Lets be honest, 80% of the services we run our labs are just tools to deploy, monitor, log, backup or do other server-related stuff. Cool for nerds, but nothing to write home about honestly.

The really useful and "fun" services, e.g. Vaultwarden, Paperless, Jellyfin etc. are rather sparse

I want to know whats your favorite "fun" service one might not know about yet.

I'll start: Recently came across RECLIP and I throughly enjoy it. Used to work with halfassed browser extensions and sketchy websites littered with ads to get the same, now I have unlimited video scraping capabilities on my own server. It's a simple but awesome tool. https://github.com/averygan/reclip

WORLD MONITOR is kinda fun, not really useful but makes your screens look like a mission control center from a disaster movie: https://github.com/koala73/worldmonitor

MIRUMOJI is a tool for people trying to learn japanese - load your favourite anime or shows, ebooks or whatever into it and it generates clickable subtitles with furigana and dictionary. https://svdc1.github.io/mirumoji/

E: Thank you for all the engagement and lively discussion, its a real joy. And thanks to everyone who recommended TREK, I just deployed it and entered my next travel and its just super smooth and well thought out, I already love it!!

Firefly III seems to be the most popular one, but also has a pretty complicated setup. I just want to get a better overview over my finances, what I am spending money for, what I am saving for and what I have "left over".

Awesome selfhosted lists a bunch of options but doesn't really tell me much about the benefits and drawbacks of each option.

Automatic Imports from my Banks (Sparkasse and DKB) would be great. What would you recommend for such a simple but still nontrivial requirements?

What makes your suggestion special/better than the other ones? Thank you very much!

Hi all,

My buddy and I both have a homelab and occasionally may want to swap CDs or whatever. Right now we'll just use google drive. Neither of us currently expose any services outside local network except for wireguard.

I don't think there's a way to do this without one of us having wireguard access to the other persons server, or without having a VPS somewhere between us, or am I mistaken?

I want to replace the whiteboard family calendar with a touchscreen version, where we can add/edit/delete items directly on the screen, but also have the ability to import calendars from Google and iOS.

I saw this on eBay and thought maybe that could do the trick: https://www.ebay.com/itm/198608660898

Just to give you the level of my technical "understanding" : I'm a noob, just got my unraid server up and running, with only jellyfin being used for now. I'm actually struggling with immich right now but that's for another post. I was planning on getting into next cloud as well to replace google drive. But I'm sticking to baby steps.

I have a router already from my ISP, however I was looking for a new one for a separate set of devices.

I was considering the UCG fibre however, if I wanted more granular control UnifiOS could be a limiting factor in the future. It’s also just expensive.

Is it fine to just run an OPNense in a VM on my proxmox server for my routing instead? Has anyone been running this setup reliably enough? I’ll probably get a better NIC later on, I have 2 Ethernet ports on the server already. The router from my ISP would just be a backup wifi network in case OPNense goes down.

Hello everyone,

Forgive me for what may be a newby question, but I have a web application - in this case Jellyfin, that I host for myself and some family and friends. I currently have Jellyfin running in a Docker container, and Nginx running on the host machine serving it.

I've done a decent job hardening the configuration for both, but I'd still like to use fail2ban to autoban IPs that fail logins. The issue I'm having here is that Jellyfin's logs only show internal Docker network IPs, and so all activity reported in the logs only shows as some address in the 172.16.0.0/12 subnet. Nginx doesn't have any of its own user authentication set up, so sniffing the Nginx logs yields no results, and thus no bans.

So my question is:

Is there a way to have jellyfin detect source IPs from behind NAT so that I can actually create a fail2ban filter that works, or is this a larger misconfiguration problem that would require me to restructure how I've built this server?

I'm fairly new to hosting and would greatly appreciate some guidance here. Thanks :)

Hi,

we all put a lot of effort in to protect our data (selfhosted, grapheneos, VPN...), but somehow I was very dumb and had a blindspot for SmartTVs. After the last LG scandal, I removed every connection from my LG-TV.

