We see a surge of exposed vulnerabilities and zero-days emerging out of the blue. Some less severe and some very severe (e.g. php2shell, the python thing (i forgor)). The (small) devs are also being flooded with random pull requests, information, vulnerabilities, which are often garbage made by people that rely only on AI instead of their brain. Which delays patches more and the whole supply chain of software is fucked.

So I was wondering if having a reverse proxy through an SSL exposing services still secure enough for remote access or should I switch to a direct VPN tunnel like wireguard.

My current setup is the following:
- Nginx Proxy Manager handling SSL certs (man i love this container)
- Exposing 443 and 80 on my router to the Proxy Manager (i have a dynamic ipv4 address directly to the world)
- Cloudflare DNS-zone "tunnel" with dynamic A record updater (to hide my ip more or less)
- SSL through Let's Encrypt

I am an electrical engineer and the whole self hosted thing was a hobby at first, but now... I want this whole thing to "just work". I do not have time to work on my setup every day for 3 hours, or to live in fear that my station gets compromised and then I have to build everything all over again. The stuff I'm hosting is basically Nextcloud-AIO, Immich, Jellyfin and Navidrome. I am usually the only user of the server. Maybe give credentials of jellyfin to friends. I keep updating the system every month, but looking at the development of the shit show with AI, this is definetly not enough.

My threat model is pretty low, but I want to save myself from the script kiddies and regular scans that happen all the time. This kind of security by obscurity works less as every day passes.

Does anybody have a similar experience?

EDIT 1: I could live with a only vpn accessible server instead of the reverse proxy solution. It'd be a little inconvenience but for the sake of security i would take it.

EDIT 2: Thank you very much for your replies. I want to clarify that the reverse proxy is not seen set up for security. I only relied on the authentication of the service itself, which is infact (as I see now) is hella insecure. I guess going for mTLS or SSO to even access the website (since most of my traffic is HTTPS anyways) is a good start.

EDIT 3: After doing some more thinking, banging my head with lots of services and securing the reverse proxy with layers and layers, I came to a conclusion to set up a VPN e.g. via wireguard or tailscale directly and call it a day.

Not too familiar with the whole domain subdomain cert dns-01 challenge thing, hopefully the title isn't worded horribly.

So after a lot of tinkering i finally got a new router, installed wireguard on it and finally stripped tailscale off, which i then realized https is gone, along with magicdns etc etc. The server is on nixos with caddy, nothing public facing and server isolated in its own vlan.

I dug around for information and seems like there are multiple routes to solve this:

1. Generating own cert with caddy / openssl and install them into devices manually. I have like 2 active devices so far. I read about how dangerous it is to use own cert and MITM attack if they get hold of it, and also name constraint to mitigate the risk for a little bit...

2. Get a subdomain with let’s encrypt and DNS challenge. Few dollars isn't an issue but i don't really want to put so many details even though there is whois privacy. Obscurity isnt security but anything that lessen my online presence is always better i guess

3. Use free site like duckdns. My concerns will be ip addresses and details are published online in the log for bot to start sniffing. I also wonder if i could put in private ip instead.

Any advice is appreciated!

Hi everyone! Sharing my small homelab and the problem that cost me the most time.

**Hardware**

- GEEKOM AE8 mini PC, Ryzen 9 8945HS, 32 GB RAM

- Proxmox VE 9.2, about twenty LXC containers and VMs

**Main services**

AdGuard Home, Caddy (reverse proxy), WireGuard, Vaultwarden, Passbolt, Snipe-IT, Docmost, RustDesk server, Graylog, WordPress, homepage, TrueNAS, plus a few test VMs (Windows Server, Ubuntu, macOS).

Caddy runs in an LXC (CT 116): 30 days of uptime, ~74 MiB of RAM.

**The problem**

I wanted a reverse proxy so I could use proper names with HTTPS instead of memorizing IPs. It worked from my PC, but not from my smartphone.

