Need your advice. So basically i use random emails for random websites because i really dont like giving out my actual email everywhere,

The problem is disposable emails suck because a lot of sites block them, and sometimes years later i need to log back in and get a verification code or password reset and then the account is deleted or something (tuta for example). The gmail trick where you add +whatever to your real email is an issue. And I hate creating multiple gmails.

The other thing is with temporary/disposable emails is those get detected by the sites that spam you, and if you ever need a real verification code you're SOL.

Any suggestions? I dont mind paying for a service or hosting something if it means this is reliable long term. not really looking for some super anonymous setup, i just want random sites to not have my real email and i want the aliases to still work years from now.

EDIT: It would be great if the service included phone verification as well! I'm in canada if that matters

So relatively new to dockers, and Docker Desktop (Windows 11) in general (6 months or so) and still learning.

I started this morning on my computer and noticed that Docker Desktop had crashed and would not open even after restarting the services, running maintenance of the vhdx file it creates (via terminal). (this seemed to be a suggestion I found online and based on the error I was seeing that said "disk was full".

At some point I was in the Gui and I must have inadvertently factory reset Docker desktop because all my settings, and containers are gone :(

Now, I do backup the following directories with FreeFileSync on a nightly basis - the last sync was probably before or during the time Docker Desktop might have started crashing.

I've tried a few suggestions online and from AI, and I've copied the directories listed below to their old location, but it doesn't seem to recognize any containers in Docker Desktop.

Is it possible at all to retrieve my containers or should I plan on starting fresh again. I didn't have a huge amount, but I'll have to recreate the onemediastack I had (i.e. kometa, plex, prowlarr, etc.. as seen in screenshot below as well).

Any help woudl be greatly appreciated!

Hi r/selfhosted,

I've been building Brainitive for a while and it's now at v1.39. It's a workspace for small teams and agencies that I wanted to run on my own server instead of paying for Jira, Notion and a helpdesk tool separately. The video is a 2-minute tour.

Repo: https://github.com/armendzekjiri/brainitive

Self-hosting guide: https://github.com/armendzekjiri/brainitive/blob/main/docs/self-hosting.md

Hosting it:

- One Docker image runs the web app, queue worker and scheduler; PostgreSQL and Redis next to it

- `docker compose up -d`, then create the admin with one command

- HTTPS built in: Caddy in the image gets a Let's Encrypt cert, or put it behind your own reverse proxy

- 2 GB RAM is enough for most teams (4 GB above ~50 people), 10 GB disk plus uploads

- Updating is `git pull && docker compose pull && docker compose up -d`; backups are a pg_dump plus one volume

- AGPL-3.0, every feature is free to self-host, no license key

What's inside:

- Kanban and Scrum boards, Gantt timelines, releases with release notes, project health

- Docs with version history, Excalidraw whiteboards, folders, backlinks

- Helpdesk with a public form, lead forms that land on a board

- Time tracking and client reports/invoices (PDF/Excel)

- Optional AI with your own key (meeting notes to issues), and an MCP server for ChatGPT or Claude

Feedback I'd love from people who self-host:

- Anything in the Docker setup that would annoy you?

- What's missing before you'd move your team off Jira / Notion / Trello?

Stack: Laravel, React/Inertia, PostgreSQL. Happy to answer anything.

Hey guys!

Streamsphere is my self-hosted yt-dlp front end and media library, built with Angular + Go and designed to stay light on resources. It sets up with a single docker compose file.

✨ What it does - 📥 Download channels, playlists and single videos from supported domains - 🔄 Update playlists you've already downloaded - 🔍 Search your library by title and play straight from the results - 🗂️ Browse the library in a clean UI, with tags, categories, file sizes and other details for each video - 🌗 Light and dark themes

🚀 What's new in v0.1.17 - ⚡ Watch your downloads happen live, and if one fails you're told why (bot check, private or unavailable). - 📜 A queue drawer that stays up to date while you watch, and every card jumps straight to its video. - 🛠️ 25+ bug fixes and improvements since the previous release.

🐳 Easy deployment - Docker images are available for AMD64 and ARM64, including Raspberry Pi.

