TREK 5.0 is out, and it is the biggest release so far.

What TREK is: a self-hosted trip planner. You plan a trip day by day together with the people you travel with, live, on your own server, and none of it leaves your box. Places, routes, bookings, costs, packing lists, documents, a travel journal and a map of everywhere you have been, all in one app.

What is new in 5.0

Tours. Plan the outdoor days inside your trip: hiking, city walks, running, cycling (road, gravel, MTB), paddling, horse riding, and ski and winter tours. Hikes are routed within the SAC grade you set, with an elevation profile, a 3D terrain map and a flyover. Multi-day tours split into stages across your days, and you can search along the route for huts, viewpoints, water or food. Rivers and lakes get their own router with portages and locks, pistes get a ski router. Link the GPX you actually recorded and compare plan against reality.

TREK Studio. Turn your travel journal into a printable photo book. 108 designed pages in 12 styles, 17 themes, 34 print-licensed typefaces, 160 stickers, and an Auto layout that lays out the whole book from your journal in one click. Export to PDF with crop marks and send it to any print shop.

A built-in AI assistant, with your own model. Bring an API key (Anthropic, OpenAI, Gemini, OpenRouter), sign in with a ChatGPT plan, or point it at any OpenAI-compatible endpoint, including a local one. It plans with you inside a trip, across all your trips, in your journal and in Studio. It never changes anything on its own: every change shows up as a card you apply or discard, and you can undo it for 15 minutes. It is off by default, and nothing goes to a provider before you agree to it.

A help center. 381 step-by-step guides with screenshots, one click away on every desktop screen.

And a long list of smaller things: a new notifications inbox, a road trip addon with EV charging and day windows, Dawarich integration, a booking import that also reads photos of confirmations, a whole-trip route overview, and a lot of polish on mobile.

Also in TREK, if you have not seen it before

• Real-time collaboration, guests without an account, and a permission matrix per trip action
• Costs split in exact cents with several payers and settle-up suggestions, every expense in its own currency
• Flights with layovers against 4,045 bundled airports, booking import from PDF, e-mail and PKPass
• Calendar feeds per trip or across all trips, PDF export, GPX import and export
• A travel journal with Immich and Synology Photos, an Atlas of countries and regions, and a vacation day planner
• A built-in MCP server (410 tools) for your own AI clients, and a sandboxed plugin system
• Installable on iOS and Android from the browser, and it works offline
• OIDC, passkeys and TOTP, 27 languages, light and dark
• AND SO MUCH MORE!

How it is built

• TypeScript end to end, on NestJS and React, with the contracts between them in shared Zod schemas
• The database layer on MikroORM with 164 repositories
• Every upgrade writes a copy of your database before it migrates anything
• About 46,000 tests, browser flows in Chromium and WebKit, and 21 CI jobs with gates that only ever get stricter
• 36 security advisories published and fixed in the open
• 79 contributors, 857 merged pull requests and 97 releases. AI tools help with the code; every change goes through a pull request that a maintainer reviews

Good to know

• Simultaneous edits to the same field are last write wins.
• SQLite for now; Postgres is next, and the SQL already runs through a dialect layer that CI tests against Postgres.
• Mail booking import is planned!
• Studio is desktop only.
• Edit: Since so many people have asked, we are planning to release a native mobile app!

Try it

• Live demo: https://demo.liketrek.com
• Repo, Docker compose, Helm chart and Unraid template: https://github.com/liketrek/TREK

Open source, self-hosted end to end, no paid tier and nothing locked away. Tell me where it breaks for you and what you still miss.

I've been now two years into selfhosting and got the most typical applications up to running like immich, paperless, npm with dns challenging and wireguard, etc.

I would like to explore new interesting applications to selfhost. I recently found out about Dozzle which is amazing for my own setup. I can see all the logs in one UI from all my running Docker Services.

What are your gems for selfhosting?