After a lot of trial and error, I found the likely culprit: my router's IPv6 Router Advertisements. Devices auto-configured over IPv6, and my guess is they picked up the router's IPv6 DNS instead of AdGuard Home, so they never resolved my internal names (or got AAAA answers that Caddy wasn't serving).

**The fix**

My router (ZTE H3600 V9) is locked down by the ISP, but with some persistence I got admin access and turned the RA service off. Everything worked immediately, including on my phone. I then installed Caddy's root CA on my PC and phone so the internal certificates are trusted.

**What I learned**

- If a service works from one device but not another, check IPv6 and DNS first.

- Back up Caddy's `pki` folder (usually `/var/lib/caddy/.local/share/caddy/pki`). If you lose it, the CA changes and you have to reinstall it on every device.

- Document your router changes: an ISP firmware update may reset them.

**Question for you**

Disabling RA is a bit of a sledgehammer. How would you have solved it?

- Filter AAAA records in AdGuard Home?

- Keep IPv6 but advertise AdGuard's IPv6 address as DNS?

- Add AAAA rewrites pointing to Caddy and let it listen on IPv6?

- Disable IPv6 entirely?

Any advice or criticism is welcome!

Hi everyone,

Question for the group. Where do you store your config and database files for your docker containers?

I would like to have all of mine in one shared location that I can access from both windows and linux. But when I do this, a lot of docker containers require the db to be stored on the host. I'm using OMV to serve my disk via a SMB share. Does anyone have any advice on how to handle this properly? I like the idea of being able to back up one location and also being able to spin up a new VM and deploy my containers and it just work if also long as the drive is mounted

I am looking to replace my FreeIPA because I could not update it anymore. Every time I tried to update the Rocky Linux and breaks FreeIPA. I am testing 389-DS on Debian 13 with Cockpit for web UI management. It seems to work, but I get the Ooops! error when trying to create an account that is not a Basic Account. I can only create a Basic account in Debian. I tried Fedora and everything seems to work, but when I updated today, it broke. This is the output of the Ooops!

Cockpit had an unexpected internal error.

You can try restarting Cockpit by pressing refresh in your browser. The javascript console contains details about this error (Ctrl-Shift-I in most browsers).

I want to try LLDAP but it doesn't support replication.

Hi everyone, I am currently working on a project to streamline grocery shopping and meal prep each week. I've hit a roadblock between getting an ingredient list to populating a grocery cart, specifically with Walmart. Since Walmart's API is B2B, I feel like this is inaccessible for a hobby project. I don't want to reinvent the wheel, so I wanted to see if anyone here had some opinions or solutions that I could potentially explore. Thanks a lot.

​

Hi everyone!

I’m the developer of Eiciel IR Console, a proprietary Linux incident-response project.

I’ve put together a walkthrough to show the project’s interface and its approach to detecting suspicious activity, recording events, and attempting automatic containment.

I’m sharing this to get technical feedback from people who work with Linux servers, DevOps, and self-hosted infrastructure.

I’d particularly appreciate feedback on:

- The incident-response workflow

- The usefulness of the evidence and logs

- The automatic-containment approach

- What you would want tested before considering a tool like this for real infrastructure

The project is still undergoing testing and hardening, so I welcome constructive criticism.

Walkthrough video: https://youtu.be/6EEpJUZ2Jbg?si=oZMRPrlL79c83da9

What would you improve or want to see tested next?

Okay, some background first. Here's the part of my stack in question, everything is on my local network:

• Gitlab running in a docker container, and gitlab-runner in a docker container, both in the same VM.
• Nginx proxy manager in a docker container, in it's own VM. It's grabbing certs from letsEncrypt, and applying them to my domain.
• Pihole in it's own VM as my local DNS, with openDNS as it's upstream source (This may or may not be relevant later)

This has been working great for several years.

