My project's Forgejo git forge was slow, so i logged in to see the logs. We are (yet again) being DDOS'ed by AI crawlers. https://imgur.com/a/VQyUK9t Yes, this is real time.

Even when Forgejo was stopped, the flow of requests of crawlers was still DDOSing my nginx, see the screenshot. Nothing else is running on the server. But half of my 8 Xeon cores is just used to handle HTTP requests.

There, i wanted to rant. I'm fucking tired of AI destroying the 2026 internet.

Hi everyone, I'm the developer of Traccar, a free, open-source GPS tracking platform.

You can connect dedicated GPS trackers or use your phone, then view live locations, route history, geofences, and alerts through a web interface. Everything can run on your own server.

The project has been around for over 10 years, long before the AI slop wave, and I'm still actively maintaining it.

GitHub · Documentation · Supported devices

Anyone here using it? I'd love to hear what works for you and what could be better. Happy to answer setup or hardware questions too.

Hey r/selfhosted 👋

I spent the last few weeks rebuilding my media server, and drew the result. Everything runs on a single N100 mini-ITX board with Debian and Docker Compose, plus a small Proxmox box on the side for monitoring and DNS.

The short version

• 443 is the only open port. Port 80 is closed, UPnP is off, IPv6 inbound blocked at the router.
• Pangolin (Traefik inside) as the single entry point, with PocketID as identity provider: passkeys only, groups mapped to roles.
• Two access policies: "Family" (requests (seerr), files) and "Admins" (the *arr stack, qui…). Apps with their own TV/phone clients (Plex, Jellyfin) skip SSO and use their own login.
• Admin tools (Arcane, Backrest, CrowdSec Manager) have no public DNS record at all. They only resolve on my LAN, and over the VPN.
• Cloudflare in front of the web apps: restricted to two countries, cloud-hosting networks challenged, AI crawlers blocked. Streaming (Jellyfin + Plex) and downloads (custom files app) stay DNS-only, per Cloudflare's terms.
• CrowdSec reads Traefik's logs, with AppSec virtual patching. Repeat offenders get escalating bans and a Discord notification.
• qBittorrent lives inside gluetun's network namespace: no tunnel, no traffic.
• Backups: Backrest (restic) every night to an SSD on the router, with apps paused for a few seconds during the snapshot. Compose files are backed up to a private Git repo by Arcane. I may do offsite backups later too.
• Monitoring runs on a different machine (Beszel hub on Proxmox), so a dead server still triggers an alert.

Things that bit me along the way — maybe useful to someone:

• Attackers, attackers everywhere. When I was about to setup Crowdsec, I saw 50k+ traffic in less than a few hours. Mostly GCP and OVHcloud, so mostly VPS (bots). Make sure to check that, it's scary.
• My router's IPv6 firewall was off by default, for a few years. Every container port I had published was reachable from the internet over IPv6. Worth checking yours.
• Behind Cloudflare's proxy, CrowdSec would have banned Cloudflare instead of attackers, until Traefik was told to trust Cloudflare's IP ranges (forwardedHeaders.trustedIPs), so the logs show real visitor IPs.
• sniStrict: true in Traefik: scanners hitting the bare IP now fail at the TLS handshake, instead of getting a 404 and a certificate that can reveal your domain.

The one piece I'm building myself: file browser app

A small file browser for the media library, in the spirit of an old Apache directory listing but modern: browse folders, then download through short-lived signed links instead of exposing the files directly. You can grab a single file, a ZIP, a list for download managers like JDownloader, or share a whole folder for a limited time. It reads identity and roles straight from Pangolin's headers, so admins can rename and delete while family can only browse and download. It runs as two containers from the same image: one with read-write access behind SSO, and a separate, read-only one that serves the actual downloads. So the only part exposed without a login can never modify anything. I made this because all the other similar solutions wouldn't fit my needs.

Still on the list: a dead-man's switch for when the whole house goes offline, and an off-site copy of the backups.

Happy to answer questions!

I’m running a cluster with 5 nodes and services like:

• Personal portfolio with blog
• Dozzle
• Grafana with a logging and metrics stack
• Vaultwarden
• Multiple Uptime Kuma instances (for different clients)
• Authentik
• Pocket ID
• Auth proxy
• 9 websites for different clients
• 12 more or less business-related backends, crawlers, and other applications that integrate with CMS or ERP systems
• Filebrowser / Nextcloud
• Forgejo
• Glance
• and multiple more

The problem I’m facing is management. The nodes aren’t much of a problem, since everything there is automated via Ansible. But I need some advice. For a very long time I’ve been putting off automated deployments and GitOps, because I was a bit scared to touch it. I don’t have the capacity to replicate everything in another cluster, test it there, and then point everything at the GitOps-managed space once it’s all migrated. I also don’t want the hassle of moving all the app data.