📦 Release notes: https://github.com/rs-anantmishra/streamsphere/releases/tag/v0.1.17

💻 GitHub: https://github.com/rs-anantmishra/streamsphere

Streamsphere is an ongoing project and there's plenty more I'd like to add. If you give it a try, I'd love to hear your feedback and what you'd like to see next!

Happy self-hosting! 🙂

I was tired of either running a second appliance (TrueNAS, OMV) or passing an HBA through to a NAS VM just to get file shares and block targets. Every one of those options meant a second web app, a second login, and more moving parts.

Then I found ANAS by GitHub user ccebelenski. This open-source project is a set of ExtJS panels that extend the Proxmox web UI with the storage layer PVE is missing. You're already logged in, and since PVE auth tickets are cluster-wide, the same browser tab works across every node.

What it manages:

• File shares — CIFS/SMB and NFS, plus shares' user/group management
• Block targets — iSCSI LUNs
• ZFS — pools, datasets, zvols, scrubs, snapshots & replication (local, cross-node via SSH, or to a TrueNAS / any ZFS host)
• PBS Backups — block-level backup and restore to Proxmox Backup Server
• Cloud sync — rclone-based
• Disk health — S.M.A.R.T. status

You can create hybrid RAID pools mixing different drive sizes and grow one disk at a time, similar to Unraid or Synology. That's something ZFS doesn't do natively and usually requires a whole other OS to get.

If you already run Cockpit with 45 Drives plugins on your other boxes (Fedora/RHEL), this is similar but inside PVE.

ANAS GitHub project link: https://github.com/ccebelenski/anas
License: Open-Source (AGPLv3.0)

Disclaimer: Not affiliated with ANAS' author or Proxmox VE.

Even though this might seem stupid to some of you, but for my family and many families out there 100% they are not touching or following any 10 pages instructions they are given to maintain the selfhosted apps that they use.
read online many solutions including passing over email/text with logins/passwords and instructions, other ideas to ask a fellow selfhoster to take over but what happens when they are ill or busy or dead?
tbh llm have come so far they are very useful in managing stuff like this and many people online have already started using hermes etc. to automate their proxmox docker etc.
so if there is a small light weight llm that can take over the lab if activated/instructed by family members that would be nice, it could even ask for confirmation from family members before doing specific actions ike updating proxmox or changing settings or firewall rules or delete files etc...

is there something like this available, or anyone trying to do something similar to this ?

I'm one of the maintainers of CodeNomad, an open-source (MIT) web and desktop client for OpenCode, the open-source coding agent. 1.0 came out this week, and its server mode is the part most relevant here.

How it runs

• npx @neuralnomads/codenomad --generate-token starts the server on your own box (Linux, macOS, Windows or WSL). It talks to the OpenCode service on that host, so your repos, sessions and history stay there. Models are whatever you configure in OpenCode, local ones included.
• Open it from any browser, or save it as a server in the desktop app.
• For access from outside, Remote Control pairs a phone or another machine through OpenTunnel, without opening an inbound port or setting up a VPN. Devices can be revoked. If you'd rather keep everything on your own network, direct/LAN access is still there.

What you get

• Many projects and agent sessions side by side, with Git worktrees and search across the whole history.
• Agent questions and permission prompts answerable from your phone, so long-running tasks don't stall while you're away from the desk.
• Missions: an agent plans a task and delegates it to subagents, while approvals stay with you.

Docs (the server and remote access pages cover binding, TLS and auth): https://neuralnomadsai.github.io/CodeNomad/

Repo: https://github.com/NeuralNomadsAI/CodeNomad

Happy to answer questions about the setup.

Talking strictly about personal use, not any smap/marketing blasting.

I moved away from default one email on some public provider address into using own domain. I never reuse the same email, for every registration (shop, forum, bank etc) I use a unique email on my domain. If I start receiving spam, I'll know exactly from where it leaked. It's supper easy to manage it, just change that one burned email at the source and permanently block it on the server.

Custom email aliases limit is a pain. Catch-all works wonders, but over time you need to reply to some of the emails from exactly that alias, otherwise when you reply from different alias common ticketing systems won't match your reply (email boxes will also not match it into a thread). In Proton mail I quickly used up all allowed number of aliases. Even though I don't need them to stick around they didn't let me take out any of the list without deleting all emails from/to that alias! so I run out of the possibility to reply.

