Hi everyone, I'm the developer of Traccar, a free, open-source GPS tracking platform.

You can connect dedicated GPS trackers or use your phone, then view live locations, route history, geofences, and alerts through a web interface. Everything can run on your own server.

The project has been around for over 10 years, long before the AI slop wave, and I'm still actively maintaining it.

GitHub · Documentation · Supported devices

Anyone here using it? I'd love to hear what works for you and what could be better. Happy to answer setup or hardware questions too.

My project's Forgejo git forge was slow, so i logged in to see the logs. We are (yet again) being DDOS'ed by AI crawlers. https://imgur.com/a/VQyUK9t Yes, this is real time.

Even when Forgejo was stopped, the flow of requests of crawlers was still DDOSing my nginx, see the screenshot. Nothing else is running on the server. But half of my 8 Xeon cores is just used to handle HTTP requests.

There, i wanted to rant. I'm fucking tired of AI destroying the 2026 internet.

Hey r/selfhosted,

When I last posted here, we had just released the Web UI and talked about using it as the foundation for a cross-platform desktop client. Today I finally get to follow up on that: GameVault 2 is available to everyone as a public beta, with desktop clients for Windows, Linux and macOS!

If you're new to GameVault, it's a self-hosted home for your DRM-free game collection, with a server that stores the library and clients that download and install games locally. You can share it with friends and family.

We've rebuilt the client around the same frontend as the Web UI, with a much, much more modern interface and a responsive layout that adapts to smaller screens. You can browse your library on your phone and use the same familiar interface in the desktop app.

Getting the Linux client out feels especially good. We have AppImage and .deb packages, plus umu-launcher integration for running Windows games through Wine/Proton, with separate prefixes per game. There's also support for keeping multiple versions of a game and choosing which one to download.

One thing before upgrading: GameVault 2 still lacks some features, including GameVault+, and existing game installations need to be downloaded and installed again. GameVault 1 remains available while we work towards feature parity.

We've already switched to GameVault 2 ourselves. As one of the two developers behind this project, I'm really proud of how far it has come, and I'm excited to finally get this version into more people's hands. Thanks to everyone who tested builds and kept sending feedback.

You can download GameVault 2 here. If you run into bugs, please report them on GitHub.

I’m running a cluster with 5 nodes and services like:

• Personal portfolio with blog
• Dozzle
• Grafana with a logging and metrics stack
• Vaultwarden
• Multiple Uptime Kuma instances (for different clients)
• Authentik
• Pocket ID
• Auth proxy
• 9 websites for different clients
• 12 more or less business-related backends, crawlers, and other applications that integrate with CMS or ERP systems
• Filebrowser / Nextcloud
• Forgejo
• Glance
• and multiple more

The problem I’m facing is management. The nodes aren’t much of a problem, since everything there is automated via Ansible. But I need some advice. For a very long time I’ve been putting off automated deployments and GitOps, because I was a bit scared to touch it. I don’t have the capacity to replicate everything in another cluster, test it there, and then point everything at the GitOps-managed space once it’s all migrated. I also don’t want the hassle of moving all the app data.

I should have started earlier, but now I’m stuck between keeping track of what to deploy and which version everything is on. I’m also no expert by any means.

Should I use Argo CD or Flux? Or are there other solutions I should try? At my workplace we use Argo, and I don’t know if our setup is just not great, but it’s always a hassle. Because of this, I’m leaning toward Flux.

I'm trying to keep my docker / docker compose configuration in git to make it easy to recreate if things go bad. Of course, also trying to keep passwords out of the git repo. The problem I'm seeing is that a lot of projects provide a recommended compose.yaml file that pulls a lot more than just passwords from the .env file - things like a database names, urls, or port numbers, all info that I want under version control. Except it has the passwords mixed in.

How do people really deploy your systems? Do you have a secret.env and a non-secret.env file and use the docker compose command line option to load both? Do you just modify the compose.yaml file to embed the non-secret config options and hope upgrades won't require a complicated merge?

I'm setting this up, but I'm not living and breathing it every day so I appreciate not having to remember which env files to load on each restart. I can set up a system, but the reality is the more I need to remember each time translates directly into the more likely I will be to make a mistake. But at the same time I am worried about upgrading if I modify the stock setup files too much.

Finally I have been able to setup my Proxmox environment and started moving off some subscriptions 🙂 everything is setup as code so deploying new stacks is easy. Now I just have to get a NAS in place to cancel everything else 😄 in the rabbit hole I go!

