12 ms·

Self-Hosting like it's 2025

221 points by finnlab 1y ago

ValdikSS 1y ago
Nah, that doesn't look fun. Self-hosting in 2025 should look like Yunohost or Sandstorm.
- crabmusket 1y ago
  I really like Sandstorm - it's a glimpse into an alternate world of how things could be.
  - brulard 1y ago
    I tried the demo, but I still don't get it. What is it? Is it supposed to be like a collection of productivity apps, like google docs/drive ? The demo worked poorly, I waited very long time for many interactions, some didn't work at all (like changing font on etherpad).
    - crabmusket 1y ago
      I agree the current experience is sonewhat unpolished. The docs explain the vision best: https://sandstorm.org/how-it-works https://sandstorm.org/how-it-works
- arnley 1y ago
  You sir know how to appreciate the simplicity such service providers deliver.
  - pjc50 1y ago
    I'd not heard of yunohost, so I went googling and found https://www.reddit.com/r/selfhosted/comments/1ey9ayp/what_made_you_stop_using_yunohost/ https://www.reddit.com/r/selfhosted/comments/1ey9ayp/what_ma... Seems like Docker has won so comprehensively that even more convenient (But unfamiliar) options are pushed to use it.
Helmut10001 1y ago
I tried portainer once, it looked nice and had a lot of features... for which I had no use. I always found `docker compose` much easier to use, it is often just an alias and a tab away, where for portainer I would have to open a browser tab and sometimes even touch my mouse! Otherwise good article. If you want to go rootless (which you should!), Podman is the way to go; but Docker works rootless too, with some modifications [1]. I have found Docker rootless to be reliable and robust on both Debian and Ubuntu. It also solves permissions problems because your rootless user owns files inside and outside the container, whereas with rootful setups all files outside the container are owned by root, which can be a pain. Also, you don't need Watchtower. Automatic `docker compose pull` can be setup using standard crontab, see [2]. [1]: https://du.nkel.dev/blog/2023-12-12_mastodon-docker-rootless/ https://du.nkel.dev/blog/2023-12-12_mastodon-docker-rootless... [2]: https://du.nkel.dev/blog/2023-12-12_mastodon-docker-rootless/#automatic-updates https://du.nkel.dev/blog/2023-12-12_mastodon-docker-rootless...
- kalaksi 1y ago
  Can I suggest Lightkeeper (I'm the maintainer): https://github.com/kalaksi/lightkeeper https://github.com/kalaksi/lightkeeper. I made it for my own needs to simplify repetitive tasks and provide an efficient view, and it has hotkeys and trying to stay "agile". You can drop to a terminal with a hotkey any time.
- BrandoElFollito 1y ago
  You will love dockge then. I run it alongside portainer because exactly of the compose.yaml file I want to have control over
lambdadelirium 1y ago
Muh kube
terminalbraid 1y ago
I am going to continue to stan for dokku for hosting web apps, docker images included https://dokku.com/ https://dokku.com/
- SJC_Hacker 1y ago
  Is that really self hosting though ? Self hosting to me is, at the very least having physical access to the machines.
  - rubslopes 1y ago
    I think GP miswrote; Dokku does not host, it manages containers and makes deployment easier. It's like a self-hosted Heroku.
  - boxed 1y ago
    Yes, it's self hosting. You have access to the machine.
- rubslopes 1y ago
  coolify.io is also a great open-source alternative if someone wants a web interface.
  - brulard 1y ago
    Anyone with experience to compare Coolify vs. Dokku? (and maybe something else?)
- oulipo 1y ago
  Dokploy is really nice
- thebiglebrewski 1y ago
  Aw yes Dokku is still great in 2025! Hear hear!
- sujaldev 1y ago
  There's caprover too: https://caprover.com/ https://caprover.com/
nodesocket 1y ago
I recently discovered Beszel (https://github.com/henrygd/beszel https://github.com/henrygd/beszel) for monitoring all my homelab servers. It's quick, easy, and has a very clean and intuitive interface. Works especially well running inside of containers on hosts. I also wrote a very quick guide on getting it running inside of Kubernetes at https://github.com/henrygd/beszel/discussions/431 https://github.com/henrygd/beszel/discussions/431. While it's not nearly as powerful as say DataDog, it provides the core essentials of CPU, memory, disk, network, temperature and even GPU monitoring (via agent only).
hankchinaski 1y ago
The only thing that holds me back for self hosting is Postgres. Has anyone managed to get a rock solid Postgres setup self managed? Backups + tuning?
- nodesocket 1y ago
  I run a few PostgreSQL instances in containers (Kubernetes via Bitnami Helm chart). I know running stateful databases is generally not best practice but for development/homelab and tinkering works great. Bitnami PostgreSQL Helm chart - https://github.com/bitnami/charts/tree/main/bitnami/postgresql https://github.com/bitnami/charts/tree/main/bitnami/postgres...
- candiddevmike 1y ago
  What is your RTO/RPO?
  - orthoxerox 1y ago
    1s/0s
  - nijave 1y ago
    RTO - best effort RPO - wait? You guys have backups and test then??
- lytedev 1y ago
  I self-host Postgres at home and am probably screwing it up! I do at least have daily backups, but tuning is something I have given very little thought to. At home, traffic doesn't cause much load. I'm curious as to what issues you might be alluding to! Nix (and I recently adopted deploy-rs to ensure I keep SSH access across upgrades for rolling back or other troubleshooting) makes experimenting really just a breeze! Rolling back to a working environment becomes trivial, which frees you up to just try stuff. Plus things are reproducible so you can try something with a different set of machines before going to "prod" if you want.
- homebrewer 1y ago
  Put it on a zfs dataset and back up data on the filesystem level (using sanoid/syncoid to manage snapshots, or any of their alternatives). It will be much more efficient compared to all other backup strategies with similar maintenance complexity.
bauerd 1y ago
Last thing I need is Kubernetes at home
- nodesocket 1y ago
  I run Kubernetes on my homelab on 4x Raspberry Pi's then use Portainer to manage it. Works quite well, can use Helm charts when available, otherwise I use Portainer and deploy container apps manually. It's really not that bad.
  - dailykoder 1y ago
    I'm sure you find some joy in it or just like to explore what's possible. But just a reminder: Pieter Levels is running his million dollar businesses on a single VPS (if that's still correct). But yeah, if you like it, why not. "Premature clustering is the source of all evil" - or something like that.
- import 1y ago
  Exactly. I am hosting 30+ services using docker compose and very happy. I don’t want to troubleshoot k8s in the early morning because home assistant is down and light dimmers are not working for some random k8s reason.
  - johnisgood 1y ago
    I am quite happy even without Docker, but I can see the appeal in some cases.
  - seba_dos1 1y ago
    All my "smart home" stuff needs is mosquitto on a OpenWrt router and bunch of cgi-bin scripts that can run anywhere. I already went through a phase of setting up tons of services which ended up being turned off when something changed in my life (moving, replacing equipment etc.) never to be resurrected as I couldn't be bothered to redo it without the novelty effect, so I learned from that.
  - vbezhenar 1y ago
megous 1y ago
My peace of mind comes from my self hosting in 2025 looking the same as my self-hosting in 2005 (except a move to systemd). I haven't even re-installed my workstation OS since 2006 or so.
- johnisgood 1y ago
  I see a lot of people mention some technology under this submission that you do not even have to look at when you are self-hosting. It all depends what you want to self-host, from nginx, fcgiwrap (with certbot), to an e-mail server, or a Matrix instance, or Zulip, or what have you these days. I maintain quite many servers and I do not use these new and fancy technologies. I'm just a boomer (technically a millennial) who sticks to Arch Linux even when it comes to servers, I have zero friction, really. I have no issues self-hosting whatever me or a client requires, keeping it minimal and functional. I self-host like it is 2000 (apart from a couple of some more modern stuff, if you could consider systemd and certbot, etc. modern). :D
- MortyWaves 1y ago
  2006 is impressive. I can’t even imagine that. I reinstall Windows every 18 months or so.
  - Aachen 1y ago
    I don't think I've reinstalled since around 2014, when I switched to a different Linux distribution. It's just a pain and while it cleans up some unused packages, what's the point really? Why do you reinstall Windows every 18 months? One change I made that may help with this, is to not install crap on the host that I don't plan to use for a long time. Trying out a new database server or want to set up an Android IDE for a temporary project? Use a VM, don't clutter up random files all over the host. Is this what is happening on your Windows perhaps?
    - MortyWaves 1y ago
      Windows seems to insistent on crappifying itself. Even if you have a small set of installed applications, many of them behave poorly. Lots and lots of small paper cuts add up. A few dozen registry entries here, a few files there, seven or eight Explorer right click menu extensions (like eg “Edit with X” instead of just using the normal “Open With”) setup by installers. The end result is right clicking has noticeable delay in some directories. Boot takes a few seconds longer than it did the first time it was installed. Some applications, even Task Manager inexplicably hang with a white window for a few seconds. The shell (part of Explorer) no longer displaying anything when searching in the start menu (because it tries to connect to the internet to search bing and that sometimes stops working rendering half the start menu useless). The “modern” settings app hanging with its blue window and icon for anywhere from seconds to indefinitely. It’s just a lot of this bullshit that adds up. Reinstalling Windows makes it like it was day one.