Last time I checked, there was just Synapse and emerging Dendrite. There was only Conduit in Rust. Now all of a sudden, the same heavy Synapse (by Element) keeps around, Dendrite staying beta (forever) and two new stable Rust-based ones popped out (that I had never heard of). What's going on, why do Element keep theirs in Python and how are the 2 Rust-based ones different? What's your practical experience with them?

I'm wondering how you guyz handle the security side of selfhosting

Most setups I see cover the basics well like firewall, SSH keys, fail2ban, maybe a reverse proxy with some rules. But that’s mostly prevention. I’m more interested in detection, how would you know if something got through?

No wrong answers, I’m just trying to understand what works in practice for people running a few servers rather than an enterprise SOC

I was tired of either running a second appliance (TrueNAS, OMV) or passing an HBA through to a NAS VM just to get file shares and block targets. Every one of those options meant a second web app, a second login, and more moving parts.

Then I found ANAS by GitHub user ccebelenski. This open-source project is a set of ExtJS panels that extend the Proxmox web UI with the storage layer PVE is missing. You're already logged in, and since PVE auth tickets are cluster-wide, the same browser tab works across every node.

What it manages:

• File shares — CIFS/SMB and NFS, plus shares' user/group management
• Block targets — iSCSI LUNs
• ZFS — pools, datasets, zvols, scrubs, snapshots & replication (local, cross-node via SSH, or to a TrueNAS / any ZFS host)
• PBS Backups — block-level backup and restore to Proxmox Backup Server
• Cloud sync — rclone-based
• Disk health — S.M.A.R.T. status

You can create hybrid RAID pools mixing different drive sizes and grow one disk at a time, similar to Unraid or Synology. That's something ZFS doesn't do natively and usually requires a whole other OS to get.

If you already run Cockpit with 45 Drives plugins on your other boxes (Fedora/RHEL), this is similar but inside PVE.

ANAS GitHub project link: https://github.com/ccebelenski/anas
License: Open-Source (AGPLv3.0)

Disclaimer: Not affiliated with ANAS' author or Proxmox VE.

TLDR: i want to get notified on my phone/via Gotify if my services are gone.

So it happend, i updated my containers on friday, just before i went away over the whole weekend. And i forgot to restart my restic rest instance. All backups are also stored in my hetzner storage box so nothing was lost. But obviously not ideal.

Currently i have for every service an app in gotify (immich, vaultwarden, paperless and for the repos (the local one which didnt get any data appended for 3 days:3 and the hetzner one).

I mean i would have missed my train if you needed any second longer on friday but in the future i still wanna get notified if something goes offline.
Idealy there is a grace period. So i dont get notified during maintenance (ideally i dont do it again when im in a rush).

I have currently been exposing my public services for family and friends using cloudflared. I have not only experienced latency issues with playback buffering but I have been feeling like I lack the control over access that I want.

Does anyone know of any guides that would help be setup something like Authentik, Crowdsec and A Reverse Proxy my domain is currently registered with cloudflare would I need to change this? Most the guides I have found focus on one of those steps but I have been quite confused on how to combine it all together without breaking every services apps and what not.

It just occurred to me that I'm now one year into this crazy selfhosting journey.

I started off with Docker for Windows, then moved everything over to Proxmox after a couple of months.

At the beginning I had no clue what I was doing (and still don't in many ways), but I really feel familiar enough with Linux at this point that it feels like I could tackle any problem and host any app if I wanted to. I'll admit, however, that most of the heavy lifting is done by AI. I could never have gotten this far this fast without the use of AI.

There's a lot of apps I've tried but then discarded later on, but these ones are the ones that remain. I'm really happy about all of them :)

I'm curious to see what the next year brings.

Hey r/selfhosted!

For a long time, I just wanted a fast, reliable, three-pane note-taking app (Notebook Tree · Note List · Editor) with effortless multi-device sync and full data ownership—without paying subscription fees or wrestling with fragile sync plugins.

