Hey r/selfhosted,

About four years ago I posted Sablier v1.1.0 on r/Traefik. If you've never heard of it: Sablier starts your apps when someone actually visits them, and stops them after a while without traffic. While an app boots, your reverse proxy shows a waiting page or just holds the request until it's ready. It's made for the services you open twice a month but keep running 24/7.

I've just released v1.19.0, and a lot has changed since that post, so here's a catch-up.

It's not just Docker anymore

• Providers: Docker, Docker Swarm, Kubernetes, Podman, Proxmox LXC, systemd, Nomad and AWS ECS
• Reverse proxies: plugins for Traefik and Caddy, plus Nginx, Envoy, Istio and Apache APISIX through a proxy-wasm plugin

Scale instead of stop
Cold starts are the main complaint about this kind of tool. With scale mode, Sablier doesn't have to stop an idle app. It can keep it running with throttled CPU, memory or disk I/O, and give it its full resources back when someone shows up.

Webhooks and observability

• Webhooks when an instance starts or stops, so you can plug Sablier into your notifications or monitoring
• A Prometheus /metrics endpoint
• OpenTelemetry tracing

A few smaller ones I like

• Running hours: keep something up during set hours, whatever the traffic
• Anti-affinity: make an app back off while another group is in use, e.g. free the GPU from Nextcloud while your streaming stack is running
• Groups, optional instances, and themes for the waiting page

The maintainer side

This part is more personal. For most of its life, Sablier was mostly me, on evenings and weekends, because I enjoyed it. Outside contributions were rare. After a while that gets heavy: issues pile up, every feature takes weeks, and the project lives in the back of your head as a to-do list.

This year changed that, and AI is a big part of why. I know it's a touchy subject here, so I'd rather say it upfront. On my side, I can turn an idea into a working feature in days instead of months. It comes with tests and docs, and I still review every line. Contributions came back too: 13 people besides me have contributed so far this year, about twice as many as in any previous year. I was honestly expecting a wave of AI slop. I didn't get any, just really nice PRs.

The result is that I don't carry the project around in my head anymore, and maintaining it is fun again.

If you already use Sablier, I'd really like to hear from you

I know very little about who actually runs Sablier. I see the stars, the issues and the occasional PR, but most people who use it never say anything. That's fine, but it means I'm guessing a lot when I decide what to work on next.

So if you use it, I'd love a comment, even a short one:

• Is it for your homelab, for work, or both?
• What do you put behind it, and why? Saving RAM or power, a small VPS, GPU sharing, or something else?
• Is it really useful to you day to day, or more of a nice-to-have?
• What's annoying, missing, or confusing?

Negative feedback is just as welcome. If you tried it and dropped it, I want to know why too.

• GitHub: https://github.com/sablierapp/sablier
• Docs: https://sablierapp.dev

My current setup... and I'm getting so much satisfaction out of it!

Everything is running smoothly, 3-2-1 backups are in place and working, remote monitoring is set up, and even my wife is happy with KitchenOwl for recipes and Watcharr! :)

It's honestly amazing how much fun self-hosting can be.

Good day r/selfhosted,

Wednesday is an exception day for sharing projects, so I wanted to introduce Lagrange Reader, an Android companion app for BookOrbit, Komga, and now Kavita, with more integrations planned.

The project started from a simple need: I wanted to read my books offline on Android and have my reading progress sync back to my self-hosted library when I reconnected.

I’ve been a heavy reader for as long as I can remember, but I’ve never fully satisfied with how most Android apps handle offline reading from self-hosted book servers. I’m also not really comfortable using OPDS as the main way to access my library.

Lagrange is my attempt to make reading from a self-hosted library on Android feel more comfortable and natural. Among the sea of Android readers, I’m trying to build it as a convenient way to connect to your library and read offline whenever you need to.