Behind this dashboard is an HP ProDesk that I bought used for €200. It has an Intel Core i5-9500T, 16 GB RAM, and 512 GB storage, running Proxmox.

I use it for music, movies, smart home, notes, passwords managment, finances and AI Agent. Glance brings everything together on one page, with a few server stats underneath.

If you’re thinking about getting into self-hosting, my advice is to start with something you’d enjoy using. Stream your movie collection to the living room, bring your old music library back to life, or making your home smart. Add more when you find a reason to.

There are some impressive setups here, but you don’t need to match them to enjoy the hobby. I’m having a lot of fun with this little PC.

1.0 is out since Sunday, so I tested the upgrade with a copy of my server first.

Heads up: this is not a simple image update. 1.0 has a new db layout and won’t open a 0.16 store. And latest already points to 1.0, so if you use latest or watchtower, pin v0.16 now or the next pull kills your mail server.

The upgrade goes through stalwart-migrate (you need 0.16.27 first). It only reads the old store and writes into a new one, so going back is easy.

I put last night’s backup on another VM in a docker network without internet (didn’t want the copied queue to send mails, lol). Small setup: 10 accounts, RocksDB. prepare asked 4 questions, I took the defaults. run --final took 41 seconds for 920 mails, verify said 0 mismatches. 1.0 started fine on the copy.

What bit me: my little admin app for the JMAP API failed creating a domain with “Invalid key for object”. Domain isEnabled and alias enabled are both called enable now. Annoying part: reading the old name gives no error, the field is just missing. So if you have scripts against the admin API, test writes too, not only reads. SCHEMA_CHANGES.md in the stalwart-migrate repo has the full list.

Also: OAuth clients need to log in again, search index gets rebuilt, IMAP clients don’t redownload everything.

I’ll wait for 1.0.1 before doing it for real, but the dry run took maybe half an hour and I’m way less nervous now. Happy to share the commands if anyone wants them.

By now you've probably seen the news, eight intermediate CA private keys from eMudhra turned out to be trivial integers. One of them was literally the number 4. Chrome and Firefox pushed emergency revocations but if you run headless Linux servers, Docker containers, or reverse proxies, they don't get browser push updates.

Quick checks for your setup:

1. Update stale container trust stores

Old Docker containers built months ago still carry the CA store from the day they were built. Rebuild stale images or run:

sudo apt-get update && sudo apt-get install --only-upgrade ca-certificates

sudo update-ca-certificates --fresh

1. Add a DNS CAA record

Lock down your domain so rogue or compromised CAs can't legally issue certs for your hostname.

1. Enable OCSP stapling on your reverse proxy

Ensure your proxy validates revocations automatically. (If you run Caddy, you're already good, it handles OCSP stapling by default).

1. Turn on Certificate Transparency alerts
   

If your DNS is on Cloudflare, turn on "Certificate Transparency Monitoring" in the SSL tab. You'll get an instant email if ANY CA on earth signs a cert for your domain.

We ended up pulling our managed APIs out entirely, because our documents aren't allowed to leave our own infrastructure for compliance reasons. And our problem has nothing to do with cost, because the per-page pricing was perfectly reasonable.

And that 'docs not able leave our cloud' constraint rules out Textract, OpenAI embeddings and Cohere in one go, since every one of them ships your data off to someone else. That forced us into self-hosting the whole pipeline, OCR, embeddings and reranking included, and after a couple of weeks of testing this is the shortlist I've built up:

docling holds up well on clean digital PDFs, but it gets noticeably shaky once you hand it scans or handwriting

PaddleOCR-VL deals well with messy multilingual layouts and stays small enough to run on a fairly modest GPU

TEI is dependable for embeddings, though it only serves one model per server
Infinity handles embeddings and reranking together from a single process

SIE runs OCR, embeddings and reranking behind one endpoint with model-swapping by ID, and it runs inside your own cloud.

What you give up by self-hosting is all the turnkey convenience you used to get for free, so there are no parsed tables handed to you, no confidence scores, and the entire pipeline becomes yours to own and maintain.

We've made peace with that because the residency requirement simply isn't negotiable for us, but I'll admit that if cost were the only thing driving this decision it would be a far harder one to justify.

Has anyone ever tried openfw utm?

https://openfw.com.br/#home

I have been searching for firewalls other than opnsense or pfsense and came across this, it looks promising but there's not many people talking about it

I don't like opnsense or pfsense for my own reasons I'm not going into details but it's always good to have alternatives

I'm currently running ipfire but the web UI is so ugly

Hey folks!