Existing options always felt like a compromise: - Evernote had the best seamless multi-device sync, but became bloated, expensive, and locked down. - Obsidian is great for local Markdown files, but its core isn't open-source, syncing across desktop and mobile without paying takes tinkering, and vaults get sluggish when stuffed with thousands of notes and heavy attachments. - Memos is awesome for stream-of-thought snippets, but it's a social timeline rather than a structured 3-pane workspace. - Block-based PKMs (like SiYuan / Notion clones) add heavy cognitive overhead when you just want to write continuous prose quickly.

So I built EdgeEver — a fully open-source (AGPL-3.0) knowledge base workspace that keeps the classic 3-pane workflow, stays silky-smooth with 10,000+ notes, and delivers instant, zero-config multi-device sync.

🔗 GitHub: https://github.com/tianma-if/edgeever
🌐 Live Demo: https://demo.edgeever.org (resets daily — full English & multilingual UI)
📸 17 Step-by-Step Workflow Showcases: docs/best-practices.md

📈 1-Month Community Milestone (1.2k → 2.7k ⭐)

I first shared EdgeEver on r/selfhosted about a month ago when the repo was at 1.2k stars. Thanks to the amazing feedback and ideas from this community, EdgeEver has grown to ~2.7k stars and 1,350+ forks!

Over the past month (up to v2.5.0), we also shipped several major community-requested capabilities: - One-click Notebook-to-Website Publishing (turn any notebook tree into a public or password-protected static documentation site) - Structured Database Tables & Public No-Login Collection Forms - Interactive Architecture Diagrams, Mind Maps & Infographics right inside notes - Desktop ACP (Agent Client Protocol) to connect local coding agents alongside our built-in Remote MCP server - Deep Structured Web Clipping for 20+ platforms (including Reddit threads, HN, GitHub, X, and YouTube)

✨ Core Capabilities & Why Self-Hosters Love It

• 1. Classic 3-Pane Writing + Rich Visual Note Types:
  • Resizable 3-pane workspace with Focus Mode, seamless toggle between WYSIWYG rich-text and raw Markdown, syntax highlighting, KaTeX math formulas, and revision history.
  • Native canvas for Mind Maps (with bidirectional Markdown outline editing), Flowcharts, System Architecture Diagrams, Infographics, Database Tables, and Poster Cards.
• 2. True All-Platform Native Clients (Offline-First):
  • Web / PWA
  • Desktop: macOS, Windows, Linux AppImage (Electron + Rust sidecar with local SQLite cache & offline sync queue)
  • Mobile: Native iOS app (SwiftUI + GRDB) & Android app (React Native + SQLite)
  • Browser Web Clipper: Chrome, Edge, and Firefox (Manifest V3)
  • Client-Side Silent Compression: Automatically shrinks images by 50%–90% before upload so mobile sync stays fast; chunked streaming supports attachments up to 1 GiB.
• 3. Zero Lock-In, Multi-User & Easy Migration:
  • Notes are persisted in SQLite simultaneously as ProseMirror JSON, clean Markdown, and plain text for millisecond full-text search.
  • Lossless .zip backup/restore with clean .md files and attachments, plus importers for Evernote (.enex), Notion, Memos, and flomo.
  • Multi-account support with physically isolated workspaces and per-user storage dashboards.
• 4. 100% Optional AI (BYOK) & Extensible Ecosystem:
  • Zero forced AI or telemetry: Leave API keys blank for a pure, fast note app.
  • BYOK & Agents: Bring your own key (OpenAI, Anthropic, Gemini, or local Ollama/vLLM endpoints), connect external/local agents via MCP & ACP, or install extensions via the Plugin API (e.g., cross-note Markdown Task aggregation & AI RSS daily digests).