Some of the features I’m most happy with:

• Download books for reliable offline reading
• Sync reading progress back to your server after reconnecting
• Read EPUBs, PDFs, and comics
• Listen to supported audiobooks
• Browse libraries, series, authors, and search
• Customize the reading experience with themes, text size, margins, and orientation controls
• Continue reading even when your connection is unreliable

A heads-up about how it is made: my day job is as a data engineer, and I also work as a freelance backend engineer on various private projects. I do not have any real Android development experience. I designed the system and framework myself, but much of the implementation work has been AI-assisted.

I completely understand if that makes some of you close this post immediately. I wanted to be transparent about it. I research, test, review, and maintain the project myself, and contributions and feedback are more than welcome.

The project very recently reached 100 stars, and we already have multiple external contributors and translators helping with the project. That has been a really encouraging milestone.

In a way, I’m trying to give something back to the self-hosting community that has helped and inspired me for years. Lagrange is completely free and licensed under GPLv3, so you can do almost anything you want with it. There is also no telemetry whatsoever.

I would be honored if some of you would give it a try and let me know what you think.

GitHub: https://github.com/van-geaux/lagrange-reader

Thank you!

https://www.bleepingcomputer.com/news/security/tailscale-warns-of-serious-ssh-flaws-allowing-root-privilege-escalation/

I recently came across an IETF proposal called SETTLE (SEcure access To Tls Local rEsources), and I'm surprised I haven't seen it discussed here before. I'm making this post just because I found it exciting and wanted to share, and figured more people supporting it can only be a good thing. I am unaffiliated with the IETF.

In short, if developed into a standard, and implemented into popular OSs, it will allow you to establish trusted TLS connections to local services without reliance on global cert authorities or manually installing root certs. This would make it possible to establish zero-external-dependence trust for things like Vaultwarden and OIDC without the pain of dealing with root certs.

Today, there are three primary ways people achieve network trust for their self-hosting (in no particular order):

1. Purchasing a domain or utilizing a DDNS, and then using Let's Encrypt with a reverse proxy
2. Tailscale's Tailnet (https://*.ts.net)
3. Setting up a CA, and manually installing root certs onto devices

The first two of which require varying degrees of dependency on external services and possibly recurring costs. Only the root certs option avoids this, but it's an impractical solution if you'll ever need to onboard someone remotely, as installing root certs can be a real pain (especially on mobile devices).

To be clear, I'm talking about network trust, not simply access. You can, of course, use Wireguard (or a tunnel manager like Headscale or Netbird) for fully self-controlled remote access, and local access is a-given.

What is the SETTLE proposal?

The October 2026 SETTLE requirements draft describes a possible architecture built around locally managed cryptographic identities and a local trust authority. The precise protocol and implementation details are still being developed though, so specifics are likely to change.

Rather than providing blind trust, SETTLE is proposed to call for an initial verification mechanism that can work independently of the network connection itself. Depending on the eventual implementation, this could involve a QR code, a physical push button, or another OOB exchange of cryptographic information.

SETTLE describes a Referee, essentially a local trust authority. Once a device has been securely enrolled, the Referee could issue it a cryptographic identity. Other participating devices would be able to verify that identity and thereby establish trust.

How does this affect you?

Once realized and implemented, SETTLE, as it's currently proposed, aims to enable you to establish local domains with TLS trust (e.g., https://NextCloud.home.arpa) without ever even needing to contact an external server or spend a cent. New users could "possibly" be onboarded by sending them a simple cryptographic key file and connecting them through your choice of Wireguard tunnel system (speculative).

There are still a lot of important questions that need to be answered by the IETF devs pursuing this, and it will likely be a fair few years (speculation) until the standard is finalized and we see it implemented into major OSs, but this is a very exciting development nonetheless.

My questions for you:

1. Would you favor establishing trust via SETTLE over however you're currently doing so?
2. What are some specifics you would need in the implementation for this to best serve you?

Using solutions like wireguard or tailscale never fit my use case. I didn't want people in my household to have to rely on an app on their phone for connectivity.