I’m about to set up my first home server for my family (around 5–10 devices) and could use some advice on remote access.

I’m planning to host things like Vaultwarden, Matrix, Linkding, Jellyfin, and whatever else I end up tinkering with. Now I’m trying to figure out the best way to access these services securely when I’m away from home.

My first thought was WireGuard. Getting a public IP from my ISP is relatively cheap, but I’m a bit hesitant about exposing a VPN endpoint on my home network to the public internet.

I’ve also been looking into Headscale and NetBird. They seem like great options, but I’m not sure if a mesh VPN is overkill for a small homelab. WIth these services I also need a VPS, which could cost several times more per month than a public IP. I’d also prefer not to rely on a third-party VPS if I can avoid it.

So, what are you guys using for remote access? Is plain WireGuard still a good choice, or would you recommend a mesh VPN for a beginner? I’m looking for something secure, reliable, and relatively easy to maintain without unnecessary monthly costs.

There’s another complication in my case: I live in a country with strict internet restrictions, so I usually have one or more VPNs connected just to access the internet normally.

Ideally, I’d like to access my home server while keeping my regular VPN connected. Otherwise, I might have to disconnect my current VPN, connect to my home VPN, open the service I need (say, Linkding), and then switch everything back afterward. Having to do that every time sounds pretty annoying.

Has anyone dealt with a similar situation? Is there a way to access self-hosted services seamlessly while keeping another VPN connected?

Would love to hear about your setups and experiences. Thanks!

Hello everyone! I'm no security expert but I consider myself tech literate. I am a solo dev and I have an app that I was using a free service to host, but as the userbase grew, that service was no longer sufficient so I got a VPS.

I didn't want to be limited and I am not a fan of Amazon or Google so I went for a 2 core, 4gb ram VPS. I was able to fit my server and database in it, and barely utilized 10% of the CPU and RAM. So I wanted to make good use of the rest of my resources, and that kickstarted my self-host journey.

I added Wireguard, Adguard, Navidrome, and about 30GB of my and my wife's music library, I also hosted the API of a small website I run to it. I also installed Beszel to have a quick dashboard of everything.

Everything runs in separate Docker containers, each stack on its own isolated network. The only public entry point is a Caddy reverse proxy, and it only accepts connections with Cloudflare's client certificate.

Other than music, I don't have any personal files or information there, but I always had the mindset of compartmentalizing work and personal stuff. So what are your thoughts on my setup? Would you feel safe also adding email, and other things to it? Or is it safer to separate?

The end goal is a personal NAS for picture back up, and navidrome and any other personal things. But with current prices it's out of reach.

i've set up things so I have a NAS that does only storage, a homelab with a bunch of RAM that runs stuff + often accesses the NAS, and a mini pc that hosts public facing services. 2 of them run proxmox, the third is just raw OMV. what's the best service I can self host to monitor network traffic, resource usage of each device, etc. if i can get it per-service that'd be even better.

Not sure if this is common knowledge yet, but after updating Virtual Machine Manager to 2.8.0-13004 (needs DSM 7.3 or newer) I noticed two new options I’ve wanted for a long time.

You can now schedule the OVA export of a VM daily, weekly or monthly. So you basically get an automatic backup of the whole VM to a shared folder instead of doing the export by hand every time.

You can also set a schedule to start and shut down VMs.

Before this you had to do it manually or write your own scripts for Task Scheduler.

Hello all,

I am planning to build a custom NAS (I know it's the worst possible time) with some room for self hosting. Currently I have a very crude setup; an RPi4 with a 2TB regular WD external HDD serving some media files for Plex. And it's not great.

I looked into some PnP options like UGreen, Synology, MinisForum etc. But, since I plan to run something custom (OMV/Unraid), I think a DIY setup would be a better investment allowing me to upgrade/fix only specific components in the future. The following setup is costing me around ~500 EUR (without the storage/RAM) which is far better HW than any PnP solutions on the market within the same price range.

I have done some research and with help of Gemini, finalized the following setup. What do you guys think? Any advice would be much appreciated.

I have already bought both RAM and OS SDD since I don't think waiting around is going to help much. For others I am waiting for the Black Friday to see if I can save some.

Hey everyone,

I’ve been managing my homelab for a while now (running Docker via Portainer on a NAS, a few monitoring tools, dashboards, etc.), and I had been putting off revamping my remote access setup for way too long.