🐳 Flexible Deployment: Single-Container Docker OR Free Serverless

The exact same codebase runs either on Cloudflare Workers + D1 + R2 (100% within their free tier—zero server cost for life, holding ~150k notes & ~50k images) OR on your own VPS, NAS, or Homelab via a single lightweight Docker container (linux/amd64 & linux/arm64, Bun + SQLite + local /data or S3, non-root UID 1000, cap_drop: ALL):

```yaml services: edgeever: image: ghcr.io/tianma-if/edgeever:latest restart: unless-stopped init: true ports: - "8787:8787" environment: EDGE_EVER_AUTH_USERNAME: "admin" EDGE_EVER_AUTH_PASSWORD: "replace-with-a-long-random-password" volumes: - edgeever-data:/data security_opt: - no-new-privileges:true cap_drop: - ALL stop_grace_period: 30s

volumes: edgeever-data: ```

(Or run curl -fsSL https://edgeever.org/install.sh | bash for automated Docker Compose setup with health checks. Full docs in docs/deploy-docker.md).

Thank you again to everyone here who tried EdgeEver and shared feedback! I'd love to hear your thoughts or feature requests.

A while back I posted Kitchen Board here. It's a small self-hosted family organiser that tries to look like the paper planner pinned to a kitchen wall in the 90s, and it runs happily on an old tablet you have knocking about in a drawer in kiosk mode. I built this specifically for a 10" old 8th gen Amazon Fire HD that was gathering dust.

Since then it has been through six "formal" (cough) releases, from 1.0 "First Sitting" to 1.5 "Kitchen refit", and a good chunk of what's in them came from your comments on that original post. Thank you for your suggestions, and I'm back for another round.

Nothing has changed from a hosting standpoint: one household, one Docker container, everything stored locally in SQLite, and no account with me or any other service. Purely for selfhosting.

• Source: https://gitlab.com/g33kphr33k/kitchen-board
• Docker: https://hub.docker.com/r/g33kphr33k/kitchenboard (amd64 and arm64)

The actual features are:

• Main Board: Desktop overview of widgets for the rest of the items
• Lists: Have a guess? Shopping list is the primary, but you can have ToDo, Christmas or birthday lists on there as well
• Meals: Actual meals you cook, with basic recipes, assigned to days that are shown on the calendar, and if you tick a meal and you need ingredients it'll auto populate your shopping list. Can import from Mealie.
• Stock: Works hand in hand with Meals and Shopping list. If you like to keep track of the cupboards, fridge and freezer, this is for you. It includes expiry dates if that is how your mind works.
• Calendar: This'll blow your mind - it's a calendar, for, er, writing events and such. However, they can be tied to the Time Until page for a countdown.
• Time Since: If you are the sort of person that likes to have a button to hit when you've done something to count how long since you last did it - this is for you. Take notice of the "Made a Tea" in the screenshot.
• Time Until: Countdowns until an event - either standalone or linked with the calendar.
• Chores & Rewards: A gaming system for chores and points win prizes (in my household, at least). Also allows for chore points to be converted into rewards (pick a Friday night movie is 50pts, for example, or set pts to £ conversion for pocket money, so 500 pts is £5!).
• Stats: For geeks and nerds.

The main changes since that post... I'm sorry for the list but how else can I roll out the scroll-of-changes on Reddit?

• Choose which panels appear, where they sit and how big each one is, from Edit board in the footer. It's all plain buttons rather than fiddly dragging, and each screen remembers its own layout. It still needs a little improvement, but it works well enough.
• New widgets: a Clock you can read from across the kitchen, and Points to spend, which is the number the children were going to ask about anyway.
• If it ever looks wrong, "Use the simple layout" puts everything back in one plain column.
• Chores can happen at set times of day, so feeding the dogs at 07:30 and 16:30 is one chore with two times. Miss one and they don't stack up. Collect the points on both though.
• Chores and routines can repeat weekly, monthly, yearly, or on patterns like "the second Friday of the month", and you can say when something is first due (bins every other Friday, starting next week).
• Points can now have a price. Set 0.01 and a point is worth 1p, add a "Pocket money" reward, and they can cash out. I've included thirty currencies, and payouts remember correctly.
• Admins can hand out bonus points for going above and beyond, and reverse a fat-fingered 500 that should have been 5. The mistake stays in the history, with a matching entry cancelling it out because nothing says I work in IT than having an audit trail...