vbezhenar 1y ago
I'm slowly configuring my new VPS. Here's approach I'm taking: 1. RHEL 9 with Developer Subscription. Installed dnf-automatic, set `reboot = when-changed`, so it's zero effort to reliably apply all updates with daily reboots. One or two minutes of downtime, not a big deal. 2. For services: podman with quadlets. It's RH-flavoured replacement for docker-compose. Not sure, if I like it, but I guess that's the "future", so I'm embracing it. Every service is a custom-built image with common parent to reduce space waste (by reusing base OS layer). So far I want to run static http (nginx), vaultwarden, postfix and some webmail. May be more in the future. This setup wastes a lot of disk space for image data, so expect to order few more gigabytes of disk to pay for modern tech.
deleted 1y ago
[deleted]
rullopat 1y ago
What about Kamal? https://kamal-deploy.org/ https://kamal-deploy.org/ Did anybody here use it for anything that is not a Ruby on Rails app?
- MortyWaves 1y ago
  The thing that puts me off is its seemingly heavy focus on “web apps”. I have a bunch of services I either use or wrote myself and only a handful have anything to do with the web.
- echoperkins 1y ago
  Yes, I have been using it and really enjoying it for deploying web apps. So far I have deployed web apps using: * fastapi (python) * Django ninja (python) * ghost cms (node) I have been writing up my thoughts (and an example): https://andrewperkins.com.au/kamal/ https://andrewperkins.com.au/kamal/ The ability to deploy to both cloud servers and on-premises is a big win as I often work on projects that have a mix of both. As the sibling comment says, it’s focussed on web servers. In my use case that is fine!
  - rullopat 1y ago
    Great! Are you also deploying DB servers or any other kind of additional servers that are dependencies of those webapps?
    - echoperkins 1y ago
      Yes, I am deploying mysql with ghost ``` accessories: db: image: mysql:8.0 host: 170.64.156.161 env: secret: - MYSQL_ROOT_PASSWORD options: restart: always directories: - data:/var/lib/mysql ``` For my other services I am just using sqlite combined with a volume for persistence (managed by kamal)
jagermo 1y ago
i really like this software-centric approach, but I am a bit stuck when it comes to the hardware. Are there some sources around servers that don't suck up too much energy and are fairly quiet? What CPU is a good all-round solution?
- brulard 1y ago
  Depends on your needs. For some Raspberry Pi (ideally with 8-16GB RAM) + SSD can be enough if you are after low power consumption. If you need more power: I had success with HP ProDesk Mini (or any other one-litre PC), you can get these second hand from like $150 and extend RAM and SSDs however you like. You can even pick processor / generation to fit your needs best. These can have consumption from like 30W if I'm not mistaken. I have no experience with real and expensive server hardware, but most people don't need that for a homelab.
  - Aachen 1y ago
    > For some Raspberry Pi (ideally with 8-16GB RAM) + SSD can be enough Wut? For many, a Raspberry Pi with 1 GB RAM and the regular sdcard can be enough, you really don't need to go fancy if you don't want to run anything particularly heavy. Or if it's cpu-intensive then you might need the newest Pi or something even beefier but still only the lowest RAM and smallest/slowest storage options (like for WordPress). As you say, it depends on needs I always recommend using an old laptop to start out with because you've already got it anyway and it's already low power yet very powerful: if it can run graphical software from 2020 then it'll be fine as server until 2030 for anything standard like a web server (with half a dozen websites and databases, such as a link shortener, some data explorers, and my personal site), torrent box, VPN server, mail server, git server, IRC bouncer, Windows VM for some special software, chat bot, etc. all at once. At least, that's what I currently run on my 2012 laptop and the thing is idle nearly the whole time. Other advantages of a laptop include a built-in KVM console and UPS, at least while you still trust the old battery (one should detach and recycle that component after some years)
    - brulard 1y ago
TrayKnots 1y ago
I am actually worried about the self-hosting pandemic. We self-hosters will stop flying under the radar. Wonder how long it will take until our matrix instances require to be backdoored, our immich are scanning our pictures with AI. On an unrelated note, an article of how to rent a VPS in China would be interesting :)
- pjc50 1y ago
  > an article of how to rent a VPS in China would be interesting Given that apparently it's quite difficult to even get a WeChat account without a national ID, I suspect that step 1 is "learn mandarin" and step 2 is "get a Chinese national ID".
  - throawayonthe 1y ago
    [dead]
  - thenthenthen 1y ago
    Also your home modem/router is often tied to your ID and then there is ofc the firewall. IIRC You can get vos hosting and ICP code through Ali Cloud somewhat automagically. Agree it would be nice to give it a try some time.
  - vbezhenar 1y ago
    I didn't have any problems creating wechat account. May be I was lucky, I don't know, I just typed my phone number and it went pretty smooth, like whatsapp. Also was able to connect my visa card. I did it in the Kazakhstan and then was able to pay in China, no problems. May be they got exception for Kazakhstan specifically, we recently got visa-free travels there.
  - TobTobXX 1y ago
    Did you try? It's a few years ago when I had to create one, but it was just as simple as WhatsApp (just a few more CAPTCHAs). And no VPNs or whatever, straight from a Swiss IP.
- ciupicri 1y ago
candiddevmike 1y ago
If any self hosters are burnt out by the state of config management tools and YAML, consider giving Etcha a shot (https://etcha.dev https://etcha.dev). It's stateful (cleans up things when they're no longer in your config), procedural (you control the flow and can trigger things as needed), and supports flexible deployment models (push or pull). Full disclosure, I created it and use it across my business and personal devices.
- simoncion 1y ago
  > It's started (cleans up things when they're no longer in your config)... Would you please call this something else? "It automatically reconciles", perhaps? I know that a multi-word phrase isn't nearly as snappy, but not only are "it's started" and "started" overloaded with a bunch of meanings, approximately zero of them mean what you want them to mean in this new context.
  - candiddevmike 1y ago
    Sorry, autocorrect changed stateful to started.
    - simoncion 1y ago
      Ye olde autodefect makes fools of us all, eventually. (As does the ever-present HN urge to downvote things for no comprehensible reason. Seriously, why the fuck would someone downvote an honest explanation for a typo? Animals, I guess.)
qudat 1y ago
I’ve been self hosting small web apps using an SSH service https://tuns.sh https://tuns.sh and it helped me replace my DO droplet pretty successfully. What’s nice is it also has built-in usage analytics, alert notifications when a tunnel goes down, and fully manageable with a remote TUI which means I don’t have to install anything to use it.
anymouse123456 1y ago
[flagged]
- lifestyleguru 1y ago
  In my own kingdom I write bash on Linux. In my own kingdom I don't have to listen to caged monkeys on caffeine. Not even a single YAML in the codebase.
- 0xCE0 1y ago
  This.
oliwary 1y ago
Does anyone have any experience with coolify? https://coolify.io/ https://coolify.io/ I am considering switching the hosting of my online games to it.
James_K 1y ago
I tell you the real problem with self hosting: people using monospace fonts for body text.
- MortyWaves 1y ago
  But mono fonts let the reader know they are reading Serious Technical Content ™
  - sceptic123 1y ago
    Why is the snark here downvoted, but not the original message?
    - MortyWaves 1y ago
      Doesn’t seem downvoted to me
      - sceptic123 1y ago
        enough people enjoyed it to upvote it again I guess, weird that I got a downvote here too
Youden 1y ago
I've been through just about everything to get where I am and I've ended up with Hashicorp Nomad and Consul with Traefik, managed by OpenTofu (open-source Terraform). Things that haven't worked for me: - Standalone Docker: Doesn't work great on its own. Containers often need to be recreated to modify immutable properties, like the specific image the container is running. To recreate the container, you need to store some state about how it _should_ work elsewhere. - Quadlet: Too hard to manage clusters of services. Podman has subtle differences to Docker that occasionally cause problems and really tempting features (e.g. rootless) that cause more problems if you try to use them. - Kubernetes: Waaaay too heavy. Even the "lightweight" distributions like k3s, k0s etc. embed large components of the official distribution, which are still heavy. Part of the embedded metric server for example periodically enumerates every single open file handle in every container. This leads to huge CPU spikes for a feature I don't care about. With my setup now, I can more or less copy-paste a template into a new file, tweak some strings and have a HTTPS-enabled service available at https://thing.mydomain.mine https://thing.mydomain.mine. This works pretty painlessly even for services that need several volumes to maintain state or need several containers that work together.