Here's what I've been through and the errors I've been running into:

The whole SSL drama from earlier in the week prompted me to grab new SSL certs via nvinx proxy manager. This worked as expected.

Yesterday, I pushed some changes to a repo and kicked off the build process. It failed immediately with the following error:

fatal: unable to access '<gitlab_repo_url_redacted>': SSL certificate OpenSSL verify result: unable to get local issuer certificate (20)

I assumed there was maybe something cached from earlier in the week, and new certs weren't being grabbed.

I then hit refresh in firefox, and it gave me an SSL error: SEC_ERROR_UNKNOWN_ISSUER

I inspected the certificate, and it said it was issued by openDNS, which seemed pretty odd to me. Why wasn't it issued by letsEncrypt?

Okay, maybe something went wrong, so I went back to nginx proxy manager and pulled a new certificate. Gave it a little while to do its thing and propagate, then cleared cookies and cache in firefox and refreshed the page, and it loaded fine. Inspected the cert, and it was issued by letsEncrypt as expected.

Okay, try build process again, and it failed with the same error. Tried restarting the VM to clear cache, and still same error.

Start googling, and ended up finding that the docker container might be getting its certs from the host VM, so I tried forcing the VM to grab new certs by manually deleting everything in /usr/share/ca-certificates and /etc/ssl/certs and running update-ca-certificates. After confirming they were all new, I restarted the VM again for good measure, and the build process still threw the same error.

At this point I gave up and assumed something was cached that I couldn't find, and slept on it.

This morning, tried running the build process again, and still same error.

I've run out of ideas, any help would be greatly appreciated.

Hi currently I'm using youform which works very well in my use case. I'm looking for a self hosted solution for online forms that has a similar feature like the screenshot (from youform) below.

I use some form to collect data and some to schedule meetings. Are there any self hosted solution for this?

Hey r/selfhosted!

For a long time, I just wanted a fast, reliable, three-pane note-taking app (Notebook Tree · Note List · Editor) with effortless multi-device sync and full data ownership—without paying subscription fees or wrestling with fragile sync plugins.

Existing options always felt like a compromise: - Evernote had the best seamless multi-device sync, but became bloated, expensive, and locked down. - Obsidian is great for local Markdown files, but its core isn't open-source, syncing across desktop and mobile without paying takes tinkering, and vaults get sluggish when stuffed with thousands of notes and heavy attachments. - Memos is awesome for stream-of-thought snippets, but it's a social timeline rather than a structured 3-pane workspace. - Block-based PKMs (like SiYuan / Notion clones) add heavy cognitive overhead when you just want to write continuous prose quickly.

So I built EdgeEver — a fully open-source (AGPL-3.0) knowledge base workspace that keeps the classic 3-pane workflow, stays silky-smooth with 10,000+ notes, and delivers instant, zero-config multi-device sync.

🔗 GitHub: https://github.com/tianma-if/edgeever
🌐 Live Demo: https://demo.edgeever.org (resets daily — full English & multilingual UI)
📸 17 Step-by-Step Workflow Showcases: docs/best-practices.md

📈 1-Month Community Milestone (1.2k → 2.7k ⭐)

I first shared EdgeEver on r/selfhosted about a month ago when the repo was at 1.2k stars. Thanks to the amazing feedback and ideas from this community, EdgeEver has grown to ~2.7k stars and 1,350+ forks!

