J5040 and push my proxmox to more possibilities.

Because my needs for ram are increasing since its not just about have the services availble anymore. I plan to add gitlab and k3s and with the rest of my services the 16GB ram are pretty tight.

Not quite server related, but in the middle of a workday this week, I decided I was done with Windows on my home PC. Installed Zorin OS and things have been going really well. Any issues I've had have been really minor and mostly revolve around me being picky about theming.

I haven't found a native mp3 tagger that makes sense to me yet, so I just installed Mp3tag. I'm open to suggestions on that front.

On the server side, it's mostly just keeping on. A friend has me considering Home Assistant, I just don't know if the value is there for me. I need to do some housekeeping today and update and clean up unused containers.

OMG patching all the vulns. I actually pulled my wordpress offline overnight for that one. Still waiting on the Ubuntu patch for that IPv4 kernel CVE.

That reminds me - It's time to do No NAT November again. This CVE gives me an excuse. Last year, the Nintendo Switch Switch and Steam were the big standouts. I think the Switch 2 will actually work with it now.

Oh, and my workplace is shifting offices, so my offsite backup is not offsite. Must take care to not burn the place down. I just put new fans in my PoE switch and now I can hear a server fan is dying too. There's a lot of maintenance work to all this.

This week, I've mainly been handling the fallout from the PHP vulnerability that occurred in late October. Following that incident, I made a few changes: I've opened only the necessary ports to the outside world, and the admin panel is now accessible only via VPN. I've created an inventory list for each server, clearly detailing which services are running and their versions, so that the next time a CVE is released, I'll know immediately which servers are affected. In addition to running daily automatic backups, I periodically restore them to a clean machine to verify they work.

Remember: Always treat your servers as if they might be lost tomorrow, and make sure to have a thorough recovery plan in place.

• I've taken the opportunity to update most of my hosted services to newer image versions.

  They're all in Docker and behind private access (Tailscale, mTLS, IP whitelist etc.) so I'm not usually too worried. I update images manually whenever I can find time on a slow weekend, so this wasn't strictly speaking related to the recent vulnerabilities. Volume data and container definitions are backed up automatically once a day and I also take manual copies of the old images when I update them.

• I've switched to new major versions of Immich and Jellyfin in the process and I'm very pleased with the new releases, amazing great work from the developers, they've been killing it lately.

• I've been tinkering with some custom images that I use for various things like syncing specialized data (logs off FTP services, archive email over IMAP from my mail provider, grab Garmin data copies, run monitors and log parameters to Influx, run port forwarders etc.)

  I typically want to lock down this kind of images as much as possible, so I tweak them towards running with an unprivileged user, remove all caps and only grant strictly necessary ones, make the storage read-only inside the container etc.

• Some needs have been recurring inside this type of containers, like having a decent process manager to keep some things running and restart them, or having a decent cron service. So I've been toying with the idea of making a "universal" image for this kind of thing and maybe publishing it for others to use as a base too. If I get around to it I'll be announcing it here.

Working on a custom rust server / client for self hosted obsidian lifesync. Goal is to be significantly faster than existing solutions as well as being hassle free. Using noise with curve25519 keys instead of HTTPS.

Apart from that I finally figured out why tailscale wasn't working on my pfsense and that enabled me to move the majority of my services to be behind the VPN.

Got my hands on an old laptop. Since I started using nix a little while ago, and want to migrate to NixOS for my servers, this will be the starting point. Started cobbling together some code to commission it as a smart tv platform. KDE Plasma BigScreen is what I'm looking at atm.

I shut everything down only to discover nothing runs on php, while shit was going down at work. And I just recently discovered how to run docker compose updates through Komodo which is great.

Finally got around to self hosting Fluxer (Discord alternative) because they’ve implemented an easy to use setup.

Now I’m trying to optimise the setup for my needs as a backup space if my friends decide to stop using Discord and it’ll be a frictionless changeover.

On a side note; it’s the most containers for a single hosted service that I have. I can’t check the exact number right now but it’s over 10 containers!

I hosted Donetick. It was awful. Everything is processed server-side, which makes it crazy slow. Data should be backed up locally on device. Shame because it seems an otherwise sophisticated software.

i have an asustor nas and i set it up with my hdd raid 1 drives as volume1, and installed my ssd later as volume2. now docker is constantly making my hdds tick and I can't move it to the SSD because asustor don't allow it ☠️ so I'm looking at reeeeaaallly testing my backups, wiping the device and reinstalling everything. It's all in docker so it's theoretically easy enough 🤞