- JojoFatsani 1y ago
  Docker Compose is very suitable for the homelab scenario. I use it on my pi.
- quickslowdown 1y ago
  Do you run a Nomad cluster? Or just on a single host? This is my desired state, I've set up Nomad a number of times but always get stuck in one place or another. I've gotten much further with Nomad than Kubernetes, but I've kind of always gone back to ol' faithful, writing a docker compose file and running everything that way.
  - Youden 1y ago
    Just a single host. The main thing that I couldn't figure out is how to turn off "bootstrap" mode, so I've just left it on.
0xEF 1y ago
I love the idea of self-hosting, especially since I keep a number of very tiny websites/projects going at any given time, so resources would not really be too much of an issue for me. What stops me is security. I simply do not know enough about securing a self-hosted site on real hardware in my home and despite actively continuing to learn, it seems like the more I learn about it, the more questions I have. My identity is fairly public at this point, so if I say the wrong thing to the wrong person on HN or whatever, do I need to worry about someone much smarter than me setting up camp on my home network and ruining my life? That may sound really stupid to many of you, but this is the type of anxiety that stops the under-informed from trying stuff like this and turning to services like Akamai/Linode or DO that make things fairly painless in terms of setup, monitoring and protection. That said, I'm 110% open to reading/watching any resources people have that help teach newbies how to protect their assets when self-hosting.
- doublerabbit 1y ago
  A VPS with a software firewall is more than enough. Block port 22, secure SSH with certificates only. Allow port 443 and configure your web server as a reverse proxy with a private backend. You don't need an IDS, you don't need a WAF and you don't need Cloudflare. Unless you become the next Facebook that's when you start to become concerned about security.
  - XorNot 1y ago
    I'm less worried about SSH access then I am abotya vulnerability in some front-end web service though. I've contented myself using TLS client certs on my family's Android phones (which do not work at all on iOS for something like Home Assistant).
  - palata 1y ago
    > A VPS with a software firewall is more than enough. So you don't self-host at home, right? I have been considering setting up a physical DMZ at home, with two routers (each with its own firewall), such that my LAN stays unmodified and my server can run between both routers. Then it feels like it would be similar to having a VPS in terms of security, maybe?
kuon 1y ago
If you self host, do not use containers and all those things. Just use a static site generator like zola or hugo and rsync to a small VPS running caddy or nginx. If you need dynamic thing, there are many frameworks you can just rsync too with little dependencies. Or use PHP, it's not that bad. Just restrict all locations except public ones to your ip in nginx config if you use something like wordpress and you should be fine. If you have any critical stuff, create a zfs dataset and use that to backup to another VPS using zfs send, there are tools to make it easy, much easier than DB replication.
- Aachen 1y ago
  What I'm reading is not to use containers for a web server, which makes sense because web servers have had vhosts since forever and you can host any number of sites on there independently already But what about other services, like if you want a database server as well, a mail server, etc.? I started using containers when I last upgraded hardware and while it's not as beneficial as I had hoped, it's still an improvement to be able to clone one, do a test upgrade, and only then upgrade the original one, as well as being able to upgrade services one by one rather than committing to a huge project where you upgrade the host OS and everything has to come with to the new major version
  - skydhash 1y ago
    That’s when you favor stability and use an LTS OS. You can also isolate workload by using VMs. Containers is nice for the installation part, but the immutability can be a pain.
  - kuon 1y ago
    I manage about 500 servers. Critical services like DNS, mail, tftp, monitoring, routing, firewall... are all running openbsd in N+1 configuration, and in 15 years we had zero issue with that. Now most servers are app servers, and they all run archlinux. We prepare images and we run them with PXE. Both those are out of scope for self host. But, we also have about a dozen of staging, dev, playground servers. And those are just regular installs of arch. We run postgres, redis, apps in many languages... For all that we use systems packages and AUR. DB upgrade? Zfs snapshot, and I follow arch wiki postgres upgrade, takes a few minutes, there is downtime, but it is fine. You mess anything? Zfs rollback. You miss a single file? cd .zfs/snapshots and grab it. I get about 30minutes of cumulated downtime per year on those machines. That's way enough for any self host. We use arch because we try the latest "toys" on those. If you self host take an LTS distribution and you'll be fine.
aborsy 1y ago
I can self host many applications, but their security must be outsourced to a company. I don’t have time to keep on top of vulnerabilities. Cloudflare Tunnels is a step in the right direction, but it’s not end to end encrypted. The question is then, how to secure self hosted apps with minimal configuration, in a way that is almost bulletproof?
- Aachen 1y ago
  > security must be outsourced to a company. I don’t have time to keep on top of vulnerabilities. If the software you host constantly has vulnerabilities and something like apt install unattended-upgrades doesn't resolve them, maybe the software simply isn't fit for hosting no matter what team you put on it. That hired team might as well just spend some time making it secure rather than "keeping on top of vulnerabilities"
  - aborsy 1y ago
    The concern is zero days. There are probably lots of easy zero days, patched across a host of software, once discovered in one. The solution is a secure software in front. It could be Wireguard, but sometimes you don’t know your users or they don’t want to install anything.
  - nijave 1y ago
    There's only a handful of web apps packaged in the OS repo. Even wildly popular software like WordPress and Drupal you need to use their built in facilities or manually apply outside the OS update manager
- interloxia 1y ago
  I don't need public access to my stuff so my strategy is to use zerotier taking care that services are only able to use the virtual network. It's easy to manage and reason about.
FloatArtifact 1y ago
Self-Hosting like it's 2025...uhhgg... Don't get me wrong I love some of the software suggested. However yet a another post that does not take backups as seriously as the rest of the self-hosting stack. Backups are stuck in 2013. We need plug and play backups for containers! No more roll your own with zfs datasets, back up data on the filesystem level (using sanoid/syncoid to manage snapshots or any other alternatives.
- marceldegraaf 1y ago
  Best decision of last year for my homelab: run everything in Proxmox VMs/containers and back up to a separate Proxmox Backup Server instance. Fully automated, incremental, verified backups, and restoring is one click of a button.
  - FloatArtifact 1y ago
    Yes, I'm considering that if I can't find a solution that is plug-and-play for containers Independent of the OS and file system. Although I don't mind something abstracting on top of ZFS. ZFS Mental overhead through the snapshot paradigm can lead to its own complexities. A traditional backup and restorer front end would be great. I find it strange that, especially with a docker which already knows your volumes, app data, and config, can't automatically backup and restore databases, and configs. Jeez, they could have built it right into docker.
- nunez 1y ago
  rclone is great for this. One could set up a Docker Compose service that uses rclone to gzip and back up your docker volumes to something durable to get this done. An even more advanced version of this would automate testing the backups by restoring them into a clean environment and running some tests with BATS or whatever testing framework you want.
  - nijave 1y ago
    Rclone won't take a consistent snapshot so you either need to shutdown the thing or use some other tool to export the data first
zephyreon 1y ago
I host tons of web-facing apps behind a reverse proxy. I used to have it all running in a swarm cluster with several underlying vms but decided to move everything to Unraid a while back for simplicity. Would highly recommend. https://unraid.net https://unraid.net
- raphinou 1y ago
  As mentioned in another comment, I'm currently still happy with (single node) Docker Swarms (with the reverse proxy as described on https://dockerswarm.rocks/ https://dockerswarm.rocks/ ). I like that I can basically use the docker compose files published by a lot of project to deploy. How does Unraid compare in your experience? And I like that I can deploy images which basically don't have any requirement to be deployable to Docker Swarm. Is that also the case with Unraid?
martin_a 1y ago
Still "rsync"ing the result of "hugo build" to a subfolder on a shared webhost. Works like a charm, hope it will do so forever. :-D
- finnlab 1y ago
  I'll eventually set this up to automatically deploy from git, don't worry haha
  - martin_a 1y ago
    I wrote a deploy.sh to help me with the parameters, almost feels like automatic deployment... ;-)
cullumsmith 1y ago