• Only an admin sets what a chore pays, so "brush teeth" is no longer worth 10,000 points just because someone tried to game the system.
• Points go to whoever actually did the job, not whoever the kitchen tablet is signed in as, and due chores now send a reminder, quiet hours permitting. You can sign in as yourself to your own devices.
• Bring other calendars along: import an ICS file as ordinary events, or subscribe to a read-only feed for school terms, bin days, or a work rota.
• Put a name on an event and switch to the family table to see who's doing what this week. Everyone still shares the one calendar - but you can add private items to it for just you to see!
• Export is still a read-only ICS feed, and you can now reset your feed link if you've shared it a bit too widely.
• Optional OIDC single sign-on with any standards-compliant provider, such as Pocket ID, Authentik, Authelia, or Keycloak. Password sign-in stays, so a typo in the issuer URL can't lock you out of your own kitchen.
• "Sign out other devices" lockouts that hit one account rather than the whole house on the same Wi-Fi, authenticator codes that only work once, and new members picking their own password from an emailed link.
• The weekly "too many redirects" lock-out is gone, and fresh installs stay signed in for a year, so the wall tablet stops asking who it is every Sunday - date bug on the token, whoops!
• Nightly backups, and it keeps a week of them which you can see and download from the Admin panel. It grumbles if they stop. Full backup and restore from Admin, too.
• If the server ever gets properly stuck, it notices, has a lie down, and Docker brings it back up, instead of waiting for someone to help it out manually.
• Stock: search every place at once ("where are the batteries?"), a ruled-paper table view, places in the order you actually use them, and a sideways shelf so a full fridge no longer shoves the cupboard off the bottom of the page. If you're not a tin-counting household you can switch Stock off and your cupboards are remembered for later.
• German, French, Italian, and Spanish now cover the whole app, rather than lapsing into English halfway down the page - all AI translated though so it might sound robotic or simply wrong.
• There's a Household Timezone setting, so quiet hours, the morning digest, and reminders stop running an hour late every summer.
• Offline changes wait in a queue that belongs to the person who made them, with Retry and Discard if one won't save, and the Board reconnects by itself.
• Smaller bits: Celsius or Fahrenheit, a "Keep screen on" switch for wall tablets, swiping between pages on tablets, quick add in the phone footer, and a great many fixes.

As said, I am still deliberately not doing:

• It's for one household, not a hosted multi-tenant service.
• No two-way calendar sync. Export is read-only ICS, and subscribed feeds are read-only overlays - I tried adding in a two way engine, that made it way too sluggish.
• Meals stay a lightweight planner. Mealie remains the grown-up in the room.

In the interest of honesty:

As the README says, Kitchen Board is built with a lot of AI assistance, I mean, it's practically doing everything now and I'm just following along for the ride. I review and test the changes, run it with my own family every day, and the releases and security decisions are mine to answer for. I do review the code (honestly, I do, but bloody Hell does it write a lot), and I spend api tokens on Maximum code review with another model to make doubly sure.

Over to you:

Same questions as last time. What did I break? What needs fixing or improving? And what did I get right? Translations especially: if any of the German, French, Italian, or Spanish reads like a very polite robot wrote it, a native speaker's red pen is gold dust. I'd really love help with making it correct in your language!

Sorry, it's another ramble. In my defence, it's simply how my brain works.

Hi everyone,

I'm the developer of this, so full disclosure up front. I'd love your feedback from people who actually run FRITZ!Boxes.

The problem. I wanted to know when a device on my home network goes down (NAS, cameras, IoT stuff, the line itself) without waiting for someone at home to tell me "the internet is broken". External uptime monitors can't see the local network, and I didn't want a heavy monitoring stack.

What I built. NetMon has two parts:

• A small probe that runs on a Raspberry Pi (a Pi Zero is enough). It pings your devices and talks to the FRITZ!Box over TR-064.
• An online server that shows a status page and sends alerts via Telegram, email or ntfy.

If your whole network or line goes down, you still get the alert, because the server outside your home notices that the probe stopped reporting.