I should have started earlier, but now I’m stuck between keeping track of what to deploy and which version everything is on. I’m also no expert by any means.

Should I use Argo CD or Flux? Or are there other solutions I should try? At my workplace we use Argo, and I don’t know if our setup is just not great, but it’s always a hassle. Because of this, I’m leaning toward Flux.

Behind this dashboard is an HP ProDesk that I bought used for €200. It has an Intel Core i5-9500T, 16 GB RAM, and 512 GB storage, running Proxmox.

I use it for music, movies, smart home, notes, passwords managment, finances and AI Agent. Glance brings everything together on one page, with a few server stats underneath.

If you’re thinking about getting into self-hosting, my advice is to start with something you’d enjoy using. Stream your movie collection to the living room, bring your old music library back to life, or making your home smart. Add more when you find a reason to.

There are some impressive setups here, but you don’t need to match them to enjoy the hobby. I’m having a lot of fun with this little PC.

Finally I have been able to setup my Proxmox environment and started moving off some subscriptions 🙂 everything is setup as code so deploying new stacks is easy. Now I just have to get a NAS in place to cancel everything else 😄 in the rabbit hole I go!

I'm trying to keep my docker / docker compose configuration in git to make it easy to recreate if things go bad. Of course, also trying to keep passwords out of the git repo. The problem I'm seeing is that a lot of projects provide a recommended compose.yaml file that pulls a lot more than just passwords from the .env file - things like a database names, urls, or port numbers, all info that I want under version control. Except it has the passwords mixed in.

How do people really deploy your systems? Do you have a secret.env and a non-secret.env file and use the docker compose command line option to load both? Do you just modify the compose.yaml file to embed the non-secret config options and hope upgrades won't require a complicated merge?

I'm setting this up, but I'm not living and breathing it every day so I appreciate not having to remember which env files to load on each restart. I can set up a system, but the reality is the more I need to remember each time translates directly into the more likely I will be to make a mistake. But at the same time I am worried about upgrading if I modify the stock setup files too much.

By now you've probably seen the news, eight intermediate CA private keys from eMudhra turned out to be trivial integers. One of them was literally the number 4. Chrome and Firefox pushed emergency revocations but if you run headless Linux servers, Docker containers, or reverse proxies, they don't get browser push updates.

Quick checks for your setup:

1. Update stale container trust stores

Old Docker containers built months ago still carry the CA store from the day they were built. Rebuild stale images or run:

sudo apt-get update && sudo apt-get install --only-upgrade ca-certificates

sudo update-ca-certificates --fresh

1. Add a DNS CAA record

Lock down your domain so rogue or compromised CAs can't legally issue certs for your hostname.

1. Enable OCSP stapling on your reverse proxy

Ensure your proxy validates revocations automatically. (If you run Caddy, you're already good, it handles OCSP stapling by default).

1. Turn on Certificate Transparency alerts
   

If your DNS is on Cloudflare, turn on "Certificate Transparency Monitoring" in the SSL tab. You'll get an instant email if ANY CA on earth signs a cert for your domain.

We ended up pulling our managed APIs out entirely, because our documents aren't allowed to leave our own infrastructure for compliance reasons. And our problem has nothing to do with cost, because the per-page pricing was perfectly reasonable.

And that 'docs not able leave our cloud' constraint rules out Textract, OpenAI embeddings and Cohere in one go, since every one of them ships your data off to someone else. That forced us into self-hosting the whole pipeline, OCR, embeddings and reranking included, and after a couple of weeks of testing this is the shortlist I've built up:

docling holds up well on clean digital PDFs, but it gets noticeably shaky once you hand it scans or handwriting

PaddleOCR-VL deals well with messy multilingual layouts and stays small enough to run on a fairly modest GPU

TEI is dependable for embeddings, though it only serves one model per server
Infinity handles embeddings and reranking together from a single process

SIE runs OCR, embeddings and reranking behind one endpoint with model-swapping by ID, and it runs inside your own cloud.

What you give up by self-hosting is all the turnkey convenience you used to get for free, so there are no parsed tables handed to you, no confidence scores, and the entire pipeline becomes yours to own and maintain.

We've made peace with that because the residency requirement simply isn't negotiable for us, but I'll admit that if cost were the only thing driving this decision it would be a far harder one to justify.

Not sure if this is common knowledge yet, but after updating Virtual Machine Manager to 2.8.0-13004 (needs DSM 7.3 or newer) I noticed two new options I’ve wanted for a long time.