Still running everything from my basement using FreeBSD jails and shell scripts. Sacrificing some convenience? Probably. But POSIX shell and coreutils is the last truly stable interface. After ~12 years of doing this I got sick of tool churn.
- bitsandboots 1y ago
  Not just stable - also easy to understand when, if ever, something goes wrong. There's very little magic, very little layers of complexity.
- Gud 1y ago
  Same. Why add the complexity of docker/kubernetes/? FreeBSD and jails is so easy to maintain its unbelievable.
notpushkin 1y ago
I feel like I’ve been plugging it way too many times... but if you’re looking for a more humane alternative to Portainer, check out my project, Lunni: https://lunni.dev/ https://lunni.dev/ (Docker Swarm only for now, though I’m thinking about adding k8s later this year)
- finnlab 1y ago
  this looks really cool, I love to see some competition in this space
  - notpushkin 1y ago
    Thank you so much!
ltr_ 1y ago
just want to say that, to self host feels like the 2000's, and that's a refreshing good thing, you feel in control, away for all the enshittification we are experiencing right know. I'm having a blast with a group of friends with netbird/tailscale, creating little projects in our forgejo instance with full CI/CD for the infra, and day by day we are adding more and more stuff, our own little internet. we learn things and talk about technical stuff while setting up and implementing them, its my favorite social network now. also f big tech.
q2dg 1y ago
Cockpit-podman can be an interesting Podman-centered alternative to Portainer et al.
TimPC 1y ago
I think the reasons not to self-host are the difficulty of implementing any type of dynamic scaling. For instance when clicking on this article I get a result that their site is down. Instead of benefiting from the traffic their engagement got them, they are crashing.
mr_mitm 1y ago
This site redirects to localhost:1313. Is this some sort of April fool's joke that I'm not getting? $ curl https://kiranet.org/self-hosting-like-its-2025/ <!DOCTYPE html> <html lang="en"> <head> <title>//localhost:1313/posts/self-hosting-like-its-2025/</title> <link rel="canonical" href="//localhost:1313/posts/self-hosting-like-its-2025/"> <meta name="robots" content="noindex"> <meta charset="utf-8"> <meta http-equiv="refresh" content="0; url=//localhost:1313/posts/self-hosting-like-its-2025/"> </head> </html>
- k8sToGo 1y ago
  Now it's suddenly returning 404
  - finnlab 1y ago
    my bad, works now. Don't test in production...
- montroser 1y ago
  Yeah... Is this performance art? Intentional or otherwise? It's a jungle out there on the Internet -- we should take self-hosting as an opportunity to _simplify_. It doesn't probably need to scale way up, and doesn't need to scale across many teams of people, so it's a good time to shed a few of those layers of abstraction and get back to basics.
drKarl 1y ago
Lol that's hilarious, the url resolves to https://localhost:1313/posts/self-hosting-like-its-2025/ https://localhost:1313/posts/self-hosting-like-its-2025/, how ironic!!
- finnlab 1y ago
  tried to push an update in production like a true self-hoster...works now
captaincrunch 1y ago
It sure is self hosted! https://localhost:1313/posts/self-hosting-like-its-2025/ https://localhost:1313/posts/self-hosting-like-its-2025/
- captaincrunch 1y ago
  April fools I guess!!
spencerflem 1y ago
Sandstorm.org has picked back up the pace of development recently, and is an excellent platform wrt sharing securely between multiple users
SuperSandro2000 1y ago
some notes: - uptime kuma scales very bad, even with just 20 entries - Docker/Kubernetes is a trap, use something more suitable for a home lab like NixOS
drKarl 1y ago
I found this which is kind of hosted self-hosting: https://www.pikapods.com/ https://www.pikapods.com/
dismalpedigree 1y ago
Proxmox on a NUC. Separate RPI running HaProxy to route requests. Public 443 forwards to haproxy. All on separate vlan from home network. Router allows ssh across vlan for specific IPs. Ssh only available from the specific IPs. Some of the VPS on proxmox run Nebula protocol (like tailscale but self hosted) and there is a lighthouse on a $2 VPS. This allows me to access specific resources only from mesh network when away from home.
smjburton 1y ago
This is a great introduction to self-hosting, good job OP. As some of the other comments mentioned, discussion about self-hosted security and the importance of back-ups would be good to include. Also, you link to some great resources for discovering self-hosted applications, but it would be interesting to hear some of the software you enjoy self-hosting outside of core infrastructure. As I'm sure you're aware, self-hosters are always looking for new ideas. :)
deleted 1y ago
[deleted]
espdev 1y ago
Funny how the author doesn't give a single link in the post. The reader has to go searching, spend time to find the things the author writes about. Well, a simple example: Awesome-Selfhosted. Is it that hard to give a link? Is it some kind of phobia or religion that doesn't allow direct links on the internet? Really? Come on, it's hypertext! Where are the hyperlinks?
- TobTobXX 1y ago
  The headers are hyperlinks.
  - espdev 1y ago
    Yes, the links are now in the headers. The author has updated the post.
tvaughan 1y ago
For our startup, I decided we’d self-host as much as possible. We have one server in our office with Traefik for “firewall” and SSL termination, and our backend services are handled by Incus. Our only paid services are Tailscale and Postmark. We run things like forgejo and mattermost for our internal development work, as well as things like elasticsearch and kibana for observability into our products (100ish embedded devices distributed globally). So far so good.
72deluxe 1y ago
This seems overkill. You only need a Pi. I have a Pi4 fanless running: 1. lighttpd exposing a website, using letsencrypt and a cron job to run certbot and restart lighttpd. 2. mox (https://www.xmox.nl https://www.xmox.nl) to run a mail server, with PTR records set up by my ISP. I am not with a CG-NAT ISP else none of this would be possible. mox makes it easy enough to set up DMARC and SPF etc. with appropriate output given that you can add to your DNS records. 3. I grab the list of IPs from https://github.com/herrbischoff/country-ip-blocks https://github.com/herrbischoff/country-ip-blocks and add them to an iptables list (using ipset) every week so that I can block certain countries that have no legitimate reason to be connecting, with iptables just dropping the connection. I think I also use https://github.com/jhassine/server-ip-addresses https://github.com/jhassine/server-ip-addresses to drop certain ranges from cloud servers to make annoying script kiddies go away. 4. peer-calls (https://github.com/peer-calls/peer-calls/ https://github.com/peer-calls/peer-calls/) to be able to video call with my family and friends (with a small STUN server running locally for NAT traversal as I recall). 5. linx (https://github.com/andreimarcu/linx-server https://github.com/andreimarcu/linx-server) to share single links to files (you can get an Android app to upload from your phone) 6. filebrowser for sharing blocks of files for users (https://github.com/filebrowser/filebrowser https://github.com/filebrowser/filebrowser). 7. pihole runs on it so blocks adverts. 8. Wireguard runs on the Pi and I open the VPN ports on my router. I use the VPN on my phone so adverts are blocked when I am out and about (traffic gets routed through the Pi). 9. navidrome runs on it and I use subtracks on Android to stream (or just download albums for when I have spotty connection). 10. mpd runs on the Pi and it plays music to some speakers in the house, so I can control it with M.A.L.P on Android. 11. I use goaccess (https://goaccess.io https://goaccess.io) to look at my server logs and see what is hitting me. 12. I use maxmind geoip data so I know which countries are hitting me. 13. minidlna runs on the Pi so I can stream films to my TV. 14. I run CUPs on it too so that my rubbish wireless Samsung printer can be printed to from Android and my wife's Apple devices without having to buy an AirPlay-compatible printer. 15. xrdp running so I can log into a visual desktop on the Pi if required. My router doesn't expose SSH ports, just appropriate ports for these web services and the VPN. SSH keys are useful. SSH is not open to the world anyway and you have to VPN into the network first. This all sits happily and quietly in a cupboard and uses a feeble amount of power.
hemlock4593 1y ago
[dead]
gaeb69 1y ago
Nice blog! following.
crivlaldo 1y ago
This article motivated me to upgrade my hosting approach. I've been running a DigitalOcean VPS for years hosting my personal projects. These include a static website, n8n workflows, and Umami analytics. I used manual Docker container management, Nginx, and manual Let's Encrypt certificate renewals. I was too lazy even to set up certbot. I've migrated to a Portainer + Caddy setup. Now I have a UI for container management and automatic SSL certificate handling. It took about two hours. Thanks for bringing me to 2025!
johnmw 1y ago
I recently came across another new one that looks really nice - Canine [0]. I haven't tried it myself yet. Has anybody else given it a spin? [0]: https://canine.sh/ https://canine.sh/
pentagrama 1y ago
As a non-developer, I find it difficult to step into the self-hosting world. What I recommend for people like me is the service PikaPods [1], which takes care of the hard part of self-hosting. I have now switched from some SaaS products to self-hosted alternatives: - Feed reader: Feedly to FreshRSS. - Photo management/repository: Google Photos to Imich or Imgich (don't remember). - Bookmarks: Mozilla's Pocket to Hoarder. And so far, my experience has been simple and awesome! [1] https://www.pikapods.com https://www.pikapods.com
pookiefoof 1y ago
[dead]