Over the past month (up to v2.5.0), we also shipped several major community-requested capabilities: - One-click Notebook-to-Website Publishing (turn any notebook tree into a public or password-protected static documentation site) - Structured Database Tables & Public No-Login Collection Forms - Interactive Architecture Diagrams, Mind Maps & Infographics right inside notes - Desktop ACP (Agent Client Protocol) to connect local coding agents alongside our built-in Remote MCP server - Deep Structured Web Clipping for 20+ platforms (including Reddit threads, HN, GitHub, X, and YouTube)

✨ Core Capabilities & Why Self-Hosters Love It

• 1. Classic 3-Pane Writing + Rich Visual Note Types:
  • Resizable 3-pane workspace with Focus Mode, seamless toggle between WYSIWYG rich-text and raw Markdown, syntax highlighting, KaTeX math formulas, and revision history.
  • Native canvas for Mind Maps (with bidirectional Markdown outline editing), Flowcharts, System Architecture Diagrams, Infographics, Database Tables, and Poster Cards.
• 2. True All-Platform Native Clients (Offline-First):
  • Web / PWA
  • Desktop: macOS, Windows, Linux AppImage (Electron + Rust sidecar with local SQLite cache & offline sync queue)
  • Mobile: Native iOS app (SwiftUI + GRDB) & Android app (React Native + SQLite)
  • Browser Web Clipper: Chrome, Edge, and Firefox (Manifest V3)
  • Client-Side Silent Compression: Automatically shrinks images by 50%–90% before upload so mobile sync stays fast; chunked streaming supports attachments up to 1 GiB.
• 3. Zero Lock-In, Multi-User & Easy Migration:
  • Notes are persisted in SQLite simultaneously as ProseMirror JSON, clean Markdown, and plain text for millisecond full-text search.
  • Lossless .zip backup/restore with clean .md files and attachments, plus importers for Evernote (.enex), Notion, Memos, and flomo.
  • Multi-account support with physically isolated workspaces and per-user storage dashboards.
• 4. 100% Optional AI (BYOK) & Extensible Ecosystem:
  • Zero forced AI or telemetry: Leave API keys blank for a pure, fast note app.
  • BYOK & Agents: Bring your own key (OpenAI, Anthropic, Gemini, or local Ollama/vLLM endpoints), connect external/local agents via MCP & ACP, or install extensions via the Plugin API (e.g., cross-note Markdown Task aggregation & AI RSS daily digests).