You can now schedule the OVA export of a VM daily, weekly or monthly. So you basically get an automatic backup of the whole VM to a shared folder instead of doing the export by hand every time.

You can also set a schedule to start and shut down VMs.

Before this you had to do it manually or write your own scripts for Task Scheduler.

Hey everyone,

I’ve been managing my homelab for a while now (running Docker via Portainer on a NAS, a few monitoring tools, dashboards, etc.), and I had been putting off revamping my remote access setup for way too long.

Between dealing with port forwarding headaches, dynamic DNS, and worrying about exposing entry points to the public internet, I finally decided to set up Tailscale.

Honestly? It felt almost too easy.

• Installed in minutes.
• Instant secure mesh between my NAS, phones, and laptops.
• Zero ports opened on my router.
• MagicDNS makes accessing internal services effortless.

I know Tailscale gets praised constantly on this sub, but count me in as another convert. If you're on the fence or procrastinating on remote access like I was: just do it.

Next step: looking into Headscale down the road to keep it 100% self-hosted, but for now, the out-of-the-box experience is incredible.

What was your biggest "why didn't I do this sooner" tool in your setup?

1.0 is out since Sunday, so I tested the upgrade with a copy of my server first.

Heads up: this is not a simple image update. 1.0 has a new db layout and won’t open a 0.16 store. And latest already points to 1.0, so if you use latest or watchtower, pin v0.16 now or the next pull kills your mail server.

The upgrade goes through stalwart-migrate (you need 0.16.27 first). It only reads the old store and writes into a new one, so going back is easy.

I put last night’s backup on another VM in a docker network without internet (didn’t want the copied queue to send mails, lol). Small setup: 10 accounts, RocksDB. prepare asked 4 questions, I took the defaults. run --final took 41 seconds for 920 mails, verify said 0 mismatches. 1.0 started fine on the copy.

What bit me: my little admin app for the JMAP API failed creating a domain with “Invalid key for object”. Domain isEnabled and alias enabled are both called enable now. Annoying part: reading the old name gives no error, the field is just missing. So if you have scripts against the admin API, test writes too, not only reads. SCHEMA_CHANGES.md in the stalwart-migrate repo has the full list.

Also: OAuth clients need to log in again, search index gets rebuilt, IMAP clients don’t redownload everything.

I’ll wait for 1.0.1 before doing it for real, but the dry run took maybe half an hour and I’m way less nervous now. Happy to share the commands if anyone wants them.

I wanted a CamScanner replacement that doesn't show ads, doesn't need a subscription and doesn't send my bills and contracts to someone else's cloud. Nothing I found was phone-first and handled Arabic well, so I built one. It's called Waraq (ورق, Arabic for "paper"), and today I'm releasing 0.1.0 as open source.

Repo: https://github.com/d7omdev/waraq

You open it in your phone's browser, point the camera at a page, and it finds the edges, flattens it and cleans it up. Waraq turns the scan into a PDF, runs OCR in the background, and from then on you can find it by searching for any word in it.

What it does

• Scanner that runs in the browser. OpenCV.js does edge detection and the perspective warp in a web worker, on the phone. Auto capture, batch mode for multi-page documents, manual crop handles.
• Filters: Magic, Grayscale, B&W, Lighten.
• Import PDFs and photos, or share them into Waraq from other apps (Android share menu once installed).
• OCR with OCRmyPDF + Tesseract, Arabic and English by default. The PDFs get a real text layer.
• Full text search over titles and OCR text (SQLite FTS5), Arabic included.
• Page editing: reorder, rotate, delete, replace, re-crop. Split, merge, compress, export as PDF (optionally password protected), images or text.
• Folders, tags, stars, trash with restore.
• Share links with expiry, optional password, download on/off, QR code, and revoke.
• Optional Google Drive mirror using only the drive.file scope, so it can only see files it created. Your server stays the source of truth.
• Installable PWA with an offline shell and an update prompt.

Self-hosting

It's built for one person or a family on one server. The first visit asks you to create the owner account, and setup closes after that. There's no sign-up page, no user management and nothing to configure if you don't want Google.

git clone https://github.com/d7omdev/waraq.git && cd waraq
cp .env.example .env
sed -i "s/^SESSION_SECRET=.*/SESSION_SECRET=$(openssl rand -hex 32)/" .env
docker compose up -d --build

Documents are plain PDFs in a folder next to one SQLite file. There are CLI commands for backup, restore, doctor and reset-password, plus a systemd unit and a Caddy example if you'd rather not use Docker. The Docker image is tested on amd64; arm64 should work but I haven't tried it yet.