221 points by finnlab 1y ago

ValdikSS 1y ago

Nah, that doesn't look fun. Self-hosting in 2025 should look like Yunohost or Sandstorm.

crabmusket 1y ago
I really like Sandstorm - it's a glimpse into an alternate world of how things could be.
- brulard 1y ago
  I tried the demo, but I still don't get it. What is it? Is it supposed to be like a collection of productivity apps, like google docs/drive ? The demo worked poorly, I waited very long time for many interactions, some didn't work at all (like changing font on etherpad).
  - crabmusket 1y ago
    I agree the current experience is sonewhat unpolished. The docs explain the vision best: https://sandstorm.org/how-it-works https://sandstorm.org/how-it-works
arnley 1y ago
You sir know how to appreciate the simplicity such service providers deliver.
- pjc50 1y ago
  I'd not heard of yunohost, so I went googling and found https://www.reddit.com/r/selfhosted/comments/1ey9ayp/what_made_you_stop_using_yunohost/ https://www.reddit.com/r/selfhosted/comments/1ey9ayp/what_ma... Seems like Docker has won so comprehensively that even more convenient (But unfamiliar) options are pushed to use it.

Helmut10001 1y ago

I tried portainer once, it looked nice and had a lot of features... for which I had no use. I always found `docker compose` much easier to use, it is often just an alias and a tab away, where for portainer I would have to open a browser tab and sometimes even touch my mouse! Otherwise good article. If you want to go rootless (which you should!), Podman is the way to go; but Docker works rootless too, with some modifications [1]. I have found Docker rootless to be reliable and robust on both Debian and Ubuntu. It also solves permissions problems because your rootless user owns files inside and outside the container, whereas with rootful setups all files outside the container are owned by root, which can be a pain. Also, you don't need Watchtower. Automatic `docker compose pull` can be setup using standard crontab, see [2]. [1]: https://du.nkel.dev/blog/2023-12-12_mastodon-docker-rootless/ https://du.nkel.dev/blog/2023-12-12_mastodon-docker-rootless... [2]: https://du.nkel.dev/blog/2023-12-12_mastodon-docker-rootless/#automatic-updates https://du.nkel.dev/blog/2023-12-12_mastodon-docker-rootless...

kalaksi 1y ago
Can I suggest Lightkeeper (I'm the maintainer): https://github.com/kalaksi/lightkeeper https://github.com/kalaksi/lightkeeper. I made it for my own needs to simplify repetitive tasks and provide an efficient view, and it has hotkeys and trying to stay "agile". You can drop to a terminal with a hotkey any time.
BrandoElFollito 1y ago
You will love dockge then. I run it alongside portainer because exactly of the compose.yaml file I want to have control over

lambdadelirium 1y ago

Muh kube

terminalbraid 1y ago

I am going to continue to stan for dokku for hosting web apps, docker images included https://dokku.com/ https://dokku.com/

SJC_Hacker 1y ago
Is that really self hosting though ? Self hosting to me is, at the very least having physical access to the machines.
- rubslopes 1y ago
  I think GP miswrote; Dokku does not host, it manages containers and makes deployment easier. It's like a self-hosted Heroku.
- boxed 1y ago
  Yes, it's self hosting. You have access to the machine.
rubslopes 1y ago
coolify.io is also a great open-source alternative if someone wants a web interface.
- brulard 1y ago
  Anyone with experience to compare Coolify vs. Dokku? (and maybe something else?)
oulipo 1y ago
Dokploy is really nice
thebiglebrewski 1y ago
Aw yes Dokku is still great in 2025! Hear hear!
sujaldev 1y ago
There's caprover too: https://caprover.com/ https://caprover.com/

nodesocket 1y ago

I recently discovered Beszel (https://github.com/henrygd/beszel https://github.com/henrygd/beszel) for monitoring all my homelab servers. It's quick, easy, and has a very clean and intuitive interface. Works especially well running inside of containers on hosts. I also wrote a very quick guide on getting it running inside of Kubernetes at https://github.com/henrygd/beszel/discussions/431 https://github.com/henrygd/beszel/discussions/431. While it's not nearly as powerful as say DataDog, it provides the core essentials of CPU, memory, disk, network, temperature and even GPU monitoring (via agent only).

hankchinaski 1y ago

The only thing that holds me back for self hosting is Postgres. Has anyone managed to get a rock solid Postgres setup self managed? Backups + tuning?

nodesocket 1y ago
I run a few PostgreSQL instances in containers (Kubernetes via Bitnami Helm chart). I know running stateful databases is generally not best practice but for development/homelab and tinkering works great. Bitnami PostgreSQL Helm chart - https://github.com/bitnami/charts/tree/main/bitnami/postgresql https://github.com/bitnami/charts/tree/main/bitnami/postgres...
candiddevmike 1y ago
What is your RTO/RPO?
- orthoxerox 1y ago
  1s/0s
- nijave 1y ago
  RTO - best effort RPO - wait? You guys have backups and test then??
lytedev 1y ago
I self-host Postgres at home and am probably screwing it up! I do at least have daily backups, but tuning is something I have given very little thought to. At home, traffic doesn't cause much load. I'm curious as to what issues you might be alluding to! Nix (and I recently adopted deploy-rs to ensure I keep SSH access across upgrades for rolling back or other troubleshooting) makes experimenting really just a breeze! Rolling back to a working environment becomes trivial, which frees you up to just try stuff. Plus things are reproducible so you can try something with a different set of machines before going to "prod" if you want.
homebrewer 1y ago
Put it on a zfs dataset and back up data on the filesystem level (using sanoid/syncoid to manage snapshots, or any of their alternatives). It will be much more efficient compared to all other backup strategies with similar maintenance complexity.

bauerd 1y ago

Last thing I need is Kubernetes at home

nodesocket 1y ago
I run Kubernetes on my homelab on 4x Raspberry Pi's then use Portainer to manage it. Works quite well, can use Helm charts when available, otherwise I use Portainer and deploy container apps manually. It's really not that bad.
- dailykoder 1y ago
  I'm sure you find some joy in it or just like to explore what's possible. But just a reminder: Pieter Levels is running his million dollar businesses on a single VPS (if that's still correct). But yeah, if you like it, why not. "Premature clustering is the source of all evil" - or something like that.
import 1y ago
Exactly. I am hosting 30+ services using docker compose and very happy. I don’t want to troubleshoot k8s in the early morning because home assistant is down and light dimmers are not working for some random k8s reason.
- johnisgood 1y ago
  I am quite happy even without Docker, but I can see the appeal in some cases.
- seba_dos1 1y ago
  All my "smart home" stuff needs is mosquitto on a OpenWrt router and bunch of cgi-bin scripts that can run anywhere. I already went through a phase of setting up tons of services which ended up being turned off when something changed in my life (moving, replacing equipment etc.) never to be resurrected as I couldn't be bothered to redo it without the novelty effect, so I learned from that.
- vbezhenar 1y ago

megous 1y ago

My peace of mind comes from my self hosting in 2025 looking the same as my self-hosting in 2005 (except a move to systemd). I haven't even re-installed my workstation OS since 2006 or so.

johnisgood 1y ago
I see a lot of people mention some technology under this submission that you do not even have to look at when you are self-hosting. It all depends what you want to self-host, from nginx, fcgiwrap (with certbot), to an e-mail server, or a Matrix instance, or Zulip, or what have you these days. I maintain quite many servers and I do not use these new and fancy technologies. I'm just a boomer (technically a millennial) who sticks to Arch Linux even when it comes to servers, I have zero friction, really. I have no issues self-hosting whatever me or a client requires, keeping it minimal and functional. I self-host like it is 2000 (apart from a couple of some more modern stuff, if you could consider systemd and certbot, etc. modern). :D
MortyWaves 1y ago
2006 is impressive. I can’t even imagine that. I reinstall Windows every 18 months or so.
- Aachen 1y ago
  I don't think I've reinstalled since around 2014, when I switched to a different Linux distribution. It's just a pain and while it cleans up some unused packages, what's the point really? Why do you reinstall Windows every 18 months? One change I made that may help with this, is to not install crap on the host that I don't plan to use for a long time. Trying out a new database server or want to set up an Android IDE for a temporary project? Use a VM, don't clutter up random files all over the host. Is this what is happening on your Windows perhaps?
  - MortyWaves 1y ago
    Windows seems to insistent on crappifying itself. Even if you have a small set of installed applications, many of them behave poorly. Lots and lots of small paper cuts add up. A few dozen registry entries here, a few files there, seven or eight Explorer right click menu extensions (like eg “Edit with X” instead of just using the normal “Open With”) setup by installers. The end result is right clicking has noticeable delay in some directories. Boot takes a few seconds longer than it did the first time it was installed. Some applications, even Task Manager inexplicably hang with a white window for a few seconds. The shell (part of Explorer) no longer displaying anything when searching in the start menu (because it tries to connect to the internet to search bing and that sometimes stops working rendering half the start menu useless). The “modern” settings app hanging with its blue window and icon for anywhere from seconds to indefinitely. It’s just a lot of this bullshit that adds up. Reinstalling Windows makes it like it was day one.