Up until now I've been using Pangolin, with crowdsec, geo blocking, and ASN blocking. As expected my access logs were filled with denied attempts as bots sniffed around my services.

I was researching how to lock it down further and was learning about mTLS certificates, only to learn it had just been recently added to pangolin. Basically, you install one certificate on the pangolin server, and then client certificates on each of your client devices that will be accessing services through pangolin. I found decent support for it through apps like Nextcloud, Immich, and Home Assistant already baked in.

Since a client needs to have a valid cert to establish a TLS handshake, that means that bot requests never even make it to your server because they can't even establish a connection.

The only maintenance is having to renew certificates when they expire, which you can choose how long they are valid for.

My logs are finally silent! And it gives me much stronger protection against non-authenticated vulnerabilities, like the PHP CVE last week.

I'm the author - free + MIT, not affiliated with Immich.

My library was mostly phone uploads: live photo pairs, 12MP stills, 4K clips. Immich stores everything exactly as uploaded, which adds up fast. JPEG-XL saves 20-40% on photos, AV1 saves 30-50% on videos with no visible loss.

immich-convert-originals talks to Immich via API and converts originals in place:

• Images -> JPEG-XL / HEIC / AVIF (JPEG -> JXL is lossless bit-exact repack)
• Videos -> AV1 in MP4
• Web UI: browse, pick album / date range / selection, dry-run savings preview, live progress
• EXIF, GPS, favorites, ratings, albums carry over
• Every upload verified, old file goes to Immich trash (30 days)
• Single Docker container, amd64/arm64, settings in UI

Docker:

mkdir -p immich-converter/data && cd immich-converter
docker run -d \
  --name immich-library-converter \
  --restart unless-stopped \
  -p 8000:8000 \
  -v ./data:/app/data \
  ghcr.io/fabianwimberger/immich-convert-originals:latest

Source + docs: https://github.com/fabianwimberger/immich-convert-originals

AI Involvement: Made with AI assistance

Hey all, I picked up a DXP2800 a few weeks ago and I'm about two weeks into UGOS before I commit and move my real data over. Would love some opinions from people who've lived with it longer.

Setup is simple: stock N100 with 8 GB RAM, two 4 TB IronWolfs in RAID 1 on Btrfs, and a Lexar NM620 512 GB NVMe sitting there unused. I got the SSD so I could try ZimaOS on it without touching UGOS, and boot back if I don't like it.

What I want out of it isn't crazy. File storage and PC backups for me and my partner, automatic photo backup from our two iPhones (around 400 GB and growing), a network-wide ad blocker, and a music library where I can dump my MP3s in a folder and stream them to my phone. Most of that will run in Docker, with Tailscale for remote access so I don't have to open ports. Backups will be a nightly USB drive plus something offsite.

Honestly UGOS has been fine so far. RAID, snapshots, users and photo backup all work without much drama. I just want some feedback before picking the OS I'll live with long term, since switching later means wiping the drives and starting over (I think?).

What's holding me back on ZimaOS is that I'm not sure how open source it really is, and it's another Chinese company on top of UGREEN. Not trying to start a political thread, I just don't love the idea of my whole photo library and network DNS running on software I can't really look into. Is that a fair worry or am I overthinking it? And if it's fair, does switching even make sense when UGOS is in the same boat?

Which makes me wonder if I should look at TrueNAS or Unraid instead. I'm comfortable following guides but new to NAS and Docker, so would any of those fit better for this? Also curious how Docker and Tailscale have been on this box for people, whatever OS you ended up on.

Cheers!

Hi everyone! So I’m really new to self-hosting and unsure of where to start equipment-wise. I’ve done a little bit of research and have an idea of what I need to run for what I’m wanting. Mainly I need enough storage for music, movies/shows, and to store pictures and important files securely.
While I am not tech illiterate, the most “coding” experience I have is cheating in the Sims. So beginner-friendly is preferable.

