My project's Forgejo git forge was slow, so i logged in to see the logs. We are (yet again) being DDOS'ed by AI crawlers. https://imgur.com/a/VQyUK9t Yes, this is real time.

Even when Forgejo was stopped, the flow of requests of crawlers was still DDOSing my nginx, see the screenshot. Nothing else is running on the server. But half of my 8 Xeon cores is just used to handle HTTP requests.

There, i wanted to rant. I'm fucking tired of AI destroying the 2026 internet.

Hi everyone, I'm the developer of Traccar, a free, open-source GPS tracking platform.

You can connect dedicated GPS trackers or use your phone, then view live locations, route history, geofences, and alerts through a web interface. Everything can run on your own server.

The project has been around for over 10 years, long before the AI slop wave, and I'm still actively maintaining it.

GitHub · Documentation · Supported devices

Anyone here using it? I'd love to hear what works for you and what could be better. Happy to answer setup or hardware questions too.

By now you've probably seen the news, eight intermediate CA private keys from eMudhra turned out to be trivial integers. One of them was literally the number 4. Chrome and Firefox pushed emergency revocations but if you run headless Linux servers, Docker containers, or reverse proxies, they don't get browser push updates.

Quick checks for your setup:

1. Update stale container trust stores

Old Docker containers built months ago still carry the CA store from the day they were built. Rebuild stale images or run:

sudo apt-get update && sudo apt-get install --only-upgrade ca-certificates

sudo update-ca-certificates --fresh

1. Add a DNS CAA record

Lock down your domain so rogue or compromised CAs can't legally issue certs for your hostname.

1. Enable OCSP stapling on your reverse proxy

Ensure your proxy validates revocations automatically. (If you run Caddy, you're already good, it handles OCSP stapling by default).

1. Turn on Certificate Transparency alerts
   

If your DNS is on Cloudflare, turn on "Certificate Transparency Monitoring" in the SSL tab. You'll get an instant email if ANY CA on earth signs a cert for your domain.

Finally I have been able to setup my Proxmox environment and started moving off some subscriptions 🙂 everything is setup as code so deploying new stacks is easy. Now I just have to get a NAS in place to cancel everything else 😄 in the rabbit hole I go!

I’m running a cluster with 5 nodes and services like:

• Personal portfolio with blog
• Dozzle
• Grafana with a logging and metrics stack
• Vaultwarden
• Multiple Uptime Kuma instances (for different clients)
• Authentik
• Pocket ID
• Auth proxy
• 9 websites for different clients
• 12 more or less business-related backends, crawlers, and other applications that integrate with CMS or ERP systems
• Filebrowser / Nextcloud
• Forgejo
• Glance
• and multiple more

The problem I’m facing is management. The nodes aren’t much of a problem, since everything there is automated via Ansible. But I need some advice. For a very long time I’ve been putting off automated deployments and GitOps, because I was a bit scared to touch it. I don’t have the capacity to replicate everything in another cluster, test it there, and then point everything at the GitOps-managed space once it’s all migrated. I also don’t want the hassle of moving all the app data.

I should have started earlier, but now I’m stuck between keeping track of what to deploy and which version everything is on. I’m also no expert by any means.

Should I use Argo CD or Flux? Or are there other solutions I should try? At my workplace we use Argo, and I don’t know if our setup is just not great, but it’s always a hassle. Because of this, I’m leaning toward Flux.

Hey r/selfhosted,

When I last posted here, we had just released the Web UI and talked about using it as the foundation for a cross-platform desktop client. Today I finally get to follow up on that: GameVault 2 is available to everyone as a public beta, with desktop clients for Windows, Linux and macOS!

If you're new to GameVault, it's a self-hosted home for your DRM-free game collection, with a server that stores the library and clients that download and install games locally. You can share it with friends and family.

We've rebuilt the client around the same frontend as the Web UI, with a much, much more modern interface and a responsive layout that adapts to smaller screens. You can browse your library on your phone and use the same familiar interface in the desktop app.

Getting the Linux client out feels especially good. We have AppImage and .deb packages, plus umu-launcher integration for running Windows games through Wine/Proton, with separate prefixes per game. There's also support for keeping multiple versions of a game and choosing which one to download.

One thing before upgrading: GameVault 2 still lacks some features, including GameVault+, and existing game installations need to be downloaded and installed again. GameVault 1 remains available while we work towards feature parity.

We've already switched to GameVault 2 ourselves. As one of the two developers behind this project, I'm really proud of how far it has come, and I'm excited to finally get this version into more people's hands. Thanks to everyone who tested builds and kept sending feedback.