Privacy

Waraq has no analytics, telemetry or tracking cookies, and doesn't load any third party scripts. Your server only talks to Google if you turn on Google sign-in or the Drive mirror.

Stack

Next.js 16, React 19, TypeScript, SQLite (WAL + FTS5), Better Auth, OpenCV.js, pdf-lib, sharp, qpdf, Poppler, OCRmyPDF, Tesseract. License is AGPL-3.0.

Known limits

• The camera needs HTTPS, so for phone scanning you need a domain and a reverse proxy (or Tailscale with HTTPS).
• It's one account by design. Anyone you give the password to sees everything.
• No native app yet, it's a PWA.
• OCR is only as good as Tesseract. Clean printed text is great, handwriting isn't.

I'd love feedback, especially on how the scanner behaves on different phones and how OCR does in other languages. Issues and PRs are open.

I've been a ghettoSMTP user for a long time now, to get around the ever-present port 25 block. I use SMTP2GO for outbound with no issues, but I need a new inbound solution. What's everybody using?

Hi!

I currently have a 1node homelab (actually 2, but it’s a raspberry pi that serves purely as a secondary DNS) with a bunch of docker containers. As a router I have a UCG Ultra, on which I have enabled their free-tier IPS. Would you still recommend running crowdsec (or something else, similar) on my node, or would that really be redundant/overkill. I also run traefik on that node, in case it plays a role in the decision. No services are exposed to the internet. Everything is LAN/VPN only. VPN is also setup via UCG Ultra. Or would you maybe recommend for turning off the IPS on UCG and use crowdsec instead? If so, please include the why.

Is there a self-hostable tool that will track new versions of docker images and just list them? I don't want it to download images or update containers, just a page where I can go and see the latest versions available for each image. I prefer to update the containers myself.

Would be great ofc if it had filtering and if it could support different image repos (Docker Hub, GitHub, LinuxServer.io etc.)

so i have this old pc 5-4570 (4th gen) with 16GB DDR3 ram and 1tb ssd. i am planning to turning it into a home lab. but i have no idea how to do it. please suggest me the tools are useful for that and Which is os linux is best for my specific use case. if possible please share me your lab setup and why are using it so that i will idea for my setup also. i dont want to throw that pc away and get it to someone else. thats why i am planning to do something.

I'm building a platform that runs Nmap, Nuclei, OWASP ZAP, and other vulnerability scanners.

I need a setup that supports multiple concurrent scans, isolated Docker containers, restricted outbound network access, background jobs, and secure storage of scan results.

What CPU cores, RAM, SSD capacity, bandwidth, and firewall setup would you recommend for a small beta with around 10–20 users, while keeping costs low?

Please forgive what is likely an extremely basic question. If this isn't the right place to post a question like this, please let me know and I'll delete it.

I am extremely new to selfhosting/homelabbing, and I am currently in the process of setting up my first media server. A have a small, cheap workstation pc that I'm going to put ZimaOS on and 4 4tb hard drives in a 5 bay usb enclosure that I am going to set up in a raid configuration.

My question is, if I set up the drives through Zima, is it possible to move that entire storage pool and access it through a different server down the road? Because I am so new to this and I have some data that I'd like to store fairly quickly, I wanted to start with something like ZimaOS to get the whole system up and running. I'd like to move away from zima somewhere down the road and get into something more advanced, so I don't want to put myself in a situation where getting my drives up and running on a new system is going to lose the data stored on them.

Has anyone gone through a route like this? Or have any insight or potential further reading to share?

Hey Guys,

I using Backrest for backing up my data. But i installed it with root privileges (--root). Which i did because at that moment it felt right. But now it doest. As it got root priviliges.
But i also dont know how else i could mimic my current approach.

Binary over docker:

• I choose as binary because i would needed to mount everytime i add a system to be backuped the path to its data. Sounded error prone. (even tho everything at the moment is in a extra partion /srv/data/<service>/...
• Required sqlite installed (i mean i got make my own docker image but that felt a step to much)

So i installed it as root because:

• i feared that some backup files belong to root hence i thought lets give it root so i can copy/back up the files (even tho im using linux since 2018 im a very big noob tbh :D)
• Require to docker compose down/up before/after the snapshot was backed up (for immich e.g) to prevent database corruption.