I have been getting familiar with Jellyfin and plan to use that for the entertainment. I also use the Proton suite for file storage, email, passwords, etc
I do like the interface Proton offers, but I’m open to other suggestions, as I’m trying to reduce the subscriptions I’m paying for. For storage I’m thinking of having a couple different places to store my files as backups, hence the need for local storage.

I do play videogames and have a PC that I would like to repurpose to get every ounce of usage I possibly can when I do upgrade. I have a good size mid tower that can fit e-ATX motherboard and a lot of bays for storage (the MSI Seikira specifically) Figured the specs would be more than enough since I use it for gaming currently. I also stream as well, so I’m not sure if the load on my internet would be too much. I plan on using Jellyfin, Pi-hole, and docker, as those are repeatedly recommended online.

What would the best set up for my situation? Would I have to wipe windows completely to convert it to a home lab? It seems like self-hosting is pretty code-heavy too, and I’m willing to learn, however I would like an interface to keep track of everything. I’m not too sure of the budget because it seems like the budget can vary drastically depending on what you get. I’m thinking 500$ and under to start.

Thanks in advance for reading and for any advice you can offer!

Hi r/selfhosted, I'm Dragos, part of the small team behind grovs.

When Firebase Dynamic Links shut down, a lot of mobile apps were pushed to paid SaaS like Branch to keep their links working, which also means a third party sees every click and install. grovs is the self-hosted version of that.

What it does

- Deep links that open the right screen in your app, including after an install (deferred deep linking), on your own domain

- Attribution: which link, campaign or QR code brought each install or open

- Analytics dashboards: opens, installs, retention, campaigns

- Migration: old Branch/AppsFlyer links keep working, the first click resolves them and creates a native link

- SDKs for iOS, Android, Flutter, React Native, Unity and web

Running it

One Docker Compose stack: Rails API, React dashboard, Postgres, Redis, optional ClickHouse, workers and a reverse proxy with automatic TLS, from published images. Setup generates secrets and an admin login. There are guides for a plain Linux box, Coolify, Dokploy, CapRover, Railway, Render, Hetzner, AWS, GCP and Azure.

Licensing, to be upfront

The core and all SDKs are MIT: links, attribution, analytics, custom domains and migration. Push, in-app messages, journeys and segments are in an ee/ folder under a commercial licence. The Community image doesn't include them, and you don't need them for links and analytics.

Repo: github.com/grovs-io/backend

I'd really like feedback on the install: what broke, what's missing, and what you'd need before running it for a real app.

My project's Forgejo git forge was slow, so i logged in to see the logs. We are (yet again) being DDOS'ed by AI crawlers. https://imgur.com/a/VQyUK9t Yes, this is real time.

Even when Forgejo was stopped, the flow of requests of crawlers was still DDOSing my nginx, see the screenshot. Nothing else is running on the server. But half of my 8 Xeon cores is just used to handle HTTP requests.

There, i wanted to rant. I'm fucking tired of AI destroying the 2026 internet.

Hello r/selfhosted

I'm the developer of Chevereto, a well-known self-hosted media sharing platform that I've been developing for over 19 years. Today I released Security update V4.5.8 which fixes 19 security vulnerabilities affecting from 3.0.0 to 4.5.7 which represents almost all our existing user base.

I'm posting this here for visibility. If you run a Chevereto based system update at your earliest convenience. If you know someone using Chevereto please share the news.

The details and PoC for these vulnerabilities will be disclosed in 14 days from now via GHSA.

• Release notes: https://releases.chevereto.com/4.X/4.5/4.5.8
• Docs: https://docs.chevereto.com
• Repo: https://github.com/chevereto/chevereto

Thank you for your support, please share 🙏.

I'm looking for a self-hosted alternative to startme, and I'm struggling to find something that offers the same kind of organization and visual structure.

I've tried Linkwarden, Karakeep, LinkAce and ArchiveBox. Linkwarden is currently my favorite, and others, but none of them quite offer what I'm looking for. Most of all, I hate the way it looks and how it feels to use.

