Skip to content
Search

Self-hosting

lastmod 2026-02-04created 2016-08-1921 edits

Self-hosting is the use of a computer program as part of the toolchain or operating system that produces new versions of that same program—for example, a compiler that can compile its own source code. Self-hosting software is commonplace on personal computers and larger systems. Other programs that are typically self-hosting include kernels, assemblers, command-line interpreters and revision control software.

Music streaming

Multimedia

Online radio streaming

CCTV

Calendar & contacts

Since this is sensitive data, host your own CalDAV/CardDAV server

  • Radicale: Python-based, basic web UI, single user only, not compatible with Apple devices
  • Baïkal: PHP-based, active development, advanced web UI, multi-user support
  • DAViCal: PHP-based, not tried
  • Xandikos: Python-based, no built-in authentication, no web UI
  • Nextcloud: PHP-based, fine if you already use it, but too heavy

Infrastructure management

  • XPipe - A tool for accessing your entire server infrastructure from your local machine

Self-hosting guide, 2025 style

Self-hosting has recently been gaining popularity as an alternative to centralized services focused on data collection. Introduces tools that proved useful, based on experience running them stably for over a year after experimenting with various tools and apps. A collection of recommendations covering container runtimes, web-based management tools, reverse proxies and VPNs, and other self-hosting tools.

Container runtimes

These days containers have become the default for hosting, and traditional approaches are increasingly rare. This is a very positive trend for home server users (homelabbers); containers make software deployment simple and offer more efficient performance than virtual machines. Most people use Docker, but this post introduces various alternative runtimes that can be used in a home environment.

  • Docker
    • The most widely used, original container runtime
    • Thanks to rich documentation and community, even people unfamiliar with IT can copy a docker-compose.yml from GitHub and try running it
    • However, security-related settings need to be considered separately
  • Podman
    • A next-generation container runtime drawing attention for its rootless architecture and Docker CLI compatibility
    • Runs without a daemon, making it suitable for those who prioritize security or want to learn the related technology
    • Most Docker commands can be used as-is, and an alias compatible with the docker command is provided, making the switch easy
    • There is an initial barrier to entry, but accessibility is steadily improving as documentation and community grow
    • Additionally, Podman Quadlets enable systemd-based declarative container management instead of docker compose
  • Kubernetes
    • An advanced tool that stirs the desire for a challenge in curious, experimental home server users
    • As an orchestration tool that can gracefully manage numerous instances, it provides an enterprise-level management experience
    • However, it has so many features and is so complex that it is overkill for most users
    • In a home environment, learning itself is the main goal, with the focus on understanding the technology rather than practical use

Web-based container management tools

Some users prefer to collect and manage compose files on a local disk, but that comes with the hassle of SSHing into the server every time to check logs. Using a web-based container management tool instead makes the work much more convenient.

  • Portainer
    • The most stable web UI management tool, compatible with Docker, Kubernetes, and Podman
    • Widely used from home servers to enterprise environments, and very helpful for learning through hands-on use
    • There is an open-source community edition and an enterprise edition with extra features (3 licenses provided free)
    • Its intuitive interface and wide range of features make it very well suited to container management
  • Dockge
    • A new web-based Docker Compose management tool made by the developer of Uptime Kuma
    • Not yet as mature as Portainer, but its very simple and intuitive UI is a strength
    • The developer responds quickly to GitHub issues, and updates are regular
    • Suitable for users who prefer lightweight, minimal tools

Reverse proxies and VPNs

There are two main ways to access self-hosted applications from outside:

  • Expose the services directly to the internet
  • Access the internal network via VPN

A VPN is more secure, but exposing to the internet can also be quite useful if configured well

  • Pangolin
    • An innovative solution combining VPN and reverse proxy in one
    • Plays a role much like a Cloudflare for self-hosting
    • Just install an ingress server on a VPS or similar, and you can connect easily from various environments with a VPN client
    • Comes with CrowdSec integration and even basic SSO features
    • Impressive enough that it was the reason the author wrote this post; it may become the standard alternative to existing solutions over time
  • Nginx Proxy Manager (NPM)
    • An Nginx frontend for easily configuring TCP/UDP/HTTP(S) proxies through a web UI
    • Used by many users, but the author considers some features (e.g., password protection) unstable
    • As the first tool the author encountered, it did not leave a good impression, but when working it does its job faithfully
  • Caddy
    • Automatically handles everything from proxy configuration to HTTPS certificate issuance with a simple config file (Caddyfile)
    • Not recommended for beginners since there is no web UI, but the best choice for users who like the UNIX philosophy
    • Supports Let’s Encrypt out of the box; its advantage is not needing complex configuration
  • NetBird
    • A VPN solution you can adapt to immediately if you are familiar with Tailscale
    • Automatically configures a WireGuard-based network, reducing complex setup
    • Flexible, as both a cloud free tier and self-hosting are possible