vbezhenar 1y ago

I'm slowly configuring my new VPS. Here's approach I'm taking: 1. RHEL 9 with Developer Subscription. Installed dnf-automatic, set `reboot = when-changed`, so it's zero effort to reliably apply all updates with daily reboots. One or two minutes of downtime, not a big deal. 2. For services: podman with quadlets. It's RH-flavoured replacement for docker-compose. Not sure, if I like it, but I guess that's the "future", so I'm embracing it. Every service is a custom-built image with common parent to reduce space waste (by reusing base OS layer). So far I want to run static http (nginx), vaultwarden, postfix and some webmail. May be more in the future. This setup wastes a lot of disk space for image data, so expect to order few more gigabytes of disk to pay for modern tech.

deleted 1y ago

[deleted]

rullopat 1y ago

What about Kamal? https://kamal-deploy.org/ https://kamal-deploy.org/ Did anybody here use it for anything that is not a Ruby on Rails app?

MortyWaves 1y ago
The thing that puts me off is its seemingly heavy focus on “web apps”. I have a bunch of services I either use or wrote myself and only a handful have anything to do with the web.
echoperkins 1y ago
Yes, I have been using it and really enjoying it for deploying web apps. So far I have deployed web apps using: * fastapi (python) * Django ninja (python) * ghost cms (node) I have been writing up my thoughts (and an example): https://andrewperkins.com.au/kamal/ https://andrewperkins.com.au/kamal/ The ability to deploy to both cloud servers and on-premises is a big win as I often work on projects that have a mix of both. As the sibling comment says, it’s focussed on web servers. In my use case that is fine!
- rullopat 1y ago
  Great! Are you also deploying DB servers or any other kind of additional servers that are dependencies of those webapps?
  - echoperkins 1y ago
    Yes, I am deploying mysql with ghost ``` accessories: db: image: mysql:8.0 host: 170.64.156.161 env: secret: - MYSQL_ROOT_PASSWORD options: restart: always directories: - data:/var/lib/mysql ``` For my other services I am just using sqlite combined with a volume for persistence (managed by kamal)

jagermo 1y ago

i really like this software-centric approach, but I am a bit stuck when it comes to the hardware. Are there some sources around servers that don't suck up too much energy and are fairly quiet? What CPU is a good all-round solution?

brulard 1y ago
Depends on your needs. For some Raspberry Pi (ideally with 8-16GB RAM) + SSD can be enough if you are after low power consumption. If you need more power: I had success with HP ProDesk Mini (or any other one-litre PC), you can get these second hand from like $150 and extend RAM and SSDs however you like. You can even pick processor / generation to fit your needs best. These can have consumption from like 30W if I'm not mistaken. I have no experience with real and expensive server hardware, but most people don't need that for a homelab.
- Aachen 1y ago
  > For some Raspberry Pi (ideally with 8-16GB RAM) + SSD can be enough Wut? For many, a Raspberry Pi with 1 GB RAM and the regular sdcard can be enough, you really don't need to go fancy if you don't want to run anything particularly heavy. Or if it's cpu-intensive then you might need the newest Pi or something even beefier but still only the lowest RAM and smallest/slowest storage options (like for WordPress). As you say, it depends on needs I always recommend using an old laptop to start out with because you've already got it anyway and it's already low power yet very powerful: if it can run graphical software from 2020 then it'll be fine as server until 2030 for anything standard like a web server (with half a dozen websites and databases, such as a link shortener, some data explorers, and my personal site), torrent box, VPN server, mail server, git server, IRC bouncer, Windows VM for some special software, chat bot, etc. all at once. At least, that's what I currently run on my 2012 laptop and the thing is idle nearly the whole time. Other advantages of a laptop include a built-in KVM console and UPS, at least while you still trust the old battery (one should detach and recycle that component after some years)
  - brulard 1y ago

TrayKnots 1y ago

I am actually worried about the self-hosting pandemic. We self-hosters will stop flying under the radar. Wonder how long it will take until our matrix instances require to be backdoored, our immich are scanning our pictures with AI. On an unrelated note, an article of how to rent a VPS in China would be interesting :)

pjc50 1y ago
> an article of how to rent a VPS in China would be interesting Given that apparently it's quite difficult to even get a WeChat account without a national ID, I suspect that step 1 is "learn mandarin" and step 2 is "get a Chinese national ID".
- throawayonthe 1y ago
  [dead]
- thenthenthen 1y ago
  Also your home modem/router is often tied to your ID and then there is ofc the firewall. IIRC You can get vos hosting and ICP code through Ali Cloud somewhat automagically. Agree it would be nice to give it a try some time.
- vbezhenar 1y ago
  I didn't have any problems creating wechat account. May be I was lucky, I don't know, I just typed my phone number and it went pretty smooth, like whatsapp. Also was able to connect my visa card. I did it in the Kazakhstan and then was able to pay in China, no problems. May be they got exception for Kazakhstan specifically, we recently got visa-free travels there.
- TobTobXX 1y ago
  Did you try? It's a few years ago when I had to create one, but it was just as simple as WhatsApp (just a few more CAPTCHAs). And no VPNs or whatever, straight from a Swiss IP.
ciupicri 1y ago

candiddevmike 1y ago

If any self hosters are burnt out by the state of config management tools and YAML, consider giving Etcha a shot (https://etcha.dev https://etcha.dev). It's stateful (cleans up things when they're no longer in your config), procedural (you control the flow and can trigger things as needed), and supports flexible deployment models (push or pull). Full disclosure, I created it and use it across my business and personal devices.

simoncion 1y ago
> It's started (cleans up things when they're no longer in your config)... Would you please call this something else? "It automatically reconciles", perhaps? I know that a multi-word phrase isn't nearly as snappy, but not only are "it's started" and "started" overloaded with a bunch of meanings, approximately zero of them mean what you want them to mean in this new context.
- candiddevmike 1y ago
  Sorry, autocorrect changed stateful to started.
  - simoncion 1y ago
    Ye olde autodefect makes fools of us all, eventually. (As does the ever-present HN urge to downvote things for no comprehensible reason. Seriously, why the fuck would someone downvote an honest explanation for a typo? Animals, I guess.)

qudat 1y ago

I’ve been self hosting small web apps using an SSH service https://tuns.sh https://tuns.sh and it helped me replace my DO droplet pretty successfully. What’s nice is it also has built-in usage analytics, alert notifications when a tunnel goes down, and fully manageable with a remote TUI which means I don’t have to install anything to use it.

anymouse123456 1y ago

[flagged]

lifestyleguru 1y ago
In my own kingdom I write bash on Linux. In my own kingdom I don't have to listen to caged monkeys on caffeine. Not even a single YAML in the codebase.
0xCE0 1y ago
This.

oliwary 1y ago

Does anyone have any experience with coolify? https://coolify.io/ https://coolify.io/ I am considering switching the hosting of my online games to it.

James_K 1y ago

I tell you the real problem with self hosting: people using monospace fonts for body text.

MortyWaves 1y ago
But mono fonts let the reader know they are reading Serious Technical Content ™
- sceptic123 1y ago
  Why is the snark here downvoted, but not the original message?
  - MortyWaves 1y ago
    Doesn’t seem downvoted to me
    - sceptic123 1y ago
      enough people enjoyed it to upvote it again I guess, weird that I got a downvote here too

Youden 1y ago

I've been through just about everything to get where I am and I've ended up with Hashicorp Nomad and Consul with Traefik, managed by OpenTofu (open-source Terraform). Things that haven't worked for me: - Standalone Docker: Doesn't work great on its own. Containers often need to be recreated to modify immutable properties, like the specific image the container is running. To recreate the container, you need to store some state about how it _should_ work elsewhere. - Quadlet: Too hard to manage clusters of services. Podman has subtle differences to Docker that occasionally cause problems and really tempting features (e.g. rootless) that cause more problems if you try to use them. - Kubernetes: Waaaay too heavy. Even the "lightweight" distributions like k3s, k0s etc. embed large components of the official distribution, which are still heavy. Part of the embedded metric server for example periodically enumerates every single open file handle in every container. This leads to huge CPU spikes for a feature I don't care about. With my setup now, I can more or less copy-paste a template into a new file, tweak some strings and have a HTTPS-enabled service available at https://thing.mydomain.mine https://thing.mydomain.mine. This works pretty painlessly even for services that need several volumes to maintain state or need several containers that work together.