What I want is something that lets me build my own structure:

• Custom bookmark groups with headings: I want to divide a page into clearly defined sections and give each group its own heading. For example, I might have separate groups for self-hosted apps, networking, Linux, documentation, useful tools, etc.
• Multiple groups side by side: Being able to arrange groups in columns is a huge part of what makes startme work for me. I can see several categories at once instead of having to navigate through folders or scroll through one long list.
• Complete freedom over the layout: I want to decide where groups go and how they're arranged on a page. I don't want to be limited to choosing between a tile view and a list view for an entire collection. I want to create a structured overview that makes sense to me.
• Multiple customizable pages: Separate pages for different topics, projects or areas of interest, each with its own layout and groups.
• Good bookmark management: Search, tags, descriptions, icons and the ability to save and organize lots of links are still important. Ideally, the solution would combine this with Start.me's flexible visual organization.

Widgets such as weather, calendars, RSS feeds and notes would be nice to have, but they're definitely not a priority.

Here some example sites:
Cyber Threat Intelligence - Start.me
AI - The Ultimate Page - Start.me
Tools - Start.me

Thanks a lot!

Yesterday we cut the v1.23.0 release for Spinifex, the open source, self-hosted AWS-compatible cloud. Whilst a good portion of our resources are being devoted to opportunities with partners such as OCI, we still managed to get a significant update out:

Route53:

• Host public DNS zones on your cluster: point your domain at the cluster's name servers and it goes live.
• A new console walks you through adding a domain and editing A, AAAA, CNAME, MX, TXT, SRV and CAA records.
• Existing Terraform or AWS CLI Route 53 code works against it.

Security:

• Patched guest kernels in the system images and the load balancer VM, and the load balancer moves off end-of-life Alpine 3.20 to 3.24.
• Hardening of the instance metadata service (IMDS): it limits connections, enforces timeouts and honours HttpPutResponseHopLimit.
• Signing out ends the console session in every open tab.

Operator quality-of-life:

• spx admin storage status (S3 metadata node health), spx admin dns, and spx admin init --external-dns.
• The metadata service stays reachable after an Open vSwitch restart.
• Cluster shutdown and account termination now fail safely when a node is silent.

Full release notes on our GitHub: https://github.com/mulgadc/spinifex

Hey selfhosted community,

I run CLI cursor agent on my debian mac mini.

I tend to interface with it via VPN SSH with Terminus from my Android phone. The chat experience is a pain, the CLI doesn't provide convenient text selection, autocorrect and such in that context. I am wondering if you guys know of some other method I should consider to interface with cursor (or feel free to let me know of another provider) in a more Claude / chatgpt way I guess ? Can be web-based only or app.

From the laptop I use cursor IDE and remote connect to the server.

Thanks for your insights !

Hi everyone, I'm the developer of Traccar, a free, open-source GPS tracking platform.

You can connect dedicated GPS trackers or use your phone, then view live locations, route history, geofences, and alerts through a web interface. Everything can run on your own server.

The project has been around for over 10 years, long before the AI slop wave, and I'm still actively maintaining it.

GitHub · Documentation · Supported devices

Anyone here using it? I'd love to hear what works for you and what could be better. Happy to answer setup or hardware questions too.

Heyaaaa, I'm an artist who often looks up photos online for subjects I wish to have reference for while drawing. This used to be a pretty simple endeavor... and then generative AI happened. Now I have to carefully vet what images I'm using as reference so I know I'm getting the real thing, but to that end my collection of real deal references is growing, and searching through folders to find what I need is becoming tiring.

I'm looking for a program that I can use to catalog, tag, and search through this library of references that isn't Immich, since I already use an instance of that for my personal photo collection. I'd like to also have easy access to it while I'm away from my home network via something like tailscale, which is why im seeking something self hosted.