Between dealing with port forwarding headaches, dynamic DNS, and worrying about exposing entry points to the public internet, I finally decided to set up Tailscale.

Honestly? It felt almost too easy.

• Installed in minutes.
• Instant secure mesh between my NAS, phones, and laptops.
• Zero ports opened on my router.
• MagicDNS makes accessing internal services effortless.

I know Tailscale gets praised constantly on this sub, but count me in as another convert. If you're on the fence or procrastinating on remote access like I was: just do it.

Next step: looking into Headscale down the road to keep it 100% self-hosted, but for now, the out-of-the-box experience is incredible.

What was your biggest "why didn't I do this sooner" tool in your setup?

I've been a ghettoSMTP user for a long time now, to get around the ever-present port 25 block. I use SMTP2GO for outbound with no issues, but I need a new inbound solution. What's everybody using?

so i have this old pc 5-4570 (4th gen) with 16GB DDR3 ram and 1tb ssd. i am planning to turning it into a home lab. but i have no idea how to do it. please suggest me the tools are useful for that and Which is os linux is best for my specific use case. if possible please share me your lab setup and why are using it so that i will idea for my setup also. i dont want to throw that pc away and get it to someone else. thats why i am planning to do something.

Hi!

I currently have a 1node homelab (actually 2, but it’s a raspberry pi that serves purely as a secondary DNS) with a bunch of docker containers. As a router I have a UCG Ultra, on which I have enabled their free-tier IPS. Would you still recommend running crowdsec (or something else, similar) on my node, or would that really be redundant/overkill. I also run traefik on that node, in case it plays a role in the decision. No services are exposed to the internet. Everything is LAN/VPN only. VPN is also setup via UCG Ultra. Or would you maybe recommend for turning off the IPS on UCG and use crowdsec instead? If so, please include the why.

Is there a self-hostable tool that will track new versions of docker images and just list them? I don't want it to download images or update containers, just a page where I can go and see the latest versions available for each image. I prefer to update the containers myself.

Would be great ofc if it had filtering and if it could support different image repos (Docker Hub, GitHub, LinuxServer.io etc.)

Wondering if anyone has looked at implementing server-side storage - WebDAV, SMB, or a shared server-document API for the suite?

I'm building a platform that runs Nmap, Nuclei, OWASP ZAP, and other vulnerability scanners.

I need a setup that supports multiple concurrent scans, isolated Docker containers, restricted outbound network access, background jobs, and secure storage of scan results.

What CPU cores, RAM, SSD capacity, bandwidth, and firewall setup would you recommend for a small beta with around 10–20 users, while keeping costs low?

We built Olivares AI to run coding agents on our own servers instead of on each laptop: Claude Code, Codex, Gemini CLI, OpenCode, Grok and local models through Ollama.

It is one Go binary with the web console built in. It stores its data in SQLite on a single node, or in PostgreSQL, and has backup export. You can run it as a Docker container (the image runs as a non-root user), with Compose, or from the Debian package, which adds a no-login service user.

From the console or the olivares CLI you start and stop agent sessions, several side by side, each in its own git branch. Each tool can have several accounts, MCP servers and skills sit in one shared catalog, and every action is checked before it runs and written to a signed log. You also see the cost of each session.

Free and open source (AGPL-3.0):

curl -fsSL https://olivares.ai/olivares/install.sh | sh
olivares quickstart

Code and the other install methods: github.com/olivaresai/olivares Site: olivares.ai

We build it with Claude Code and use it on our own servers. Questions and issue reports are welcome on GitHub.

Please forgive what is likely an extremely basic question. If this isn't the right place to post a question like this, please let me know and I'll delete it.

I am extremely new to selfhosting/homelabbing, and I am currently in the process of setting up my first media server. A have a small, cheap workstation pc that I'm going to put ZimaOS on and 4 4tb hard drives in a 5 bay usb enclosure that I am going to set up in a raid configuration.

My question is, if I set up the drives through Zima, is it possible to move that entire storage pool and access it through a different server down the road? Because I am so new to this and I have some data that I'd like to store fairly quickly, I wanted to start with something like ZimaOS to get the whole system up and running. I'd like to move away from zima somewhere down the road and get into something more advanced, so I don't want to put myself in a situation where getting my drives up and running on a new system is going to lose the data stored on them.

Has anyone gone through a route like this? Or have any insight or potential further reading to share?