JojoFatsani 1y ago
Docker Compose is very suitable for the homelab scenario. I use it on my pi.
quickslowdown 1y ago
Do you run a Nomad cluster? Or just on a single host? This is my desired state, I've set up Nomad a number of times but always get stuck in one place or another. I've gotten much further with Nomad than Kubernetes, but I've kind of always gone back to ol' faithful, writing a docker compose file and running everything that way.
- Youden 1y ago
  Just a single host. The main thing that I couldn't figure out is how to turn off "bootstrap" mode, so I've just left it on.

0xEF 1y ago

I love the idea of self-hosting, especially since I keep a number of very tiny websites/projects going at any given time, so resources would not really be too much of an issue for me. What stops me is security. I simply do not know enough about securing a self-hosted site on real hardware in my home and despite actively continuing to learn, it seems like the more I learn about it, the more questions I have. My identity is fairly public at this point, so if I say the wrong thing to the wrong person on HN or whatever, do I need to worry about someone much smarter than me setting up camp on my home network and ruining my life? That may sound really stupid to many of you, but this is the type of anxiety that stops the under-informed from trying stuff like this and turning to services like Akamai/Linode or DO that make things fairly painless in terms of setup, monitoring and protection. That said, I'm 110% open to reading/watching any resources people have that help teach newbies how to protect their assets when self-hosting.

doublerabbit 1y ago
A VPS with a software firewall is more than enough. Block port 22, secure SSH with certificates only. Allow port 443 and configure your web server as a reverse proxy with a private backend. You don't need an IDS, you don't need a WAF and you don't need Cloudflare. Unless you become the next Facebook that's when you start to become concerned about security.
- XorNot 1y ago
  I'm less worried about SSH access then I am abotya vulnerability in some front-end web service though. I've contented myself using TLS client certs on my family's Android phones (which do not work at all on iOS for something like Home Assistant).
- palata 1y ago
  > A VPS with a software firewall is more than enough. So you don't self-host at home, right? I have been considering setting up a physical DMZ at home, with two routers (each with its own firewall), such that my LAN stays unmodified and my server can run between both routers. Then it feels like it would be similar to having a VPS in terms of security, maybe?

kuon 1y ago

If you self host, do not use containers and all those things. Just use a static site generator like zola or hugo and rsync to a small VPS running caddy or nginx. If you need dynamic thing, there are many frameworks you can just rsync too with little dependencies. Or use PHP, it's not that bad. Just restrict all locations except public ones to your ip in nginx config if you use something like wordpress and you should be fine. If you have any critical stuff, create a zfs dataset and use that to backup to another VPS using zfs send, there are tools to make it easy, much easier than DB replication.

Aachen 1y ago
What I'm reading is not to use containers for a web server, which makes sense because web servers have had vhosts since forever and you can host any number of sites on there independently already But what about other services, like if you want a database server as well, a mail server, etc.? I started using containers when I last upgraded hardware and while it's not as beneficial as I had hoped, it's still an improvement to be able to clone one, do a test upgrade, and only then upgrade the original one, as well as being able to upgrade services one by one rather than committing to a huge project where you upgrade the host OS and everything has to come with to the new major version
- skydhash 1y ago
  That’s when you favor stability and use an LTS OS. You can also isolate workload by using VMs. Containers is nice for the installation part, but the immutability can be a pain.
- kuon 1y ago
  I manage about 500 servers. Critical services like DNS, mail, tftp, monitoring, routing, firewall... are all running openbsd in N+1 configuration, and in 15 years we had zero issue with that. Now most servers are app servers, and they all run archlinux. We prepare images and we run them with PXE. Both those are out of scope for self host. But, we also have about a dozen of staging, dev, playground servers. And those are just regular installs of arch. We run postgres, redis, apps in many languages... For all that we use systems packages and AUR. DB upgrade? Zfs snapshot, and I follow arch wiki postgres upgrade, takes a few minutes, there is downtime, but it is fine. You mess anything? Zfs rollback. You miss a single file? cd .zfs/snapshots and grab it. I get about 30minutes of cumulated downtime per year on those machines. That's way enough for any self host. We use arch because we try the latest "toys" on those. If you self host take an LTS distribution and you'll be fine.

aborsy 1y ago

I can self host many applications, but their security must be outsourced to a company. I don’t have time to keep on top of vulnerabilities. Cloudflare Tunnels is a step in the right direction, but it’s not end to end encrypted. The question is then, how to secure self hosted apps with minimal configuration, in a way that is almost bulletproof?

Aachen 1y ago
> security must be outsourced to a company. I don’t have time to keep on top of vulnerabilities. If the software you host constantly has vulnerabilities and something like apt install unattended-upgrades doesn't resolve them, maybe the software simply isn't fit for hosting no matter what team you put on it. That hired team might as well just spend some time making it secure rather than "keeping on top of vulnerabilities"
- aborsy 1y ago
  The concern is zero days. There are probably lots of easy zero days, patched across a host of software, once discovered in one. The solution is a secure software in front. It could be Wireguard, but sometimes you don’t know your users or they don’t want to install anything.
- nijave 1y ago
  There's only a handful of web apps packaged in the OS repo. Even wildly popular software like WordPress and Drupal you need to use their built in facilities or manually apply outside the OS update manager
interloxia 1y ago
I don't need public access to my stuff so my strategy is to use zerotier taking care that services are only able to use the virtual network. It's easy to manage and reason about.

FloatArtifact 1y ago

Self-Hosting like it's 2025...uhhgg... Don't get me wrong I love some of the software suggested. However yet a another post that does not take backups as seriously as the rest of the self-hosting stack. Backups are stuck in 2013. We need plug and play backups for containers! No more roll your own with zfs datasets, back up data on the filesystem level (using sanoid/syncoid to manage snapshots or any other alternatives.

marceldegraaf 1y ago
Best decision of last year for my homelab: run everything in Proxmox VMs/containers and back up to a separate Proxmox Backup Server instance. Fully automated, incremental, verified backups, and restoring is one click of a button.
- FloatArtifact 1y ago
  Yes, I'm considering that if I can't find a solution that is plug-and-play for containers Independent of the OS and file system. Although I don't mind something abstracting on top of ZFS. ZFS Mental overhead through the snapshot paradigm can lead to its own complexities. A traditional backup and restorer front end would be great. I find it strange that, especially with a docker which already knows your volumes, app data, and config, can't automatically backup and restore databases, and configs. Jeez, they could have built it right into docker.
nunez 1y ago
rclone is great for this. One could set up a Docker Compose service that uses rclone to gzip and back up your docker volumes to something durable to get this done. An even more advanced version of this would automate testing the backups by restoring them into a clean environment and running some tests with BATS or whatever testing framework you want.
- nijave 1y ago
  Rclone won't take a consistent snapshot so you either need to shutdown the thing or use some other tool to export the data first

zephyreon 1y ago

I host tons of web-facing apps behind a reverse proxy. I used to have it all running in a swarm cluster with several underlying vms but decided to move everything to Unraid a while back for simplicity. Would highly recommend. https://unraid.net https://unraid.net

raphinou 1y ago
As mentioned in another comment, I'm currently still happy with (single node) Docker Swarms (with the reverse proxy as described on https://dockerswarm.rocks/ https://dockerswarm.rocks/ ). I like that I can basically use the docker compose files published by a lot of project to deploy. How does Unraid compare in your experience? And I like that I can deploy images which basically don't have any requirement to be deployable to Docker Swarm. Is that also the case with Unraid?

martin_a 1y ago

Still "rsync"ing the result of "hugo build" to a subfolder on a shared webhost. Works like a charm, hope it will do so forever. :-D

finnlab 1y ago
I'll eventually set this up to automatically deploy from git, don't worry haha
- martin_a 1y ago
  I wrote a deploy.sh to help me with the parameters, almost feels like automatic deployment... ;-)

cullumsmith 1y ago

Still running everything from my basement using FreeBSD jails and shell scripts. Sacrificing some convenience? Probably. But POSIX shell and coreutils is the last truly stable interface. After ~12 years of doing this I got sick of tool churn.

bitsandboots 1y ago
Not just stable - also easy to understand when, if ever, something goes wrong. There's very little magic, very little layers of complexity.
Gud 1y ago
Same. Why add the complexity of docker/kubernetes/? FreeBSD and jails is so easy to maintain its unbelievable.

notpushkin 1y ago

I feel like I’ve been plugging it way too many times... but if you’re looking for a more humane alternative to Portainer, check out my project, Lunni: https://lunni.dev/ https://lunni.dev/ (Docker Swarm only for now, though I’m thinking about adding k8s later this year)

finnlab 1y ago
this looks really cool, I love to see some competition in this space
- notpushkin 1y ago
  Thank you so much!

ltr_ 1y ago

just want to say that, to self host feels like the 2000's, and that's a refreshing good thing, you feel in control, away for all the enshittification we are experiencing right know. I'm having a blast with a group of friends with netbird/tailscale, creating little projects in our forgejo instance with full CI/CD for the infra, and day by day we are adding more and more stuff, our own little internet. we learn things and talk about technical stuff while setting up and implementing them, its my favorite social network now. also f big tech.

q2dg 1y ago

Cockpit-podman can be an interesting Podman-centered alternative to Portainer et al.