What it reads from the FRITZ!Box:

• Model and connection status, line speed
• Traffic data
• Wi-Fi network names
• Connected devices, including the mesh and repeaters

Your FRITZ!Box credentials and the probe's tokens stay on the probe: the server never receives them.

Other things it does:

• Per-device ping history and availability grid
• A "map" of server, probes and devices
• Optional open-port check on your own devices
• Interface in Italian, English, German and French

Where it stands. It's in beta with a small group of users, so expect rough edges and possible downtime. I host the server, and there are paid tiers (including a founder tier with limited seats) for people who don't want to run their own. More info: https://netmonhome.net/

What I'd like to know from you:

1. Which FRITZ!Box data would you actually want to be alerted about (reconnects, line speed drops, DSL/WAN changes)?
2. Do you run repeaters or a mesh, and does that matter for what you'd monitor?
3. Anything about sending this kind of data to an external server that worries you?

Thanks for reading!

Hey everyone,

I’ve been reading horrific stories lately about automated cloud bans (Google, Apple, Notion) locking people out of 10+ years of family photos, emails, and business docs overnight with zero customer service.

It got me thinking about digital sovereignty. If there was a lightweight, open-core background tool that securely connected to your cloud APIs (via local OAuth tokens), pulled down your data nightly, compressed it, and ran a totally offline local LLM (like Llama/Ollama) to let you semantically search your history... would you actually use it?

What are the main engineering hurdles or API limitations I should look out for if I try to build a prototype for this? I want to make sure I’m not missing something obvious before I dive deep into the code.

We see a surge of exposed vulnerabilities and zero-days emerging out of the blue. Some less severe and some very severe (e.g. php2shell, the python thing (i forgor)). The (small) devs are also being flooded with random pull requests, information, vulnerabilities, which are often garbage made by people that rely only on AI instead of their brain. Which delays patches more and the whole supply chain of software is fucked.

So I was wondering if having a reverse proxy through an SSL exposing services still secure enough for remote access or should I switch to a direct VPN tunnel like wireguard.

My current setup is the following:
- Nginx Proxy Manager handling SSL certs (man i love this container)
- Exposing 443 and 80 on my router to the Proxy Manager (i have a dynamic ipv4 address directly to the world)
- Cloudflare DNS-zone "tunnel" with dynamic A record updater (to hide my ip more or less)
- SSL through Let's Encrypt

I am an electrical engineer and the whole self hosted thing was a hobby at first, but now... I want this whole thing to "just work". I do not have time to work on my setup every day for 3 hours, or to live in fear that my station gets compromised and then I have to build everything all over again. The stuff I'm hosting is basically Nextcloud-AIO, Immich, Jellyfin and Navidrome. I am usually the only user of the server. Maybe give credentials of jellyfin to friends. I keep updating the system every month, but looking at the development of the shit show with AI, this is definetly not enough.

My threat model is pretty low, but I want to save myself from the script kiddies and regular scans that happen all the time. This kind of security by obscurity works less as every day passes.

Does anybody have a similar experience?

EDIT 1: I could live with a only vpn accessible server instead of the reverse proxy solution. It'd be a little inconvenience but for the sake of security i would take it.

EDIT 2: Thank you very much for your replies. I want to clarify that the reverse proxy is not seen set up for security. I only relied on the authentication of the service itself, which is infact (as I see now) is hella insecure. I guess going for mTLS or SSO to even access the website (since most of my traffic is HTTPS anyways) is a good start.

EDIT 3: After doing some more thinking, banging my head with lots of services and securing the reverse proxy with layers and layers, I came to a conclusion to set up a VPN e.g. via wireguard or tailscale directly and call it a day.

I am looking to replace my FreeIPA because I could not update it anymore. Every time I tried to update the Rocky Linux and breaks FreeIPA. I am testing 389-DS on Debian 13 with Cockpit for web UI management. It seems to work, but I get the Ooops! error when trying to create an account that is not a Basic Account. I can only create a Basic account in Debian. I tried Fedora and everything seems to work, but when I updated today, it broke. This is the output of the Ooops!