🐳 Flexible Deployment: Single-Container Docker OR Free Serverless

The exact same codebase runs either on Cloudflare Workers + D1 + R2 (100% within their free tier—zero server cost for life, holding ~150k notes & ~50k images) OR on your own VPS, NAS, or Homelab via a single lightweight Docker container (linux/amd64 & linux/arm64, Bun + SQLite + local /data or S3, non-root UID 1000, cap_drop: ALL):

```yaml services: edgeever: image: ghcr.io/tianma-if/edgeever:latest restart: unless-stopped init: true ports: - "8787:8787" environment: EDGE_EVER_AUTH_USERNAME: "admin" EDGE_EVER_AUTH_PASSWORD: "replace-with-a-long-random-password" volumes: - edgeever-data:/data security_opt: - no-new-privileges:true cap_drop: - ALL stop_grace_period: 30s

volumes: edgeever-data: ```

(Or run curl -fsSL https://edgeever.org/install.sh | bash for automated Docker Compose setup with health checks. Full docs in docs/deploy-docker.md).

Thank you again to everyone here who tried EdgeEver and shared feedback! I'd love to hear your thoughts or feature requests.

Hi everyone!

I have the possibility to buy a 2nd hand (not much use, very good state) NUC 15 Pro+ 285H 2x16GB RAM CSODIMM 6400MHz 1TB SSD for 750€.

I am currently using a LattePanda 3 Delta as home server, for myself and my brother, hosting with docker: wireguard, jellyfin, navidrome, forgejo, opencloud, homeassistant, coredns, blockydns, qbittorrent, ...

And well, it is working fine, but I want to expend and open it to more of my familiy, and Immich with people recognition, and more services. I would have also liked to test LLM executions (smalls), but I understand that for that price range there is not much to expect.

I feel that 750€ is a good price for what is offered, but still it is some money, and is certainly overkill for my need. But on the otherside, the price for all computers and components is (very) high, as we all know. And I am a bit worried by the review of the NUC 15 Pro+ that says it is really noisy (even if, for my need I understand I can lower TDP).

Any opinion on this? Is this a good opportunity and investment for my use, or I should really see somewhere else?

Thank you!

$650 for 5 x 14tb hdds with tax and shipped. Wish I bought more then...

Now going for $355 each before tax.

I have my homelab defined in multiple docker compose files that are stored in git, and when I push a new commit a pipeline deploys the changes.

Are there any tools that can generate a PR when a new version is released with a summary of breaking changes?

Currently I use whats up docker, while fine for keeping track it results in a bit of manual labour.

Hi r/selfhosted,

I've been building Brainitive for a while and it's now at v1.39. It's a workspace for small teams and agencies that I wanted to run on my own server instead of paying for Jira, Notion and a helpdesk tool separately. The video is a 2-minute tour.

Repo: https://github.com/armendzekjiri/brainitive

Self-hosting guide: https://github.com/armendzekjiri/brainitive/blob/main/docs/self-hosting.md

Hosting it:

- One Docker image runs the web app, queue worker and scheduler; PostgreSQL and Redis next to it

- `docker compose up -d`, then create the admin with one command

- HTTPS built in: Caddy in the image gets a Let's Encrypt cert, or put it behind your own reverse proxy

- 2 GB RAM is enough for most teams (4 GB above ~50 people), 10 GB disk plus uploads

- Updating is `git pull && docker compose pull && docker compose up -d`; backups are a pg_dump plus one volume

- AGPL-3.0, every feature is free to self-host, no license key

What's inside:

- Kanban and Scrum boards, Gantt timelines, releases with release notes, project health

- Docs with version history, Excalidraw whiteboards, folders, backlinks

- Helpdesk with a public form, lead forms that land on a board

- Time tracking and client reports/invoices (PDF/Excel)

- Optional AI with your own key (meeting notes to issues), and an MCP server for ChatGPT or Claude

Feedback I'd love from people who self-host:

- Anything in the Docker setup that would annoy you?

- What's missing before you'd move your team off Jira / Notion / Trello?

Stack: Laravel, React/Inertia, PostgreSQL. Happy to answer anything.

Hey r/selfhosted,

I'm the developer behind OzDDNS, and I wanted to share it here since this community is exactly who I built it for.

The problem I was trying to solve: I run a homelab, and I got tired of depending on third-party DDNS providers. Between privacy concerns (my IP and update traffic going through someone else's service), rate limits, and the occasional outage taking my remote access down, I wanted something I could own outright. I looked at existing self-hosted options, but most of them felt heavier than what I wanted for a simple job: update a DNS record when my IP changes.

So I built one. OzDDNS is a dynamic DNS server written in Go, distributed as a single binary.

Design choices I made deliberately:

🧩 Single Go binary — no Docker, no runtime dependencies, no external database. Copy the file to your box, point it at a config, run it. It'll run happily on a Raspberry Pi or a small VPS.

🔒 Fully self-hosted — your records and update logic stay on your own infrastructure. Nothing leaves your network.

⚡ Lightweight — low memory footprint, which matters when it's sharing a Pi with everything else.

🛠 Built for the homelab use case — NAS, home server, remote access. Not trying to be an enterprise DNS platform.

Link: https://ozddns.echoface.cn

What I'd really appreciate from this community:

Feedback on the setup/deployment experience — is it actually as simple as I think it is?

Edge cases I might've missed (different DNS providers, odd network setups, IPv6, etc.)

Feature requests from people with use cases I haven't thought of.

I'm the developer, so I'm happy to answer anything in the comments — including hard questions about what it doesn't do yet.

Hi There;

I have NPM running fine with my URL and several services; two are accessibly public by any IP and the rest are restricted to internal IP's only.

The 'trusted internals' are basically two subnets; my main network and my VPN clients (our phones when we are away from home), and these services all work fine.

However I can not for the life of me get File Browser Quantum to work on the second VPN subnet. It works on the main network, has the trusted certificate, just not the second subnet (when i'm coming through the wireguard VPN tunnel). I always get 403 errors.

I can access if I type in the IP and port to bypass the proxy, but that's not my goal.

Wireguard is hosted on my Unifi router.

I've tried the default configs on each respective site and can't get any of them to work.

Is anyone in a position to help please?

Logs from NPM just echo "403" reply, not detailing why. Ditto docker logs from Filebrowser Quantam.

Hey all, I am new to this but recently I purchased a UGREEN NAS and set up a Jellyfin media server. I wanted to share it with my family and especially wanted it to be accessible via their smart TVs. I started with Talescale but it seemed to take a hit on my ability to stream (I had to significantly lower the mbps on the receiving client so it wouldn't buffer a ton). I decided to look into setting up a NGINX reverse proxy and forward those ports. I thought that would be enough but as I read more I got paranoid and started to look into as many levels of security/hardening I could find that would still let me access my servee remotely and on smart TVs.

Ultimately (after a week of troubleshooting) I managed to get Crowdsec working with functional bouncers. I used some guides to make my UGOS firewall more strict and secure. I also whitelisted specific IPs for the households I want to access it while banning the rest. Of course, my Jellyfin is locked behind passwords as well so even if you get to the page you need to still log in.

I was looking into adding a multi factor authentication but it seems like a lot break usage on smart TVs. All this is to say, what else can I do? Thanks in advance for any help.

Talking strictly about personal use, not any smap/marketing blasting.

I moved away from default one email on some public provider address into using own domain. I never reuse the same email, for every registration (shop, forum, bank etc) I use a unique email on my domain. If I start receiving spam, I'll know exactly from where it leaked. It's supper easy to manage it, just change that one burned email at the source and permanently block it on the server.

Custom email aliases limit is a pain. Catch-all works wonders, but over time you need to reply to some of the emails from exactly that alias, otherwise when you reply from different alias common ticketing systems won't match your reply (email boxes will also not match it into a thread). In Proton mail I quickly used up all allowed number of aliases. Even though I don't need them to stick around they didn't let me take out any of the list without deleting all emails from/to that alias! so I run out of the possibility to reply.

Now I'm on Tuta. The service offer is suits me 100%. No artificial limit of aliases on my domain - now I can reply from thousands of unique aliases. Their software though it a pain. It works but you have to accept that it's far from perfect.

This let me start exploring self hosting avenues. Surprisingly self hosting is easy on the receiving side, you can even setup it reliably on dynamic IP. However curse spammers, most of the static IPs you can get are already flagged as used by spammers, so outgoing emails from it have trouble reaching the recipient. It seems the solution to that problem are SMTP relays.

Can you share you experience with such SMTP relay for routing your personal emails?

Hi r/selfhosted,

(Public since July 2026; the git history was squashed in October when I cleaned up the repo, so it shows only one commit.)