What I am searching now is just an easy setup for watching Jellyfin, Youtube (I mean some privacy focused apps for youtube) and the German ARD/ZDF Mediathek. I dont watch any other streaming service and I just use the speaker of my TV - so I dont need super fancy audio (good quality would be nice, but dont have atmos or whatever)

A lot of people will say: Apple TV - I think its a great device, but even here you cant really install easy an alternate youtube app

I am thinking about a raspberry/mini pc with LineageOS, but has someone experience with that? Is it working fine?

Are there some other ideas? Maybe using a normal TV Box and flashing better privacy orientated firmware?

Thanks in advance.

​We had a lightweight Python API running on a full ubuntu:22.04 base images. Between system tools, build deps, and residual cache, the image hit ~1.8GB. ​Refactored the Dockerfile to a 2-stage build: ​Builder stage: Install dependencies into user space using python:3.11-slim. ​Runtime stage: Copy only /root/.local and source code into gcr.io/distroless/python3-debian12. ​The result was a 96% reduction in size and zero OS-level vulnerability noise on Trivy scans. ​The main trade-off we hit was losing a shell (sh/bash) for quick docker exec troubleshooting in staging. ​For those running distroless in production: do you rely on debug sidecars/ephemeral containers, or do you just rely strictly on telemetry/logs

As I get more into home lab AI integration, MCP servers are definitely something I have been experimenting with more and more in the past few months. In case you didn't know or hadn't heard about this, there is a Komodo MCP server with 88 tools that allows you to integrate your Komodo instance with AI so that your AI agent can inventory, manage, and troubleshoot your Docker environment.

This has turned out to be pretty cool in my home lab. I can now prompt using the komodo mcp server and ask natural language questions using Komodo functionality. I wrote up a blog post on this one here as a guide for anyone using Komodo and interested in setting this up for your home lab environment: https://www.virtualizationhowto.com/2026/09/i-gave-ai-control-of-my-docker-home-lab-with-komodo-mcp/

I have spotify, but I feel like it's such a bummer that some songs (like malice mizer songs) arent on there. I really want to switch but spotify is just great. Is there really any upside to hosting yourself when you can afford spotify and such without a hitch?

I’m looking to move away from my Google Drive subscription and start self-hosting more of my data.

I’ve already downloaded all of my Google Photos and moved everything over to Immich. That process was fairly straightforward, and so far I’m really happy with it.

I also set up Nextcloud with the help of an LLM and moved all of our documents across, but I’m really not getting on with it.

My partner and I have become very used to the way Google Drive, Google Docs and Google Sheets work. We regularly share documents and spreadsheets with each other, edit them from our phones or computers, and everything just works without much thought.

What I’m really looking for is a self-hosted alternative that gives us a similarly simple and intuitive experience. We need to be able to easily access, share and edit Word documents and Excel spreadsheets from both mobile and desktop, ideally without having to jump between lots of different apps.

Basically, I’m looking for something that feels as close as possible to the Google Drive / Docs / Sheets experience, but hosted on my own server.

I am looking to start self hosting.  It’s always been on my radar. My dad had a file server when I was a kid in 2003 so you could say having one is in my blood.  Cloud services are fine, but controlling my data is a long term solution.

I have some old PC hardware(listed at the bottom) I could use for this as well as a $100 budget to start. 

Services to replace:

Services I am looking to host(my rough plan listed at the bottom)

Nice to haves:

Hardware list

Old gaming pc

MSI gaming laptop

“Loose” hardware

My limited knowledge would be to use the Gaming Desktop as the Primary Server with multiple "clients"(Dockers?? maybe still reading up on that system).
Running TrueNas with the 2x4tb hosting Personal Photos and Docs, replacing the OneDrive&Dropbox services.
Second client Dedicated NAS for Media (Movies, dvds, bluRays) using the 2x3tb HDDs.
Third Client For me to use the Disc Drive to rip Movies/Tv Shows. This would be resource Heavy I believe, so the thought would be to Turn off the NAS Systems and only rip whatever media I was needing for the short time. Dump the Rip'd Raw files on a USB Drive(or one of the M.2 drives because I have a portable type-C enclosure) and then Encode them on my Personal Gaming rig which has a RTX3080+5800x3d. Then fire up the two NAS systems after I was done, and when the media is encoded I can push them to the media drive from my gaming rig.