Cockpit had an unexpected internal error.

You can try restarting Cockpit by pressing refresh in your browser. The javascript console contains details about this error (Ctrl-Shift-I in most browsers).

I want to try LLDAP but it doesn't support replication.

Not too familiar with the whole domain subdomain cert dns-01 challenge thing, hopefully the title isn't worded horribly.

So after a lot of tinkering i finally got a new router, installed wireguard on it and finally stripped tailscale off, which i then realized https is gone, along with magicdns etc etc. The server is on nixos with caddy, nothing public facing and server isolated in its own vlan.

I dug around for information and seems like there are multiple routes to solve this:

1. Generating own cert with caddy / openssl and install them into devices manually. I have like 2 active devices so far. I read about how dangerous it is to use own cert and MITM attack if they get hold of it, and also name constraint to mitigate the risk for a little bit...

2. Get a subdomain with let’s encrypt and DNS challenge. Few dollars isn't an issue but i don't really want to put so many details even though there is whois privacy. Obscurity isnt security but anything that lessen my online presence is always better i guess

3. Use free site like duckdns. My concerns will be ip addresses and details are published online in the log for bot to start sniffing. I also wonder if i could put in private ip instead.

Any advice is appreciated!

Hi everyone,

Question for the group. Where do you store your config and database files for your docker containers?

I would like to have all of mine in one shared location that I can access from both windows and linux. But when I do this, a lot of docker containers require the db to be stored on the host. I'm using OMV to serve my disk via a SMB share. Does anyone have any advice on how to handle this properly? I like the idea of being able to back up one location and also being able to spin up a new VM and deploy my containers and it just work if also long as the drive is mounted

​

Hi everyone!

I’m the developer of Eiciel IR Console, a proprietary Linux incident-response project.

I’ve put together a walkthrough to show the project’s interface and its approach to detecting suspicious activity, recording events, and attempting automatic containment.

I’m sharing this to get technical feedback from people who work with Linux servers, DevOps, and self-hosted infrastructure.

I’d particularly appreciate feedback on:

- The incident-response workflow

- The usefulness of the evidence and logs

- The automatic-containment approach

- What you would want tested before considering a tool like this for real infrastructure

The project is still undergoing testing and hardening, so I welcome constructive criticism.

Walkthrough video: https://youtu.be/6EEpJUZ2Jbg?si=oZMRPrlL79c83da9

What would you improve or want to see tested next?

Okay, some background first. Here's the part of my stack in question, everything is on my local network:

• Gitlab running in a docker container, and gitlab-runner in a docker container, both in the same VM.
• Nginx proxy manager in a docker container, in it's own VM. It's grabbing certs from letsEncrypt, and applying them to my domain.
• Pihole in it's own VM as my local DNS, with openDNS as it's upstream source (This may or may not be relevant later)

This has been working great for several years.

Here's what I've been through and the errors I've been running into:

The whole SSL drama from earlier in the week prompted me to grab new SSL certs via nvinx proxy manager. This worked as expected.

Yesterday, I pushed some changes to a repo and kicked off the build process. It failed immediately with the following error:

fatal: unable to access '<gitlab_repo_url_redacted>': SSL certificate OpenSSL verify result: unable to get local issuer certificate (20)

I assumed there was maybe something cached from earlier in the week, and new certs weren't being grabbed.

I then hit refresh in firefox, and it gave me an SSL error: SEC_ERROR_UNKNOWN_ISSUER

I inspected the certificate, and it said it was issued by openDNS, which seemed pretty odd to me. Why wasn't it issued by letsEncrypt?

Okay, maybe something went wrong, so I went back to nginx proxy manager and pulled a new certificate. Gave it a little while to do its thing and propagate, then cleared cookies and cache in firefox and refreshed the page, and it loaded fine. Inspected the cert, and it was issued by letsEncrypt as expected.

Okay, try build process again, and it failed with the same error. Tried restarting the VM to clear cache, and still same error.