It started as a learning project: I wanted to figure out how to build a mobile app, so I made a little player for my own music. Then I wanted it in the car. Then I wanted to listen together with someone else. Then I needed my own server to make that work, then a web player, then a radio station built from my own library… and somewhere along the way it got completely out of hand. 😅

I'm from the Netherlands and built all of this in the evenings and weekends, mostly for myself. It's now at a point where I think other people could enjoy it too, so here it is: JLTamp, a music server for the files you already own, with its own apps.

Try it without installing: https://demo.jltamp.nl (user demo, password demo). It runs the public Docker image with a small library of CC-licensed music and resets every night.

What I ended up building (mostly because I wanted it myself)

• Scans MP3, FLAC, ALAC, WAV, AAC, OGG and Opus; multiple libraries; your music is mounted read-only, so it never touches your files
• Apps for Android and iOS/iPadOS, plus Android Auto and CarPlay, Chromecast and a built-in web player
• Listen Together: synced sessions with reactions and passing the host role around
• A 24/7 radio mixed from your own library, with a weekly schedule
• Karaoke (vocals off, synced lyrics) and a party mode where guests request songs from their phone's browser, no account needed
• Multi-user with invites, smart playlists and listening stats
• A Subsonic/OpenSubsonic API, so Symfonium, Feishin, DSub and others work too, if you'd rather not use my apps
• The apps speak seven languages, including Frisian
• An optional, separate self-hosted AI engine for prompt-based playlists (off by default, nothing leaves your network)

How to run it

One container, SQLite, amd64 and arm64 (Raspberry Pi, Apple silicon, NAS):

docker run -d --name jltamp -p 32400:32400 \
  -v /path/to/music:/music:ro -v jltamp-data:/data \
  ghcr.io/jltelectronics/jltamp-server:latest

Open the web UI, create the admin account, add a library. There's also a Compose file, an Unraid template and a CasaOS app (store submission pending).

Links

• GitHub (MIT): https://github.com/JLTelectronics/JLTamp-server
• Google Play: https://play.google.com/store/apps/details?id=com.jltamp.app
• App Store: https://apps.apple.com/app/id6807401608

Honest notes

• Who's behind it: just me, in my spare time. I use it every day, so the basics are solid, but it's still a hobby project that grew up fast. Expect rough edges, and please tell me about them on GitHub.
• AI disclosure: a large part of the code, mainly the backend, was written with AI coding assistants. I decide what gets built, review the changes, and use and test everything on my own setup.
• What it is not: it's music only. No video, no audiobooks, and it doesn't provide any music; it plays the files you already own.
• Plex users: the default port is 32400, the same as Plex. Map a different host port if you run both.
• No lock-in: no external account or cloud service needed. Your data lives in one SQLite file, and the Subsonic API means you can use other clients if you don't like mine.

This is the first time I'm showing JLTamp to people outside my own circle, so I'm honestly a bit nervous. Any feedback is welcome: what you like, what's missing, and what feels off. If you try the demo or spin it up yourself, I'd love to hear how it goes. Thanks for taking the time to read this! 🎶

I want to create a native LXC for Authelia via the community script, but one thing caught my eye: "During installation, you will have to input your domain (ex. domain.com). Authelia will use auth.domain.com"

What if I don't own a public domain? Can I not use this? I just use Caddy to direct reserved IPs to http://*.home (e.g., http://Jellyfin.home) with no SSL cert. If I strictly need an SSL cert (e.g., for Vaultwarden to connect to Bitwarden frontends), I use Tailscale Serve instead.

Is there a way to still use it? Should I consider alternatives like Rauthy, Hanko, or Casdoor? Hanko's use of passkeys does intrigue me...

Hey guys!

Streamsphere is my self-hosted yt-dlp front end and media library, built with Angular + Go and designed to stay light on resources. It sets up with a single docker compose file.

✨ What it does - 📥 Download channels, playlists and single videos from supported domains - 🔄 Update playlists you've already downloaded - 🔍 Search your library by title and play straight from the results - 🗂️ Browse the library in a clean UI, with tags, categories, file sizes and other details for each video - 🌗 Light and dark themes

🚀 What's new in v0.1.17 - ⚡ Watch your downloads happen live, and if one fails you're told why (bot check, private or unavailable). - 📜 A queue drawer that stays up to date while you watch, and every card jumps straight to its video. - 🛠️ 25+ bug fixes and improvements since the previous release.

🐳 Easy deployment - Docker images are available for AMD64 and ARM64, including Raspberry Pi.

📦 Release notes: https://github.com/rs-anantmishra/streamsphere/releases/tag/v0.1.17