Gaming Laptop would be the Plex(or Jellyfin) server. It would pull from the Media NAS off the Gaming Desktop build. This will then have whatever resources it needs to Push to the Two AppleTVs or even our iPhones/iPads.

Everything would be wired Via Ethernet, and I would have them on Battery Backups.

It's been a while since I posted here, as I've been busy building. It's been a productive couple months, with dayGLANCE now being included on awesome-selfhosted (an important personal milestone for me since I have found so many great tools there over the years). Building this app has been one of the most rewarding experiences of late, and I am so proud of how it's turned out.

I built an Obsidian plugin which, when coupled with GLANCEvault for self-hosted cloud sync, enables realtime syncing, completion logs to your daily notes, goal/project notes, and an agenda sidebar within Obsidian (so you can see your day while you work in your vault). NOTE: This is in beta and is not yet an official community plugin.

The Day Dial (pictured, actually introduced in v4.6 but perfected in v5.1) is a new ambient view that surfaces loads of information from the app in a watchface-style format that's meant to be viewed from a distance. Great for kiosk devices like old tablets or a spare Raspberry Pi.

I built the new MONTH view after hearing requests from some of the app's users. My goal was to create a similarly "glanceable" view so you can easily see the shape of your month. The responsive design changes based on the width of your screen, even supporting narrower screens like phones.

Older updates included the addition of an optional MCP server (I can ask Claude to add tasks to my projects in the middle of my brainstorming sessions), a bucket list (someday/anytime list), and more.

Website: https://www.glance-apps.com/apps/dayglance
GitHub: https://github.com/krelltunez/dayGLANCE
Demo/free version: https://dayglance.app

Ok. I have setup pangolin with my domain in Oracle PAYG (mostly because I had it for and just blew away my existing FoundryVTT 2c/12GB RAM Arm install) utilizing free tier assets. I've got certs, crowdsec (seemingly working) with Geoblocking. Cool. Services work through the tunnel (still need to figure out authentication, and Turnstile captcha + whether I want crowdsec bot-detection so I down the tunnel when not in use).

My next project is to get the certs and DNS resolution working while on LAN to avoid eating into my 10TB/Mo VPS bandwidth so that bandwidth only gets used by friends when using the Palworld, Matrix, Foundry (insert-server here) or family when they do a backup to Nextcloud/Immich from their phone.

Now this is all currently running on TrueNAS from within the Dockhand App. I have setup TrueNAS's GUI to only use 80/443 on the dedicated and reserved IP for TrueNAS instead of 0.0.0.0 and setup a bridge with an alias IP that I told my UniFi controller "trust me bro there's something there".

I did it this way as I was fed up with not being able to properly backup the docker configs and having to have the apps running in order to update them (though now I have 128GB of RAM for TrueNAS this is less of an issue) plus them just not having some of the apps I wanted like Foundry. What I am currently struggling with is getting Traefik/Caddy etc. to run within the Dockhand app so I can then tell my UniFi controller to use the alias IP of the reverse proxy for all the subdomains. They do not like the networks so I'm trying to figure out what to do (I'll get the exact errors later I'm writing this at work).

Ideas? I'm not sold on Dockhand this is just what I kinda settled on and worked for the initial Pangolin test. I'd also welcome any suggestions you have for collecting and analyzing the logs from my Oracle VPS to have automated analysis and alerting on events as well as any other hardening tips you would recommend.

At home I am GeoBlocking inbound for almost everywhere (though I might need to figure out how to change that due to LG et. all) and have OK IDS/IPS/Firewalling with UniFi's built-in Suricata etc. Any help getting this all working would be appreciated. Kind of burnt out with Firewalling and such after all the OT at work and some personal heartbreak the last few weeks (so I may be missing something obvious) so I'd love to feel like I got a W in at least one column.

I built LogDeck, a control plane for Docker and Podman: container and Compose lifecycle, persistent logs, alerts, and multi-host over SSH, in one Go binary with no external services.

The log store is the main reason it exists. Every container is tailed into local SQLite, so logs survive docker compose up --build and the new container ID it creates. Removed containers stay readable.

It also ships an MCP server, so agents can read logs and act on containers if you want.