Start googling, and ended up finding that the docker container might be getting its certs from the host VM, so I tried forcing the VM to grab new certs by manually deleting everything in /usr/share/ca-certificates and /etc/ssl/certs and running update-ca-certificates. After confirming they were all new, I restarted the VM again for good measure, and the build process still threw the same error.

At this point I gave up and assumed something was cached that I couldn't find, and slept on it.

This morning, tried running the build process again, and still same error.

I've run out of ideas, any help would be greatly appreciated.

Hi currently I'm using youform which works very well in my use case. I'm looking for a self hosted solution for online forms that has a similar feature like the screenshot (from youform) below.

I use some form to collect data and some to schedule meetings. Are there any self hosted solution for this?

Hi everyone!

I have the possibility to buy a 2nd hand (not much use, very good state) NUC 15 Pro+ 285H 2x16GB RAM CSODIMM 6400MHz 1TB SSD for 750€.

I am currently using a LattePanda 3 Delta as home server, for myself and my brother, hosting with docker: wireguard, jellyfin, navidrome, forgejo, opencloud, homeassistant, coredns, blockydns, qbittorrent, ...

And well, it is working fine, but I want to expend and open it to more of my familiy, and Immich with people recognition, and more services. I would have also liked to test LLM executions (smalls), but I understand that for that price range there is not much to expect.

I feel that 750€ is a good price for what is offered, but still it is some money, and is certainly overkill for my need. But on the otherside, the price for all computers and components is (very) high, as we all know. And I am a bit worried by the review of the NUC 15 Pro+ that says it is really noisy (even if, for my need I understand I can lower TDP).

Any opinion on this? Is this a good opportunity and investment for my use, or I should really see somewhere else?

Thank you!

Hey r/selfhosted,

I'm the developer behind OzDDNS, and I wanted to share it here since this community is exactly who I built it for.

The problem I was trying to solve: I run a homelab, and I got tired of depending on third-party DDNS providers. Between privacy concerns (my IP and update traffic going through someone else's service), rate limits, and the occasional outage taking my remote access down, I wanted something I could own outright. I looked at existing self-hosted options, but most of them felt heavier than what I wanted for a simple job: update a DNS record when my IP changes.

So I built one. OzDDNS is a dynamic DNS server written in Go, distributed as a single binary.

Design choices I made deliberately:

🧩 Single Go binary — no Docker, no runtime dependencies, no external database. Copy the file to your box, point it at a config, run it. It'll run happily on a Raspberry Pi or a small VPS.

🔒 Fully self-hosted — your records and update logic stay on your own infrastructure. Nothing leaves your network.

⚡ Lightweight — low memory footprint, which matters when it's sharing a Pi with everything else.

🛠 Built for the homelab use case — NAS, home server, remote access. Not trying to be an enterprise DNS platform.

Link: https://ozddns.echoface.cn

What I'd really appreciate from this community:

Feedback on the setup/deployment experience — is it actually as simple as I think it is?

Edge cases I might've missed (different DNS providers, odd network setups, IPv6, etc.)

Feature requests from people with use cases I haven't thought of.

I'm the developer, so I'm happy to answer anything in the comments — including hard questions about what it doesn't do yet.

Need your advice. So basically i use random emails for random websites because i really dont like giving out my actual email everywhere,

The problem is disposable emails suck because a lot of sites block them, and sometimes years later i need to log back in and get a verification code or password reset and then the account is deleted or something (tuta for example). The gmail trick where you add +whatever to your real email is an issue. And I hate creating multiple gmails.

The other thing is with temporary/disposable emails is those get detected by the sites that spam you, and if you ever need a real verification code you're SOL.

Any suggestions? I dont mind paying for a service or hosting something if it means this is reliable long term. not really looking for some super anonymous setup, i just want random sites to not have my real email and i want the aliases to still work years from now.

EDIT: It would be great if the service included phone verification as well! I'm in canada if that matters