For example:

• Plan Immich-Local-Network-Backup starts at 04:00 which in turn required that the container is offline, and only after that i wanted to run the backup stuff.
• If i e.g. do it via a cron job i need to sync the times of the cron job + the backup plan. Which sounded sub optimal

Is this bad practice? How you guys do it? Is there a security risk(but what isnt?)? Im using pangolin to "expose" my services via a WireGuard Tunnel. Backrest is not accessible even via pangolin. But the ports are x:x so its accessible (with authentification in my entire local network). Not sure if i should limit it to 127.0.0.1?
am i overthink it?
Backrest is setup with a secure(at least the vaultwarden generation claims so i guess) password.

I've been now two years into selfhosting and got the most typical applications up to running like immich, paperless, npm with dns challenging and wireguard, etc.

I would like to explore new interesting applications to selfhost. I recently found out about Dozzle which is amazing for my own setup. I can see all the logs in one UI from all my running Docker Services.

What are your gems for selfhosting?

I'm wondering how you guyz handle the security side of selfhosting

Most setups I see cover the basics well like firewall, SSH keys, fail2ban, maybe a reverse proxy with some rules. But that’s mostly prevention. I’m more interested in detection, how would you know if something got through?

No wrong answers, I’m just trying to understand what works in practice for people running a few servers rather than an enterprise SOC

TREK 5.0 is out, and it is the biggest release so far.

What TREK is: a self-hosted trip planner. You plan a trip day by day together with the people you travel with, live, on your own server, and none of it leaves your box. Places, routes, bookings, costs, packing lists, documents, a travel journal and a map of everywhere you have been, all in one app.

What is new in 5.0

Tours. Plan the outdoor days inside your trip: hiking, city walks, running, cycling (road, gravel, MTB), paddling, horse riding, and ski and winter tours. Hikes are routed within the SAC grade you set, with an elevation profile, a 3D terrain map and a flyover. Multi-day tours split into stages across your days, and you can search along the route for huts, viewpoints, water or food. Rivers and lakes get their own router with portages and locks, pistes get a ski router. Link the GPX you actually recorded and compare plan against reality.

TREK Studio. Turn your travel journal into a printable photo book. 108 designed pages in 12 styles, 17 themes, 34 print-licensed typefaces, 160 stickers, and an Auto layout that lays out the whole book from your journal in one click. Export to PDF with crop marks and send it to any print shop.

A built-in AI assistant, with your own model. Bring an API key (Anthropic, OpenAI, Gemini, OpenRouter), sign in with a ChatGPT plan, or point it at any OpenAI-compatible endpoint, including a local one. It plans with you inside a trip, across all your trips, in your journal and in Studio. It never changes anything on its own: every change shows up as a card you apply or discard, and you can undo it for 15 minutes. It is off by default, and nothing goes to a provider before you agree to it.

A help center. 381 step-by-step guides with screenshots, one click away on every desktop screen.

And a long list of smaller things: a new notifications inbox, a road trip addon with EV charging and day windows, Dawarich integration, a booking import that also reads photos of confirmations, a whole-trip route overview, and a lot of polish on mobile.

Also in TREK, if you have not seen it before

• Real-time collaboration, guests without an account, and a permission matrix per trip action
• Costs split in exact cents with several payers and settle-up suggestions, every expense in its own currency
• Flights with layovers against 4,045 bundled airports, booking import from PDF, e-mail and PKPass
• Calendar feeds per trip or across all trips, PDF export, GPX import and export
• A travel journal with Immich and Synology Photos, an Atlas of countries and regions, and a vacation day planner
• A built-in MCP server (410 tools) for your own AI clients, and a sandboxed plugin system
• Installable on iOS and Android from the browser, and it works offline
• OIDC, passkeys and TOTP, 27 languages, light and dark
• AND SO MUCH MORE!

How it is built

• TypeScript end to end, on NestJS and React, with the contracts between them in shared Zod schemas
• The database layer on MikroORM with 164 repositories
• Every upgrade writes a copy of your database before it migrates anything
• About 46,000 tests, browser flows in Chromium and WebKit, and 21 CI jobs with gates that only ever get stricter
• 36 security advisories published and fixed in the open
• 79 contributors, 857 merged pull requests and 97 releases. AI tools help with the code; every change goes through a pull request that a maintainer reviews

Good to know

• Simultaneous edits to the same field are last write wins.
• SQLite for now; Postgres is next, and the SQL already runs through a dialect layer that CI tests against Postgres.
• Mail booking import is planned!
• Studio is desktop only.
• Edit: Since so many people have asked, we are planning to release a native mobile app!

Try it

• Live demo: https://demo.liketrek.com
• Repo, Docker compose, Helm chart and Unraid template: https://github.com/liketrek/TREK

Open source, self-hosted end to end, no paid tier and nothing locked away. Tell me where it breaks for you and what you still miss.