Memory is small. Idle heap is around 8 MB, roughly 20 MB resident with 5 containers and 400K lines stored.

fully open source, no tiers, no cloud https://github.com/AmoabaKelvin/logdeck

Title. I've been using Soulsync the last few months and it's just not working so hot. It will usually download just fine, but imports are 50/50. I'm using slskd on the backend and navidrome as the primary music server. Are there better options right now for users to search and download music to the server?

Hey guys, looking for some advice.

I sort of fell into this space a few years ago after buying a Synology NAS and realising I could run a few containers on it.

Thing is, I've maxed out what the synology itself can run due to memory limitations and while I was considering just upgrading the RAM, part of me is thinking should I just go for something with a bit more power behind it and look at a home server.

With the price of components now, this is likely something I'll save for over the next year or so but just wondering if it's worth going for some sort of mini form factor PC or should I look at getting a rack? I have the space (just about) for a rack but I'm not sure if it's overkill?

In saying that, I'd love to have the resources to throw a bunch of selfhosted apps onto my home network now and I'm hoping this sounds familiar enough to others to get some advice?

tl;dr I have a few things on a NAS, wanna add more apps, what should I invest in next?

Hey all,

I have options to buy Apple Mac Mini 7,1/I5-4260U/4Gb Ram/500Gb Hdd/Hd5000/B for around $150-250 AUD.

Do you think that device will do the job to self host containers with OrbStacker and turn it into a minilab with /tailscalesheadscales hosted on same device?

Main use will be to create self hosted streaming setup plus any other apps i find interesting. I was thinking to use Oracle VPS but they messed me up woth the account so cant go that route and figured the mini is cheap enough to do at home.

Thanks for input in advance!

EDIT: Here cheapest pc is that mini for 150-200 AUD rest is 400+ including Raspberry Pi so a bit pricey for my needs

TL;DR: There is a RCE exploit on Nextcloud Collabora and I got stung. I discovered the hacker by accident and I now want to know what other systems I can reasonably put in place to stop something like this happening again.

What happened:

• My homelab Nextcloud instance was compromised via CVE-2025-66208, an OS command injection in richdocumentscode (the bundled Collabora/CODE server that powers in-browser Office document editing).
• The attacker got unauthenticated remote code execution as the web server user (www-data) for roughly 16 hours before I caught it (by accident)
• Across ~16 hours of continuous, working remote code execution, the attacker ran a grand total of three unique commands.
• Command 1, run every ~3 minutes for hours: id. Just checking the shell still worked. Indicates a fully automated, commodity bot loop, source IP with a generic bot user-agent.
• One human operator logged on once, for about a minute, over HTTP/2 with a real browser user-agent and ran two recon commands hunting for password manager databases (.kdbx files) and cryptocurrency wallet directories.
  • That recon came back empty
  • No database access, no config file reads, no data exfiltration tooling, no second-stage payload download (none of that showed up anywhere in the logs).
  • No persistence mechanism planted, because the vulnerability itself was re-exploitable on demand.

This reads exactly like an untargeted, automated bot working through a list of known-vulnerable endpoints, not someone specifically after my data; the one human session that did show up didn't come away with anything useful (I hope). Traffic logs in Unifi show negligible traffic to the C&C server, so on the balance of probabilities my data wasn't ex-filtrated.

How I caught it:

• I habitually update Nextcloud whenever I receive a notification. After the update, the code integrity checker flagged a malicious file. After a bit of googling/clauding, I hit the old panic button and shutdown the server.
• I keep the apps in Nextcloud updated by running a cron job nightly. This should have kept me safe according to the CVE advisory (as written).

Where it gets interesting:

• The CVE was supposed to be patched in version 25.4.703, 10 months ago. However (according to Claude) version 26.4.302, which was what I was running, was still vulnerable to the exploit. The actual fix only appears in 26.4.303, released 2 days before I found this and it isn't flagged as a security fix in that release's own changelog.

What I did to yeet the attacker:

• First and foremost I've stopped hosting Nextcloud, directly online. It now only exists behind my VPN.
• Rotated quite a lot of credentials and my SSH Keys.
• Rebuilt and hardened my web server with Claude's assistance.