Status monitoring and notification tools

  • Uptime Kuma
    • Easily monitor service status without a heavy stack like Zabbix or Grafana
    • Notifications via various channels can be configured with just a single deployment
    • Excellent for checking the availability of self-hosted systems
  • Gotify
    • A notification server that can send push notifications with simple HTTP requests
    • Notifications can be received after installing the mobile app, and it can also integrate with Uptime Kuma and others
    • Practical, as it can be used together with various self-hosting tools

Additional resources for finding self-hosted apps

A collection of useful resources for finding various self-hosted applications:

  • Awesome-Selfhosted
    • A huge software list provided on GitHub
    • Somewhat disorganized, and includes some projects whose development has stopped
  • Selfh.st
    • The author's favorite resource
    • Offers a newsletter recommending niche applications and a large, sortable application directory
    • A very useful site
  • awesome-docker-compose
    • A collection of ready-to-run Docker Compose files
    • Some applications may have compatibility issues due to updates, but overall it is a good reference

Building the ultimate self-hosting environment

Shares the experience of successfully building a custom environment after trying various self-hosting approaches over the years

  • The main goals were control over personal data and maintaining reliable infrastructure; to that end, several core technologies such as NixOS, ZFS, Tailscale, and Authelia were combined
  • Accessibility was also strengthened with usability for family and friends in mind, such as introducing SSO and a separate start page
  • Documents in detail the issues encountered in actual operation and concrete solutions (e.g., public proxy for private services, mixed VPN environment, authentication integration)
  • Plans further improvements such as backup infrastructure and security hardening, and leaves know-how and references

Requirements

  • Must-haves
    • Limit public internet exposure of services as much as possible to reduce the risk of security incidents
    • Minimize downtime of core infrastructure caused by mistakes (avoid circular dependencies and keep config rollback easy)
    • Directly own core components such as authentication, networking, and domains, and prefer open source
    • Consider usability from the perspective of family and friends (consistent SSO login, minimal maintenance required)
    • Actively adopt declarative configuration files (easy version control and backup/restore, ability to reference and reuse others' configs)
    • Updates must be easy and safe so they can be managed periodically
  • Non-priorities
    • No need for extreme modularity/tidiness (practicality first)
    • Not everything needs to be open source, but use it where possible
    • Not pursuing high availability (HA); accept downtime in exchange for a simple structure

Technology choices

  • NixOS
    • A Linux distribution that declaratively manages all OS configuration with the Nix language and package manager
    • Configuration is codified, enabling version control and systematic rollback
    • Also supports a wide range of packages and integration with Docker/PODMAN, etc.
    • Builds up know-how by referencing other developers' Nix configs
  • ZFS
    • A high-performance file system with excellent data protection features such as snapshots and rollback
    • Four 10TB HDDs configured as RAIDZ2 (tolerates 2 simultaneous disk failures), with caching on a 256GB SDD
    • File and media datasets are separated and managed with per-purpose NFS mounts
    • A simple, highly reliable main storage architecture
  • Tailscale & headscale
    • Tailscale: An accessible Mesh VPN; just installing the client allows access to the internal network without public internet exposure
    • Headscale: A self-hostable open-source Tailscale backend (eliminates the risk of company policy changes)
    • Improves network safety, but requires installing the client on user devices
    • From a Usability standpoint, the need to install a client on each device is somewhat of a barrier to entry
  • Authelia & LLDAP
    • Authelia: An OpenID Connect-based SSO, authentication, and authorization solution that can integrate with an nginx proxy
    • LLDAP: Lightweight LDAP, used for Authelia's user and group management and as a backup authentication source
    • Works well with minimal resources, but configuration is difficult and there is a learning curve in figuring out which services to integrate and how

ETC

Favorite site

References

  1. Kickball_awesome-selfhosted_README_d8f9ba5.md.zip ↩

author Zer0 sitemap