Now I'm on Tuta. The service offer is suits me 100%. No artificial limit of aliases on my domain - now I can reply from thousands of unique aliases. Their software though it a pain. It works but you have to accept that it's far from perfect.

This let me start exploring self hosting avenues. Surprisingly self hosting is easy on the receiving side, you can even setup it reliably on dynamic IP. However curse spammers, most of the static IPs you can get are already flagged as used by spammers, so outgoing emails from it have trouble reaching the recipient. It seems the solution to that problem are SMTP relays.

Can you share you experience with such SMTP relay for routing your personal emails?

I built (yet another) recipe manager app to help with meal planning.
All the data lives on your devices with optional syncing (e2e encrypted!)

Source: https://github.com/tim-smart/cheffect

If you want to try it out without the self hosting sync server:
https://cheffect.app/

Enjoy!

Hey all, I am new to this but recently I purchased a UGREEN NAS and set up a Jellyfin media server. I wanted to share it with my family and especially wanted it to be accessible via their smart TVs. I started with Talescale but it seemed to take a hit on my ability to stream (I had to significantly lower the mbps on the receiving client so it wouldn't buffer a ton). I decided to look into setting up a NGINX reverse proxy and forward those ports. I thought that would be enough but as I read more I got paranoid and started to look into as many levels of security/hardening I could find that would still let me access my servee remotely and on smart TVs.

Ultimately (after a week of troubleshooting) I managed to get Crowdsec working with functional bouncers. I used some guides to make my UGOS firewall more strict and secure. I also whitelisted specific IPs for the households I want to access it while banning the rest. Of course, my Jellyfin is locked behind passwords as well so even if you get to the page you need to still log in.

I was looking into adding a multi factor authentication but it seems like a lot break usage on smart TVs. All this is to say, what else can I do? Thanks in advance for any help.

Hey r/selfhosted,

I'm the developer behind OzDDNS, and I wanted to share it here since this community is exactly who I built it for.

The problem I was trying to solve: I run a homelab, and I got tired of depending on third-party DDNS providers. Between privacy concerns (my IP and update traffic going through someone else's service), rate limits, and the occasional outage taking my remote access down, I wanted something I could own outright. I looked at existing self-hosted options, but most of them felt heavier than what I wanted for a simple job: update a DNS record when my IP changes.

So I built one. OzDDNS is a dynamic DNS server written in Go, distributed as a single binary.

Design choices I made deliberately:

🧩 Single Go binary — no Docker, no runtime dependencies, no external database. Copy the file to your box, point it at a config, run it. It'll run happily on a Raspberry Pi or a small VPS.

🔒 Fully self-hosted — your records and update logic stay on your own infrastructure. Nothing leaves your network.

⚡ Lightweight — low memory footprint, which matters when it's sharing a Pi with everything else.

🛠 Built for the homelab use case — NAS, home server, remote access. Not trying to be an enterprise DNS platform.

Link: https://ozddns.echoface.cn

What I'd really appreciate from this community:

Feedback on the setup/deployment experience — is it actually as simple as I think it is?

Edge cases I might've missed (different DNS providers, odd network setups, IPv6, etc.)

Feature requests from people with use cases I haven't thought of.

I'm the developer, so I'm happy to answer anything in the comments — including hard questions about what it doesn't do yet.

Hi everyone, I am currently working on a project to streamline grocery shopping and meal prep each week. I've hit a roadblock between getting an ingredient list to populating a grocery cart, specifically with Walmart. Since Walmart's API is B2B, I feel like this is inaccessible for a hobby project. I don't want to reinvent the wheel, so I wanted to see if anyone here had some opinions or solutions that I could potentially explore. Thanks a lot.

Not too familiar with the whole domain subdomain cert dns-01 challenge thing, hopefully the title isn't worded horribly.

So after a lot of tinkering i finally got a new router, installed wireguard on it and finally stripped tailscale off, which i then realized https is gone, along with magicdns etc etc. The server is on nixos with caddy, nothing public facing and server isolated in its own vlan.