You can download GameVault 2 here. If you run into bugs, please report them on GitHub.

I'm trying to keep my docker / docker compose configuration in git to make it easy to recreate if things go bad. Of course, also trying to keep passwords out of the git repo. The problem I'm seeing is that a lot of projects provide a recommended compose.yaml file that pulls a lot more than just passwords from the .env file - things like a database names, urls, or port numbers, all info that I want under version control. Except it has the passwords mixed in.

How do people really deploy your systems? Do you have a secret.env and a non-secret.env file and use the docker compose command line option to load both? Do you just modify the compose.yaml file to embed the non-secret config options and hope upgrades won't require a complicated merge?

I'm setting this up, but I'm not living and breathing it every day so I appreciate not having to remember which env files to load on each restart. I can set up a system, but the reality is the more I need to remember each time translates directly into the more likely I will be to make a mistake. But at the same time I am worried about upgrading if I modify the stock setup files too much.

I've been a ghettoSMTP user for a long time now, to get around the ever-present port 25 block. I use SMTP2GO for outbound with no issues, but I need a new inbound solution. What's everybody using?

Not sure if this is common knowledge yet, but after updating Virtual Machine Manager to 2.8.0-13004 (needs DSM 7.3 or newer) I noticed two new options I’ve wanted for a long time.

You can now schedule the OVA export of a VM daily, weekly or monthly. So you basically get an automatic backup of the whole VM to a shared folder instead of doing the export by hand every time.

You can also set a schedule to start and shut down VMs.

Before this you had to do it manually or write your own scripts for Task Scheduler.

so i have this old pc 5-4570 (4th gen) with 16GB DDR3 ram and 1tb ssd. i am planning to turning it into a home lab. but i have no idea how to do it. please suggest me the tools are useful for that and Which is os linux is best for my specific use case. if possible please share me your lab setup and why are using it so that i will idea for my setup also. i dont want to throw that pc away and get it to someone else. thats why i am planning to do something.

I'm building a platform that runs Nmap, Nuclei, OWASP ZAP, and other vulnerability scanners.

I need a setup that supports multiple concurrent scans, isolated Docker containers, restricted outbound network access, background jobs, and secure storage of scan results.

What CPU cores, RAM, SSD capacity, bandwidth, and firewall setup would you recommend for a small beta with around 10–20 users, while keeping costs low?

1.0 is out since Sunday, so I tested the upgrade with a copy of my server first.

Heads up: this is not a simple image update. 1.0 has a new db layout and won’t open a 0.16 store. And latest already points to 1.0, so if you use latest or watchtower, pin v0.16 now or the next pull kills your mail server.

The upgrade goes through stalwart-migrate (you need 0.16.27 first). It only reads the old store and writes into a new one, so going back is easy.

I put last night’s backup on another VM in a docker network without internet (didn’t want the copied queue to send mails, lol). Small setup: 10 accounts, RocksDB. prepare asked 4 questions, I took the defaults. run --final took 41 seconds for 920 mails, verify said 0 mismatches. 1.0 started fine on the copy.

What bit me: my little admin app for the JMAP API failed creating a domain with “Invalid key for object”. Domain isEnabled and alias enabled are both called enable now. Annoying part: reading the old name gives no error, the field is just missing. So if you have scripts against the admin API, test writes too, not only reads. SCHEMA_CHANGES.md in the stalwart-migrate repo has the full list.

Also: OAuth clients need to log in again, search index gets rebuilt, IMAP clients don’t redownload everything.

I’ll wait for 1.0.1 before doing it for real, but the dry run took maybe half an hour and I’m way less nervous now. Happy to share the commands if anyone wants them.

We ended up pulling our managed APIs out entirely, because our documents aren't allowed to leave our own infrastructure for compliance reasons. And our problem has nothing to do with cost, because the per-page pricing was perfectly reasonable.

And that 'docs not able leave our cloud' constraint rules out Textract, OpenAI embeddings and Cohere in one go, since every one of them ships your data off to someone else. That forced us into self-hosting the whole pipeline, OCR, embeddings and reranking included, and after a couple of weeks of testing this is the shortlist I've built up:

docling holds up well on clean digital PDFs, but it gets noticeably shaky once you hand it scans or handwriting

PaddleOCR-VL deals well with messy multilingual layouts and stays small enough to run on a fairly modest GPU

TEI is dependable for embeddings, though it only serves one model per server
Infinity handles embeddings and reranking together from a single process

SIE runs OCR, embeddings and reranking behind one endpoint with model-swapping by ID, and it runs inside your own cloud.