TimPC 1y ago

I think the reasons not to self-host are the difficulty of implementing any type of dynamic scaling. For instance when clicking on this article I get a result that their site is down. Instead of benefiting from the traffic their engagement got them, they are crashing.

mr_mitm 1y ago

This site redirects to localhost:1313. Is this some sort of April fool's joke that I'm not getting? $ curl https://kiranet.org/self-hosting-like-its-2025/ <!DOCTYPE html> <html lang="en"> <head> <title>//localhost:1313/posts/self-hosting-like-its-2025/</title> <link rel="canonical" href="//localhost:1313/posts/self-hosting-like-its-2025/"> <meta name="robots" content="noindex"> <meta charset="utf-8"> <meta http-equiv="refresh" content="0; url=//localhost:1313/posts/self-hosting-like-its-2025/"> </head> </html>

k8sToGo 1y ago
Now it's suddenly returning 404
- finnlab 1y ago
  my bad, works now. Don't test in production...
montroser 1y ago
Yeah... Is this performance art? Intentional or otherwise? It's a jungle out there on the Internet -- we should take self-hosting as an opportunity to _simplify_. It doesn't probably need to scale way up, and doesn't need to scale across many teams of people, so it's a good time to shed a few of those layers of abstraction and get back to basics.

drKarl 1y ago

Lol that's hilarious, the url resolves to https://localhost:1313/posts/self-hosting-like-its-2025/ https://localhost:1313/posts/self-hosting-like-its-2025/, how ironic!!

finnlab 1y ago
tried to push an update in production like a true self-hoster...works now

captaincrunch 1y ago

It sure is self hosted! https://localhost:1313/posts/self-hosting-like-its-2025/ https://localhost:1313/posts/self-hosting-like-its-2025/

captaincrunch 1y ago
April fools I guess!!

spencerflem 1y ago

Sandstorm.org has picked back up the pace of development recently, and is an excellent platform wrt sharing securely between multiple users

SuperSandro2000 1y ago

some notes: - uptime kuma scales very bad, even with just 20 entries - Docker/Kubernetes is a trap, use something more suitable for a home lab like NixOS

drKarl 1y ago

I found this which is kind of hosted self-hosting: https://www.pikapods.com/ https://www.pikapods.com/

dismalpedigree 1y ago

Proxmox on a NUC. Separate RPI running HaProxy to route requests. Public 443 forwards to haproxy. All on separate vlan from home network. Router allows ssh across vlan for specific IPs. Ssh only available from the specific IPs. Some of the VPS on proxmox run Nebula protocol (like tailscale but self hosted) and there is a lighthouse on a $2 VPS. This allows me to access specific resources only from mesh network when away from home.

smjburton 1y ago

This is a great introduction to self-hosting, good job OP. As some of the other comments mentioned, discussion about self-hosted security and the importance of back-ups would be good to include. Also, you link to some great resources for discovering self-hosted applications, but it would be interesting to hear some of the software you enjoy self-hosting outside of core infrastructure. As I'm sure you're aware, self-hosters are always looking for new ideas. :)

deleted 1y ago

[deleted]

espdev 1y ago

Funny how the author doesn't give a single link in the post. The reader has to go searching, spend time to find the things the author writes about. Well, a simple example: Awesome-Selfhosted. Is it that hard to give a link? Is it some kind of phobia or religion that doesn't allow direct links on the internet? Really? Come on, it's hypertext! Where are the hyperlinks?

TobTobXX 1y ago
The headers are hyperlinks.
- espdev 1y ago
  Yes, the links are now in the headers. The author has updated the post.

tvaughan 1y ago

For our startup, I decided we’d self-host as much as possible. We have one server in our office with Traefik for “firewall” and SSL termination, and our backend services are handled by Incus. Our only paid services are Tailscale and Postmark. We run things like forgejo and mattermost for our internal development work, as well as things like elasticsearch and kibana for observability into our products (100ish embedded devices distributed globally). So far so good.

72deluxe 1y ago

This seems overkill. You only need a Pi. I have a Pi4 fanless running: 1. lighttpd exposing a website, using letsencrypt and a cron job to run certbot and restart lighttpd. 2. mox (https://www.xmox.nl https://www.xmox.nl) to run a mail server, with PTR records set up by my ISP. I am not with a CG-NAT ISP else none of this would be possible. mox makes it easy enough to set up DMARC and SPF etc. with appropriate output given that you can add to your DNS records. 3. I grab the list of IPs from https://github.com/herrbischoff/country-ip-blocks https://github.com/herrbischoff/country-ip-blocks and add them to an iptables list (using ipset) every week so that I can block certain countries that have no legitimate reason to be connecting, with iptables just dropping the connection. I think I also use https://github.com/jhassine/server-ip-addresses https://github.com/jhassine/server-ip-addresses to drop certain ranges from cloud servers to make annoying script kiddies go away. 4. peer-calls (https://github.com/peer-calls/peer-calls/ https://github.com/peer-calls/peer-calls/) to be able to video call with my family and friends (with a small STUN server running locally for NAT traversal as I recall). 5. linx (https://github.com/andreimarcu/linx-server https://github.com/andreimarcu/linx-server) to share single links to files (you can get an Android app to upload from your phone) 6. filebrowser for sharing blocks of files for users (https://github.com/filebrowser/filebrowser https://github.com/filebrowser/filebrowser). 7. pihole runs on it so blocks adverts. 8. Wireguard runs on the Pi and I open the VPN ports on my router. I use the VPN on my phone so adverts are blocked when I am out and about (traffic gets routed through the Pi). 9. navidrome runs on it and I use subtracks on Android to stream (or just download albums for when I have spotty connection). 10. mpd runs on the Pi and it plays music to some speakers in the house, so I can control it with M.A.L.P on Android. 11. I use goaccess (https://goaccess.io https://goaccess.io) to look at my server logs and see what is hitting me. 12. I use maxmind geoip data so I know which countries are hitting me. 13. minidlna runs on the Pi so I can stream films to my TV. 14. I run CUPs on it too so that my rubbish wireless Samsung printer can be printed to from Android and my wife's Apple devices without having to buy an AirPlay-compatible printer. 15. xrdp running so I can log into a visual desktop on the Pi if required. My router doesn't expose SSH ports, just appropriate ports for these web services and the VPN. SSH keys are useful. SSH is not open to the world anyway and you have to VPN into the network first. This all sits happily and quietly in a cupboard and uses a feeble amount of power.

hemlock4593 1y ago

[dead]

gaeb69 1y ago

Nice blog! following.

crivlaldo 1y ago

This article motivated me to upgrade my hosting approach. I've been running a DigitalOcean VPS for years hosting my personal projects. These include a static website, n8n workflows, and Umami analytics. I used manual Docker container management, Nginx, and manual Let's Encrypt certificate renewals. I was too lazy even to set up certbot. I've migrated to a Portainer + Caddy setup. Now I have a UI for container management and automatic SSL certificate handling. It took about two hours. Thanks for bringing me to 2025!

johnmw 1y ago

I recently came across another new one that looks really nice - Canine [0]. I haven't tried it myself yet. Has anybody else given it a spin? [0]: https://canine.sh/ https://canine.sh/

pentagrama 1y ago

As a non-developer, I find it difficult to step into the self-hosting world. What I recommend for people like me is the service PikaPods [1], which takes care of the hard part of self-hosting. I have now switched from some SaaS products to self-hosted alternatives: - Feed reader: Feedly to FreshRSS. - Photo management/repository: Google Photos to Imich or Imgich (don't remember). - Bookmarks: Mozilla's Pocket to Hoarder. And so far, my experience has been simple and awesome! [1] https://www.pikapods.com https://www.pikapods.com

pookiefoof 1y ago

[dead]