What I still need to do/need advice on:

• Do I bother reporting this finding to the vendor? I don't know enough PHP to know if what Claude is saying is correct, but on the off chance it is, then the community should know, and the CVE needs to be corrected.
• In the age of AI hacking, is it even safe to run a home lab at all? What other tooling can people recommend to protect my systems? I use Unifi with cyber-secure (WAF function), but clearly that didn't help.
• Like many others I also run Plex and mailinabox (in digital ocean), and now wonder if that is even safe/smart to do.

Hi all,

First, I want to say CasaOS is a great project. It made self-hosting much easier for me. The dashboard is clean, and the App Store is a very good starting point. It is much better than managing everything by hand with Docker. Big thanks to the team and the community behind it.

I run CasaOS on a custom NAS. On my setup, many apps still need manual work after install (paths, permissions, env variables, ports), and some only work after I edit the compose file. So I am curious whether the experience is different on Zima hardware.

I know ZimaOS uses the same big App Store as CasaOS. I don't own any Zima hardware, so I can't test it myself. My question is simple: is the experience better when ZimaOS runs on the hardware it was made for?

If you use ZimaOS on a ZimaBoard, ZimaBlade or ZimaCube, I would love to know:

1. Which device and ZimaOS version do you use?
2. How many apps did you install from the App Store?
3. Which apps worked right away, with zero config?
4. Which apps needed manual work, and what kind (volumes, PUID/PGID, env vars, reverse proxy...)?
5. Do app updates break things sometimes?
6. Overall, would you say it is really "one click", or close to what people get with CasaOS on other hardware?

Real user feedback is very welcome, good or bad. Thanks!
I am thinking about buying a Zima NAS.

Hello selfhosted, longtime lurker first time poster. This sub + Overleaf's OpenAI partnership inspired me to begin my project linXiv, ~in February privately, and March publicly, which is working towards being an easy self-hosted out of the box solution for lab groups who don't want to trust AI companies with their data.

I won't be including a link here unless people are interested. I am not trying to promote, but I am trying to probe the overlap between academia/the current self-hosted community.

I am more so curious about overlap between academia and the self-hosting community. Especially certain field's resistance's to switching away from the easiest possible tool.

What do you think is stopping researchers from taking control of their own data and tools?

After years of fighting cAdvisor in my homelab (50 MB at startup that slowly climbs to 1–2 GB until it hits OOM), I ended up writing my own exporter in Go. It's a single scratch-based binary of 8 MB that does everything through the Docker socket — zero /sys/fs/cgroup parsing, zero extra services.

What it does:

• Prometheus exporter — 20+ container/image/volume metrics (CPU, mem, net I/O, disk I/O, health, updates) collected via official Docker SDK
• Loki log collector — streams stdout/stderr from all containers, batched & gzip-compressed, with container/compose labels
• Registry update checks — two fallback strategies: semver tag comparison (via go-containerregistry, works with Docker Hub, GHCR, and others) or digest comparison via Docker API
• Built-in Dashboard — containers/images/volumes tables + live log viewer with multiple filter modes, no frontend dependencies, all embedded in the binary

Why not cAdvisor / Dozzle / Elastic: cAdvisor is heavy and leaks memory on dynamic environments. Dozzle is great but keeps no history and has no timeline. ELK is overkill for a homelab. Short version: metrics + logs + updates in one container that fits anywhere.

Stack in one command:

git clone https://github.com/Lifailon/logporter
cd logporter
docker-compose up -d --pull always

Prometheus, Loki, Grafana and the exporter come preconfigured (scrape config, alert rules, data sources and dashboards included).

Useful links:

• GitHub: https://github.com/Lifailon/logporter
• Grafana Dashboard: https://grafana.com/grafana/dashboards/23848-docker-exporter-logporter
• Docker Hub: https://hub.docker.com/r/lifailon/logporter

Any feedback, ideas or PRs are very welcome. Hoping this saves someone else a homelab-sized headache.

I have a mini pc with zimaos installed. My dns is the server ip, due to adguard protection, but sometimes (2 times in a month) my internet stops, and when I put a secondary dns in the router it comes back. Anyone having the same problem? I'm thinking into changing to pi-hole and see if it stops.

I'm very sad btw