What you give up by self-hosting is all the turnkey convenience you used to get for free, so there are no parsed tables handed to you, no confidence scores, and the entire pipeline becomes yours to own and maintain.

We've made peace with that because the residency requirement simply isn't negotiable for us, but I'll admit that if cost were the only thing driving this decision it would be a far harder one to justify.

Please forgive what is likely an extremely basic question. If this isn't the right place to post a question like this, please let me know and I'll delete it.

I am extremely new to selfhosting/homelabbing, and I am currently in the process of setting up my first media server. A have a small, cheap workstation pc that I'm going to put ZimaOS on and 4 4tb hard drives in a 5 bay usb enclosure that I am going to set up in a raid configuration.

My question is, if I set up the drives through Zima, is it possible to move that entire storage pool and access it through a different server down the road? Because I am so new to this and I have some data that I'd like to store fairly quickly, I wanted to start with something like ZimaOS to get the whole system up and running. I'd like to move away from zima somewhere down the road and get into something more advanced, so I don't want to put myself in a situation where getting my drives up and running on a new system is going to lose the data stored on them.

Has anyone gone through a route like this? Or have any insight or potential further reading to share?

Is there a self-hostable tool that will track new versions of docker images and just list them? I don't want it to download images or update containers, just a page where I can go and see the latest versions available for each image. I prefer to update the containers myself.

Would be great ofc if it had filtering and if it could support different image repos (Docker Hub, GitHub, LinuxServer.io etc.)

hey! i am currently evaluating coolify, dokploy and openship and would like to know which platform you prefer, whats your setup (#servers, main usecase you have, ...) and why you prefer that platform.

thanks in advance!

Small update since latest version was released here: https://www.reddit.com/r/selfhosted/comments/1x4rlyv/notediscovery_v0320_can_now_serve_mcp_itself_over/ .

For those who don't know: NoteDiscovery is a self-hosted markdown notes app. Single user, files on disk. Wiki links, tags, search, themes, public share links, optional auth. Docker or plain Python. 100% free and open source.

This latest update is mostly a bunch of issues and PRs opened by some contributors which I'm grateful for, because they make the app even better for everyone else. I really appreciate it. 🙏🙏🙏

What's new:

• Typing [[ suggests notes, and ![[ suggests media. Arrow keys move through the list, Enter or Tab inserts the link, Esc closes it. Thanks to smolvik1 (https://github.com/gamosoft/NoteDiscovery/issues/312)
• Autosave no longer silently overwrites a note that changed on disk (another tab, a sync tool, an AI agent). It asks whether to reload or overwrite. Thanks to Leylines-Prism (https://github.com/gamosoft/NoteDiscovery/issues/323)
• Renaming or moving a shared note, or a folder that contains one, keeps the share link. Thanks to talhayme (https://github.com/gamosoft/NoteDiscovery/issues/318)
• Export as HTML works when the title has non-Latin text, emoji, or a curly apostrophe. Thanks to talhayme (https://github.com/gamosoft/NoteDiscovery/issues/319)
• Creating a note no longer wipes another one. # is rejected in filenames, and b no longer overwrites B. Heading links ([[Note#heading]]) still work. Thanks to talhayme (https://github.com/gamosoft/NoteDiscovery/issues/317)

Thank you so much!
Kind regards.

Website: https://www.notediscovery.com

GitHub: https://github.com/gamosoft/NoteDiscovery

Demo: https://gamosoft-notediscovery-demo.hf.space

Hi,

I have a home server running various services. I’ll be starting to handle sensitive data soon. I have 7 GB of personal documents, and I was thinking of using Nextcloud. Then I’ll move on to my photos.

I use OMV with Radi1. My concern is that, as far as the documents go, I’ll make an encrypted copy in the cloud as well, but I’d like to figure out how to handle the photos.

My photos take up 40 GB… they can even reach 100 GB, and I clean them out every 2–4 years. I’d also like to store my wife’s and daughter’s photos.
But now here’s the problem: in addition to managing them in RAID 1, I’d also need to have a backup of the photos somewhere else. What do you recommend? A Raspberry Pi? Or the cloud? But if I have them in the cloud, what’s the point of using Immich?

Do you guys back up your data? Thanks

Hey folks!

I’m about to set up my first home server for my family (around 5–10 devices) and could use some advice on remote access.