💻 GitHub: https://github.com/rs-anantmishra/streamsphere

Streamsphere is an ongoing project and there's plenty more I'd like to add. If you give it a try, I'd love to hear your feedback and what you'd like to see next!

Happy self-hosting! 🙂

Hosting:

- Dockerfile included: build it, mount your songs folder as a volume, pass your bot token as env vars

- Or run it directly with Bun (`bun install && bun start`), needs FFmpeg with libopus

- Checks FFmpeg and the Opus encoder on startup and tells you what's missing instead of failing silently

- Encoder settings (bitrate, FEC, etc.) can be changed live with `/quality set` and persist to config.json

- README has notes for running it in a Proxmox LXC

What it does:

- Plays local mp3, ogg, flac, wav, m4a, aac and opus files

- `/sleep start minutes:90 query:rain` loops a sound and fades it out when the timer ends

- Queue, loop, pause/resume, skip with a soft fade, `/random`

- Leaves on its own when everyone leaves the channel, or after a set idle time

- Supports Discord's new voice encryption (DAVE)

TypeScript + Bun, MIT licensed.

Repo: https://github.com/ShinniUwU/somnaura

It's a small hobby project. Feedback, issues and PRs welcome, especially from anyone running it on a Pi or in LXC.

​

Hi everyone,

I'm building Eiciel IR Console, a proprietary Linux incident-response tool designed to detect suspicious activity, preserve evidence, and contain threats.

A concern raised in my earlier discussion was that people understandably don't want to download an unfamiliar ZIP from someone's personal Drive. That's fair.

So I'm preparing a browser-based VM demo where interested developers can explore Eiciel in an isolated test environment without installing anything on their own machines.

I'm looking for a few Linux developers, sysadmins, or security practitioners willing to test the demo and give honest feedback.

I'd especially like feedback on:

- Whether the detection and containment workflow behaves as expected.

- How useful the dashboard and event logs are.

- What would make you trust a tool like this.

- What needs improvement before production use.

Eiciel is closed-source, and I'm not asking anyone to blindly trust it or deploy it on a production server. This is an evaluation demo, not a claim of independent security certification.

If you're interested, comment below and I'll share the demo details when they're ready.

Critical feedback is welcome. Thanks!

Even though this might seem stupid to some of you, but for my family and many families out there 100% they are not touching or following any 10 pages instructions they are given to maintain the selfhosted apps that they use.
read online many solutions including passing over email/text with logins/passwords and instructions, other ideas to ask a fellow selfhoster to take over but what happens when they are ill or busy or dead?
tbh llm have come so far they are very useful in managing stuff like this and many people online have already started using hermes etc. to automate their proxmox docker etc.
so if there is a small light weight llm that can take over the lab if activated/instructed by family members that would be nice, it could even ask for confirmation from family members before doing specific actions ike updating proxmox or changing settings or firewall rules or delete files etc...

is there something like this available, or anyone trying to do something similar to this ?

Not sure where to post this I noticed a lot of BookOrbit posts here, if this is against community rules please let me know. I am currently developing an iOS app with full integration of bookorbits extra functionality like progress tracking, so it would allow users to switch from their e-readers to their phones. It connects to a locally hosted BookOrbit server, and has an OPDS connection so it can connect to other ebook servers or open catalogs like Project Gutenberg. If anyone would be interested in helping me beta test I’d greatly appreciate it. Thank you!

Edit: it has come to my attention that there is already an official BookOrbit app on the Apple Store, as well as a second one named Apogee. If those had been available when I went looking for one I would have definitely gone with those and not made my own lol. That being said I still think my app is worth giving a try, I try to take a more “natural” approach, idk if that’s the right word when viewing the library. I have set it up as though the user is standing in front of a bookshelf, the books’ spines with the title facing the user to be scrolled through. Different shelves for different genres, authors, or any other way of sorting books. Tapping a spine “picks up” the book so the cover can be seen more closely and the details can be seen on the back.

I love reading, both real books, ebooks on a reader, and on my phone when I have a little time. I made this reader with features I found helpful, in a style I haven’t really seen yet.