A hypothetical use case would be, if I search for "cat", it would bring up any feline that I've catalogued, but if I searched "tiger" I would only get tigers.

No idea if something like this exists, but I figure if anyone knows you guys might. Thanks!

Edit: A few people have already suggested running a second Immich instance, but the truth is I REALLY don't like the interface and use it purely as a backup service. It also uses a lot of resources on my NAS so I'd be eager to find something more lightweight and/or that I could toggle on and off as needed.

Hi All,
Looking to begin my selfhosting journey as a beginner with no idea where to start. Main things I want to accomplish:
- Plex/Jellyfin for streaming, both locally to Apple TV and remotely on phones and other Apple TVs.
- Immich for photos
- Adblocking on home network

Am I best to look at a Raspbery Pi or thin client or mini PC? How much power do I actually need?

I really like Ninox. In fact, one of the main reasons I started using it was the ability to keep my databases locally and sync them through iCloud, without depending on a cloud subscription.

I've invested a tremendous amount of time and effort building my databases, and I would hate to lose that flexibility. If Ninox eventually removes the option to use local databases without a subscription, unfortunately, I'll have to move on.

As UKenGB mentioned, what I really need is a future-proof solution where I have full control over my own data.

I've actually started exploring the idea of building my own Ninox-like application. With AI tools such as ChatGPT and Codex, development has become much faster than it used to be. It also makes me wonder whether other Ninox users facing the same concerns would be interested in collaborating on an open-source alternative.

I've been burned by software subscriptions before. I've purchased applications, invested years of work into them, and then watched their developers switch to subscription models or introduce restrictions that weren't there originally.

To be clear, I'm not accusing the Ninox team of doing this. I appreciate the work they've put into the software, and I genuinely hope Ninox continues to succeed.

However, announcing Ninox 4 without clearly explaining the future of standalone Mac databases, local storage, and iCloud synchronization leaves users like me understandably concerned.

I really hope Ninox will clarify its plans, because I'd much rather continue using a product I already enjoy than have to replace it.

Hey r/selfhosted,

When I last posted here, we had just released the Web UI and talked about using it as the foundation for a cross-platform desktop client. Today I finally get to follow up on that: GameVault 2 is available to everyone as a public beta, with desktop clients for Windows, Linux and macOS!

If you're new to GameVault, it's a self-hosted home for your DRM-free game collection, with a server that stores the library and clients that download and install games locally. You can share it with friends and family.

We've rebuilt the client around the same frontend as the Web UI, with a much, much more modern interface and a responsive layout that adapts to smaller screens. You can browse your library on your phone and use the same familiar interface in the desktop app.

Getting the Linux client out feels especially good. We have AppImage and .deb packages, plus umu-launcher integration for running Windows games through Wine/Proton, with separate prefixes per game. There's also support for keeping multiple versions of a game and choosing which one to download.

One thing before upgrading: GameVault 2 still lacks some features, including GameVault+, and existing game installations need to be downloaded and installed again. GameVault 1 remains available while we work towards feature parity.

We've already switched to GameVault 2 ourselves. As one of the two developers behind this project, I'm really proud of how far it has come, and I'm excited to finally get this version into more people's hands. Thanks to everyone who tested builds and kept sending feedback.

You can download GameVault 2 here. If you run into bugs, please report them on GitHub.

I am self hosting a number of services, like Book Orbit for example. These services are proxied by Nginx Proxy Manager and are all HTTPS enabled. I use the auth systems provided by each individual service. I have my own domain and I have a wildcard domain pointing to my public IP. NPM will only proxy matching addresses and those addresses aren't published anywhere since I have a wildcard subdomain DNS entry, making me think this is some sort of security through obscurity. Is that true? i.e. Nobody knows my subdomain addresses to access my services with.

What other things can I do to improve security?

[ Removed by Reddit on account of violating the content policy. ]

Has anyone ever sort of self hosted a couple of devices lets say a thousand plus with headscale as control plane and tailscale as Networking engine?