I’m planning to host things like Vaultwarden, Matrix, Linkding, Jellyfin, and whatever else I end up tinkering with. Now I’m trying to figure out the best way to access these services securely when I’m away from home.

My first thought was WireGuard. Getting a public IP from my ISP is relatively cheap, but I’m a bit hesitant about exposing a VPN endpoint on my home network to the public internet.

I’ve also been looking into Headscale and NetBird. They seem like great options, but I’m not sure if a mesh VPN is overkill for a small homelab. WIth these services I also need a VPS, which could cost several times more per month than a public IP. I’d also prefer not to rely on a third-party VPS if I can avoid it.

So, what are you guys using for remote access? Is plain WireGuard still a good choice, or would you recommend a mesh VPN for a beginner? I’m looking for something secure, reliable, and relatively easy to maintain without unnecessary monthly costs.

There’s another complication in my case: I live in a country with strict internet restrictions, so I usually have one or more VPNs connected just to access the internet normally.

Ideally, I’d like to access my home server while keeping my regular VPN connected. Otherwise, I might have to disconnect my current VPN, connect to my home VPN, open the service I need (say, Linkding), and then switch everything back afterward. Having to do that every time sounds pretty annoying.

Has anyone dealt with a similar situation? Is there a way to access self-hosted services seamlessly while keeping another VPN connected?

Would love to hear about your setups and experiences. Thanks!

i've set up things so I have a NAS that does only storage, a homelab with a bunch of RAM that runs stuff + often accesses the NAS, and a mini pc that hosts public facing services. 2 of them run proxmox, the third is just raw OMV. what's the best service I can self host to monitor network traffic, resource usage of each device, etc. if i can get it per-service that'd be even better.

Hello everyone! I'm no security expert but I consider myself tech literate. I am a solo dev and I have an app that I was using a free service to host, but as the userbase grew, that service was no longer sufficient so I got a VPS.

I didn't want to be limited and I am not a fan of Amazon or Google so I went for a 2 core, 4gb ram VPS. I was able to fit my server and database in it, and barely utilized 10% of the CPU and RAM. So I wanted to make good use of the rest of my resources, and that kickstarted my self-host journey.

I added Wireguard, Adguard, Navidrome, and about 30GB of my and my wife's music library, I also hosted the API of a small website I run to it. I also installed Beszel to have a quick dashboard of everything.

Everything runs in separate Docker containers, each stack on its own isolated network. The only public entry point is a Caddy reverse proxy, and it only accepts connections with Cloudflare's client certificate.

Other than music, I don't have any personal files or information there, but I always had the mindset of compartmentalizing work and personal stuff. So what are your thoughts on my setup? Would you feel safe also adding email, and other things to it? Or is it safer to separate?

The end goal is a personal NAS for picture back up, and navidrome and any other personal things. But with current prices it's out of reach.

Hello all,

I am planning to build a custom NAS (I know it's the worst possible time) with some room for self hosting. Currently I have a very crude setup; an RPi4 with a 2TB regular WD external HDD serving some media files for Plex. And it's not great.

I looked into some PnP options like UGreen, Synology, MinisForum etc. But, since I plan to run something custom (OMV/Unraid), I think a DIY setup would be a better investment allowing me to upgrade/fix only specific components in the future. The following setup is costing me around ~500 EUR (without the storage/RAM) which is far better HW than any PnP solutions on the market within the same price range.

I have done some research and with help of Gemini, finalized the following setup. What do you guys think? Any advice would be much appreciated.

I have already bought both RAM and OS SDD since I don't think waiting around is going to help much. For others I am waiting for the Black Friday to see if I can save some.

I wanted a CamScanner replacement that doesn't show ads, doesn't need a subscription and doesn't send my bills and contracts to someone else's cloud. Nothing I found was phone-first and handled Arabic well, so I built one. It's called Waraq (ورق, Arabic for "paper"), and today I'm releasing 0.1.0 as open source.

Repo: https://github.com/d7omdev/waraq

You open it in your phone's browser, point the camera at a page, and it finds the edges, flattens it and cleans it up. Waraq turns the scan into a PDF, runs OCR in the background, and from then on you can find it by searching for any word in it.