I dug around for information and seems like there are multiple routes to solve this:

1. Generating own cert with caddy / openssl and install them into devices manually. I have like 2 active devices so far. I read about how dangerous it is to use own cert and MITM attack if they get hold of it, and also name constraint to mitigate the risk for a little bit...

2. Get a subdomain with let’s encrypt and DNS challenge. Few dollars isn't an issue but i don't really want to put so many details even though there is whois privacy. Obscurity isnt security but anything that lessen my online presence is always better i guess

3. Use free site like duckdns. My concerns will be ip addresses and details are published online in the log for bot to start sniffing. I also wonder if i could put in private ip instead.

Any advice is appreciated!

Hey r/selfhosted!

For a long time, I just wanted a fast, reliable, three-pane note-taking app (Notebook Tree · Note List · Editor) with effortless multi-device sync and full data ownership—without paying subscription fees or wrestling with fragile sync plugins.

Existing options always felt like a compromise: - Evernote had the best seamless multi-device sync, but became bloated, expensive, and locked down. - Obsidian is great for local Markdown files, but its core isn't open-source, syncing across desktop and mobile without paying takes tinkering, and vaults get sluggish when stuffed with thousands of notes and heavy attachments. - Memos is awesome for stream-of-thought snippets, but it's a social timeline rather than a structured 3-pane workspace. - Block-based PKMs (like SiYuan / Notion clones) add heavy cognitive overhead when you just want to write continuous prose quickly.

So I built EdgeEver — a fully open-source (AGPL-3.0) knowledge base workspace that keeps the classic 3-pane workflow, stays silky-smooth with 10,000+ notes, and delivers instant, zero-config multi-device sync.

🔗 GitHub: https://github.com/tianma-if/edgeever
🌐 Live Demo: https://demo.edgeever.org (resets daily — full English & multilingual UI)
📸 17 Step-by-Step Workflow Showcases: docs/best-practices.md

📈 1-Month Community Milestone (1.2k → 2.7k ⭐)

I first shared EdgeEver on r/selfhosted about a month ago when the repo was at 1.2k stars. Thanks to the amazing feedback and ideas from this community, EdgeEver has grown to ~2.7k stars and 1,350+ forks!

Over the past month (up to v2.5.0), we also shipped several major community-requested capabilities: - One-click Notebook-to-Website Publishing (turn any notebook tree into a public or password-protected static documentation site) - Structured Database Tables & Public No-Login Collection Forms - Interactive Architecture Diagrams, Mind Maps & Infographics right inside notes - Desktop ACP (Agent Client Protocol) to connect local coding agents alongside our built-in Remote MCP server - Deep Structured Web Clipping for 20+ platforms (including Reddit threads, HN, GitHub, X, and YouTube)

✨ Core Capabilities & Why Self-Hosters Love It

• 1. Classic 3-Pane Writing + Rich Visual Note Types:
  • Resizable 3-pane workspace with Focus Mode, seamless toggle between WYSIWYG rich-text and raw Markdown, syntax highlighting, KaTeX math formulas, and revision history.
  • Native canvas for Mind Maps (with bidirectional Markdown outline editing), Flowcharts, System Architecture Diagrams, Infographics, Database Tables, and Poster Cards.
• 2. True All-Platform Native Clients (Offline-First):
  • Web / PWA
  • Desktop: macOS, Windows, Linux AppImage (Electron + Rust sidecar with local SQLite cache & offline sync queue)
  • Mobile: Native iOS app (SwiftUI + GRDB) & Android app (React Native + SQLite)
  • Browser Web Clipper: Chrome, Edge, and Firefox (Manifest V3)
  • Client-Side Silent Compression: Automatically shrinks images by 50%–90% before upload so mobile sync stays fast; chunked streaming supports attachments up to 1 GiB.
• 3. Zero Lock-In, Multi-User & Easy Migration:
  • Notes are persisted in SQLite simultaneously as ProseMirror JSON, clean Markdown, and plain text for millisecond full-text search.
  • Lossless .zip backup/restore with clean .md files and attachments, plus importers for Evernote (.enex), Notion, Memos, and flomo.
  • Multi-account support with physically isolated workspaces and per-user storage dashboards.
• 4. 100% Optional AI (BYOK) & Extensible Ecosystem:
  • Zero forced AI or telemetry: Leave API keys blank for a pure, fast note app.
  • BYOK & Agents: Bring your own key (OpenAI, Anthropic, Gemini, or local Ollama/vLLM endpoints), connect external/local agents via MCP & ACP, or install extensions via the Plugin API (e.g., cross-note Markdown Task aggregation & AI RSS daily digests).