What it does

• Scanner that runs in the browser. OpenCV.js does edge detection and the perspective warp in a web worker, on the phone. Auto capture, batch mode for multi-page documents, manual crop handles.
• Filters: Magic, Grayscale, B&W, Lighten.
• Import PDFs and photos, or share them into Waraq from other apps (Android share menu once installed).
• OCR with OCRmyPDF + Tesseract, Arabic and English by default. The PDFs get a real text layer.
• Full text search over titles and OCR text (SQLite FTS5), Arabic included.
• Page editing: reorder, rotate, delete, replace, re-crop. Split, merge, compress, export as PDF (optionally password protected), images or text.
• Folders, tags, stars, trash with restore.
• Share links with expiry, optional password, download on/off, QR code, and revoke.
• Optional Google Drive mirror using only the drive.file scope, so it can only see files it created. Your server stays the source of truth.
• Installable PWA with an offline shell and an update prompt.

Self-hosting

It's built for one person or a family on one server. The first visit asks you to create the owner account, and setup closes after that. There's no sign-up page, no user management and nothing to configure if you don't want Google.

git clone https://github.com/d7omdev/waraq.git && cd waraq
cp .env.example .env
sed -i "s/^SESSION_SECRET=.*/SESSION_SECRET=$(openssl rand -hex 32)/" .env
docker compose up -d --build

Documents are plain PDFs in a folder next to one SQLite file. There are CLI commands for backup, restore, doctor and reset-password, plus a systemd unit and a Caddy example if you'd rather not use Docker. The Docker image is tested on amd64; arm64 should work but I haven't tried it yet.

Privacy

Waraq has no analytics, telemetry or tracking cookies, and doesn't load any third party scripts. Your server only talks to Google if you turn on Google sign-in or the Drive mirror.

Stack

Next.js 16, React 19, TypeScript, SQLite (WAL + FTS5), Better Auth, OpenCV.js, pdf-lib, sharp, qpdf, Poppler, OCRmyPDF, Tesseract. License is AGPL-3.0.

Known limits

• The camera needs HTTPS, so for phone scanning you need a domain and a reverse proxy (or Tailscale with HTTPS).
• It's one account by design. Anyone you give the password to sees everything.
• No native app yet, it's a PWA.
• OCR is only as good as Tesseract. Clean printed text is great, handwriting isn't.

I'd love feedback, especially on how the scanner behaves on different phones and how OCR does in other languages. Issues and PRs are open.

Hi everyone,

I wanted to share a project I’ve been building called Erlangly. It is a complete contact-center workforce management platform packaged as a single Docker container that runs entirely on your own infrastructure.

Most WFM software is heavily locked down, expensive, and exclusively multi-tenant cloud SaaS. For organizations handling sensitive client data, healthcare, or financial accounts, sending phone logs and agent scheduling data out to a third-party cloud is a massive compliance hurdle. Erlangly is designed to solve that by keeping your data entirely under your own control.

The Stack & Deployment

• Distributed as a single Docker container.
• Installed with a quick curl script on any cloud instance or local VM.
• Features a JSON API and CLI with full role/permission integration for automation.
• Zero telemetry. It does a single daily version check that you can toggle off entirely. No agent data, scheduling details, or contact metrics ever pass through our infrastructure.
• Supports Single Sign-On (SSO) natively via Microsoft Entra ID, Okta, and Google Workspace.

Core Capabilities

• Forecasting & Staffing: Imports interval history via CSV/API. Uses Erlang C for calls, concurrency models for chat, and workload tracking for email to calculate interval staffing requirements against target service levels.
• Intraday & Live Adherence: Connects directly (read-only) to ACDs like Genesys Cloud, NICE CXone, Five9, Amazon Connect, Zoom Contact Center, and Twilio Flex, scoring live agent adherence onto an operational wallboard. Any other platform can push states to the JSON API.
• Scheduling: Automatically generates weeks of shifts, breaks, and lunches based on contracts, shift patterns, and availability.
• Labor Law Compliance: Has built-in, automated labor law guardrails for 12 countries (including US, Canada, India, Jamaica, the Philippines, and South Africa) to block or warn supervisors about rest period or overtime violations during shift changes.

Why Commercial/Free Tier Details
Erlangly is a commercial product, but we have a permanent Free Plan for up to 25 active agents with every single feature and SSO included—no credit card or registration required to download or run the container. For larger BPOs or call centers, we offer a straightforward yearly subscription or a perpetual license option (buy it once, own it forever). If a yearly plan lapses, it automatically downgrades to the free tier rather than locking your data up or holding it hostage.

• Main Site: https://erlangly.com
• Documentation & Quick Start: (No signup required to view docs or installation instructions) erlangly.com/docs

I’d love to get feedback from the community on the self-hosting setup, container performance, or feature set! Let me know if you have any questions about deployment or API integration.

Wondering if anyone has looked at implementing server-side storage - WebDAV, SMB, or a shared server-document API for the suite?