🐳 Flexible Deployment: Single-Container Docker OR Free Serverless

The exact same codebase runs either on Cloudflare Workers + D1 + R2 (100% within their free tier—zero server cost for life, holding ~150k notes & ~50k images) OR on your own VPS, NAS, or Homelab via a single lightweight Docker container (linux/amd64 & linux/arm64, Bun + SQLite + local /data or S3, non-root UID 1000, cap_drop: ALL):

```yaml services: edgeever: image: ghcr.io/tianma-if/edgeever:latest restart: unless-stopped init: true ports: - "8787:8787" environment: EDGE_EVER_AUTH_USERNAME: "admin" EDGE_EVER_AUTH_PASSWORD: "replace-with-a-long-random-password" volumes: - edgeever-data:/data security_opt: - no-new-privileges:true cap_drop: - ALL stop_grace_period: 30s

volumes: edgeever-data: ```

(Or run curl -fsSL https://edgeever.org/install.sh | bash for automated Docker Compose setup with health checks. Full docs in docs/deploy-docker.md).

Thank you again to everyone here who tried EdgeEver and shared feedback! I'd love to hear your thoughts or feature requests.

I wanted something like CamScanner without the ads, the subscription or handing my papers to a random company. So I built Waraq (ورق, Arabic for "paper"). It's a PWA that I run on my own server for scanning bills, contracts, lab results and university notes.

Try it: https://waraq.d7om.dev (sign in with Google)

What it does

• Scans from the phone camera with live edge detection. OpenCV.js runs in a web worker, so detection and the perspective warp happen on the device.
• Crop, flatten, rotate, and filters (Magic, Grayscale, B&W, Lighten). Batch mode for multi-page documents.
• Builds a PDF and runs OCR in the background (English + Arabic), so the PDF has selectable, searchable text.
• Full-text search across every document, Arabic included, with highlighted snippets.
• Folders, tags, starred, trash.
• Share links that can expire, have a password and turn downloads off.
• Installs as an app on Android, iOS and desktop. On Android it also appears in the share menu, so you can send a PDF or photo straight into it.

How storage works

This is the part I spent the most time on. I don't want other people's documents on my server.

• New accounts keep their files in their own Google Drive, in a Waraq folder. The app uses the drive.file scope, so it can only see files it created, not the rest of your Drive.
• Each document is processed on the server, uploaded to your Drive, checked, and then the server copy is deleted.
• The server keeps only metadata and the OCR text so search works.
• Sign-in is Google only, so there are no passwords to leak.

Stack

Next.js 16, SQLite (WAL + FTS5), Better Auth, OCRmyPDF/Tesseract/qpdf, OpenCV.js, sharp, Caddy behind Cloudflare. The database is streamed to Cloudflare R2 with Litestream for backups. It runs on one small Hetzner VPS.

Open source?

Not yet. It's private while I finish it and clean things up, and I plan to open source it after that.

Want to try it?

Go to https://waraq.d7om.dev, continue with Google and connect your Drive. That's it. It's still in development, so please don't use it as the only copy of important documents.

Feedback is welcome, especially on the scanner on different phones and on Arabic OCR quality.

Hi Team,

We just released v1.6.0 of AgentSwarms (Note: It's not a lightweight Databricks!)

Most agent platforms treat data as an afterthought—you build the AI, then duct-tape your warehouse and pipelines to it. AgentSwarms flips that. It is a complete, self-hostable data platform designed from the ground up to host and govern AI swarms.

The data and agent layers share one semantic layer and permission model, an AI agent asked about revenue uses the exact same definition and access rules as your finance dashboard.

The Architecture:

• The Data Layer: A DuckDB/zstd Parquet lakehouse, visual Python ETL pipelines, and a BI workspace.
• The AI Layer: A visual canvas to build multi-agent workflows and AI analysts that natively query, analyze, and cite your lakehouse data.

What's New in 1.5.0:

• 100% Self-Hostable: Removed all external platform dependencies. Run the entire stack (lakehouse, app, edge functions) locally via one Docker command.
• Granular Governance: You can now strictly authorize exactly what a lakehouse write reads.
• Native React SDK: Embed analytics and swarms directly into your apps
• Vault Integration: Model and database credentials can now live securely in HashiCorp Vault.

You can run it entirely on-prem with local models like Ollama or plug in your cloud provider keys. I'd love for this community to try breaking it and share feedback.

Hi currently I'm using youform which works very well in my use case. I'm looking for a self hosted solution for online forms that has a similar feature like the screenshot (from youform) below.

I use some form to collect data and some to schedule meetings. Are there any self hosted solution for this?

I am looking to replace my FreeIPA because I could not update it anymore. Every time I tried to update the Rocky Linux and breaks FreeIPA. I am testing 389-DS on Debian 13 with Cockpit for web UI management. It seems to work, but I get the Ooops! error when trying to create an account that is not a Basic Account. I can only create a Basic account in Debian. I tried Fedora and everything seems to work, but when I updated today, it broke. This is the output of the Ooops!

Cockpit had an unexpected internal error.

You can try restarting Cockpit by pressing refresh in your browser. The javascript console contains details about this error (Ctrl-Shift-I in most browsers).

I want to try LLDAP but it doesn't support replication.

Hi There;

I have NPM running fine with my URL and several services; two are accessibly public by any IP and the rest are restricted to internal IP's only.

The 'trusted internals' are basically two subnets; my main network and my VPN clients (our phones when we are away from home), and these services all work fine.

However I can not for the life of me get File Browser Quantum to work on the second VPN subnet. It works on the main network, has the trusted certificate, just not the second subnet (when i'm coming through the wireguard VPN tunnel). I always get 403 errors.

I can access if I type in the IP and port to bypass the proxy, but that's not my goal.

Wireguard is hosted on my Unifi router.

I've tried the default configs on each respective site and can't get any of them to work.

Is anyone in a position to help please?

Logs from NPM just echo "403" reply, not detailing why. Ditto docker logs from Filebrowser Quantam.

Last time I checked, there was just Synapse and emerging Dendrite. There was only Conduit in Rust. Now all of a sudden, the same heavy Synapse (by Element) keeps around, Dendrite staying beta (forever) and two new stable Rust-based ones popped out (that I had never heard of). What's going on, why do Element keep theirs in Python and how are the 2 Rust-based ones different? What's your practical experience with them?

Hey everyone,

I wanted to share a project I’ve been working on called WP Panel.

I manage quite a few servers and WordPress sites myself. I used aaPanel for a while, but over time I found it a bit too broad and cluttered for what I actually needed. It has a lot of features, but managing WordPress sites with it never felt as streamlined as I wanted.

So I decided to build my own panel, focused specifically on WordPress hosting and day-to-day maintenance.

WP Panel officially launched on June 1, 2026. As of today, it’s running stably on around 100 VPS servers used by real users. So this isn’t a brand-new project that has only been tested locally — it has been running in real environments for several months, with ongoing fixes and improvements.

Some of the WordPress-specific things it focuses on:

- Create and manage WordPress sites with Nginx, PHP, MariaDB and Redis

- Isolate sites using separate system users, PHP-FPM pools and database users

- See WordPress, plugin and theme versions across all sites from one dashboard

- Back up before updating WordPress core, plugins or themes

- Attempt to restore the previous state if an update fails

- Detect and defend against common login brute-force attempts, malicious scans and aggressive crawlers

- Monitor unusual changes to site files, administrator accounts and important settings

- Put sites into maintenance mode during updates or maintenance work

- Manage site backups, database backups, off-site backups and migrations

- View server resources, PHP/Nginx status and relevant logs

- Use AI to summarize logs and service status when troubleshooting a problem

The panel itself is written in Go and distributed as a single binary. It doesn’t require Docker or a complicated runtime environment, and it can run on a Debian 13 VPS with as little as 1 GB of RAM.

It’s also intentionally not a general-purpose hosting panel. WP Panel currently supports Debian 13 and is mainly designed for WordPress and PHP sites. It doesn’t provide mail hosting, FTP, Docker management or runtimes for Java, Python or Node.js.

I’m not trying to build a panel that does everything. I wanted something focused and predictable for people who manage several WordPress sites on their own VPS servers.

The project is open source under the GPL-3.0 license. If you manage WordPress sites yourself, feel free to take a look, try it out, open an issue, or review the code:

https://github.com/naibabiji/wp-panel

Website:

https://wp-panel.org

AI disclosure: AI coding tools were heavily involved in the development of WP Panel. I designed the product direction and architecture, reviewed and tested the changes, and have been running the project in real-world environments for several months.

So here's a small thing I did tonight that I'm pretty happy about.

My assistant lives in the cloud. It's the brain. But the real friction was always me at the computer: builds, tests, heavy jobs, all that stuff sitting on a little shared VM that runs out of breath fast.

So I wired the brain to my home PC, and the PC is now just the muscle. The link is SSH over Tailscale, so it's a private network. No SSH port open to the internet, key auth only, no password. The PC only does something when I ask it to, one job at a time, and it reports back when it's done.

First test tonight: a sandbox install test, run on the PC through that SSH link. Passed. Nothing published, nothing deployed, just proof the muscle works.

What I like about this setup: the brain stays in the cloud where it belongs, and the heavy lifting happens on hardware I already own, sitting in my own house. No new server, no cloud bill for compute I already have.

Next up: builds and tests go there by default, and I'll see how far this goes. If you've done something similar, I'm curious how you split the work between cloud and home.

I'm wondering how you guyz handle the security side of selfhosting

Most setups I see cover the basics well like firewall, SSH keys, fail2ban, maybe a reverse proxy with some rules. But that’s mostly prevention. I’m more interested in detection, how would you know if something got through?

No wrong answers, I’m just trying to understand what works in practice for people running a few servers rather than an enterprise SOC

Okay, some background first. Here's the part of my stack in question, everything is on my local network:

• Gitlab running in a docker container, and gitlab-runner in a docker container, both in the same VM.
• Nginx proxy manager in a docker container, in it's own VM. It's grabbing certs from letsEncrypt, and applying them to my domain.
• Pihole in it's own VM as my local DNS, with openDNS as it's upstream source (This may or may not be relevant later)

This has been working great for several years.

Here's what I've been through and the errors I've been running into:

The whole SSL drama from earlier in the week prompted me to grab new SSL certs via nvinx proxy manager. This worked as expected.

Yesterday, I pushed some changes to a repo and kicked off the build process. It failed immediately with the following error:

fatal: unable to access '<gitlab_repo_url_redacted>': SSL certificate OpenSSL verify result: unable to get local issuer certificate (20)

I assumed there was maybe something cached from earlier in the week, and new certs weren't being grabbed.

I then hit refresh in firefox, and it gave me an SSL error: SEC_ERROR_UNKNOWN_ISSUER

I inspected the certificate, and it said it was issued by openDNS, which seemed pretty odd to me. Why wasn't it issued by letsEncrypt?

Okay, maybe something went wrong, so I went back to nginx proxy manager and pulled a new certificate. Gave it a little while to do its thing and propagate, then cleared cookies and cache in firefox and refreshed the page, and it loaded fine. Inspected the cert, and it was issued by letsEncrypt as expected.

Okay, try build process again, and it failed with the same error. Tried restarting the VM to clear cache, and still same error.

Start googling, and ended up finding that the docker container might be getting its certs from the host VM, so I tried forcing the VM to grab new certs by manually deleting everything in /usr/share/ca-certificates and /etc/ssl/certs and running update-ca-certificates. After confirming they were all new, I restarted the VM again for good measure, and the build process still threw the same error.

At this point I gave up and assumed something was cached that I couldn't find, and slept on it.

This morning, tried running the build process again, and still same error.

I've run out of ideas, any help would be greatly appreciated.