Sounds like his family is in a pickle if he’s out of town and the server goes down.

I just checked on my *arr stack. Sonarr and Radarr idle at 157MB and 159MB of memory and approximately no CPU. Jellyfin currently idles at 330MB. I'm not sure where you got this impression from. I grant these tools are complicated and have somewhat clumsy UX, but they aren't especially heavy to run and are not fragile.

OP, point your :robot: at https://github.com/subdavis/selfhosted/blob/main/docker-comp... and ask for an explanation. It's a single compose file that illustrates how the *arrs, transmission, and jellyfin all work together. I'm sure you can set it up :)

Here is the stack I recommend:

* Radarr (movies) with optional second instance for 4K versions

* Sonarr (shows) with optional second instance for 4K versions

* Sonarr (anime), separate instance to have control over quality settings

* Prowlarr (tracker/indexer management)

* SABnzbd (Usenet)

* qBittorrent (torrents)

I would also recommend consulting the TRaSH guide to tune your setup and ensure you’re grabbing quality releases. From there, the next logical step is Profilarr :)

So I'm also surprised why someone would configure a second instance for that

I suspect it's would still work, but haven't tried it out

Sonarr/radarr has the ability to configure multiple library roots. Those are available in a drop-down when adding a new series through the (son|rad)arr interface

This is eg /media/(anime-series|series) for me. Then I defined a rule for those paths to add an anime|lifeaction Tag.

This then controls the tracker and quality profiles, as well as language preferences etc

Or, even better, the entire arr stack can be replaced with stremio to just keep everything on-demand instead of curating a library at all.

Usenet streaming sounds cool, but with releases being DMCAd so frequently, I don’t see how it would be practical for anything but the most recent content.

Also, I imagine that Stremio without Debrid (or equivalent) is kind of a terrible experience most of the time.

Is this the latest rendition of Popcorn Time?

Where does that hosted stream live? I'll have to peep their docs. Sounds interesting

I have never had any issues with the speed though and I regularly stream 50+ GB files.

https://github.com/Jackett/Jackett

Quite a feat considering it was developed without AI help.

But I do think that there is an opportunity to merge Sonarr and Radarr.

Definitely not a usecase for everyone

It’s also nice to have them separated because you can set up distinct plex libraries mapped to the sonarr and radarr 4K media directories. I don’t give everyone access to 4K content because no matter how many times I explain direct play, some people just seem to love transcoding to 720p. So I can limit 4K library access on plex and disable transcoding altogether for plex content.

I also don’t want every item I add in both 4K and 1080p.

Im having problem on some new releases where it downloads clear malware with. Exe files, its detecting it and not moving them to my jellyfine storage but it always requires manual intervention. I havent been able to find a way to stop sonarr from grabbing releases before their official releas and with n amount of seedwrs/leechers

Yes and no. E.g. I find Trash guide to quality profiles/settings useless. I wish *arr apps shipped with decent modern quality by default. No, I'm not downloading and watching a Quantum Quality UXZHD Post-Partum HDR BVIU-49.3 format. No one is.

E.g. profilarr pulls in a more sane set of profiles: https://dictionarry.dev/quality-profile

One of the most valuable things for me is the ability to rank different aspects of releases across media types. For example, I prefer dual audio anime, unless the sub is much higher quality. Same idea for surround sound and release groups. I also want to ignore things like dual audio that is non-English, or hardcoded French subs, etc.

I tried it once, and it just polluted the profiles with dozens of Trash Guide profiles :)

So I went with Profilarr which has sensible setups like "2160p Quality" etc.

> One of the most valuable things for me is the ability to rank different aspects of releases across media types.

Oh, this is something I tried to setup as well, and failed. It doesn't help that IIRC languages are not properly indexed/set up in ^arrs if I remember. Like you have to set "language = 53" for English or something like that.

I think all this complexity is down to the fact that ^arr apps grew organically on top of other things that grew organically, so the data models are all screwed up, and no one has the time or knowledge to clean it up and make better.

Highly recommend them to OP. My stack went down once in the past 4 years and it was my fault.

1. Clear that "might", it either is or isn't. An AI can get you 90% there, maybe the definitive confirmation would be good from a lawyer.

2. None of this matters if you share it from a foreign code forge and an anonymous pseudonym.

if anyone decided on their own to put that it into a local model and generate their own version of something that met the theoretical spec thats their own deal...

Almost all of the time went to to the downloader (usenet is more complicated than I thought). If I had just focused on the basics (sonarr, radarr, seerr) I could probably could have knocked it out in a day or so.

Without a tested and validated reference implementation that already accounts for the numerous edge conditions and quirks of media releases, APIs, etc., your vibecoded version would have taken much longer to iterate on.

First was Lidarr went for months last year (was it this year?) unable to search/add musicians due to complications with how they were relaying those searches. It took them a long time to refactor that part of the software and make it usable again.

Second was the retirement of Readarr, the ebook-version of this software, which was an absolute shame.

But aside from that this is pretty much set-and-forget software. Although the setting is harder than it should be, should be much easier to favour smallest x265 rips at <resolution>, lossless audio, season rips with subtitles.

Take a look at https://github.com/epiccoleman/tharmas/blob/main/schooner/do... for an example if you like.

Apparently I haven't pushed, shelfmark used to be `calibre-automated-book-downloader`

and that's totally ignoring the fact that it's only a supremely naive user that hasn't yet refined their filters to exclude dangerous extensions (or, if they're too lazy to do that, rely on one of the many many pre-assembled filter/grabber settings across the net which already do so.)

what fear-mongering and FUD-spread.

You may also want to warn the public about the dangers of having curl, wget, python or gcc installed.

They expose a PLETHORA of attack vectors! you're probably already compromised, realistically!"

... and they're actually more dangerous than a free-floating EXE.

Whenever I use them I wonder if they could be one unified app with plugins...?

There’s no value to this post honestly.

A single dream app that combines: Media server, crawler, downloader, subtitle, cloudflare bypass etc, with plugin support.

It’s all open source and harness agnostic [1]. I’m the park ranger for life aka maintainer of the project. Did a recent YouTube video with what i think the future of open source multiagent setups will look like [2]

Happy to chat more about it

[0] https://woltspace.com/ [1] https://github.com/jerpint/woltspace [2] https://www.youtube.com/watch?v=H-4khO7o0XQ

Most people do not want to solve the problem of: "how do I download and match arbitrary user-uploaded media across multiple databases"

My dream app is split into two parts. One that serves podcasts, music, books (with OPDS so I can browse my library with KOReader), tv, movies, other multimedia (youtube, whatever else). The other handling the metadata APIs and downloading files from different sources (torrent trackers, torrent DHT, nntp, etc...). Sort of like uber-Jellyfin + uber-Arr.

I guess I can probably get a personal API key for TheTVDB, etc... and develop my own sort of proxy and it wouldn't be so bad. Hmm...

(And I agree, for most workloads monoliths are much easier to grasp and deploy than microservices)

Now you don't need fifteen apps, all of which do text gripping. You just use the same grep.

Same for the above setup: I don't give a crap about BitTorrent, so why would I want RAM devoted to running anything related to that? RAM is expensive, yo!

Literally my only AI use case (I'm retired) is having it write all the software for things I want to do in my life, without having to take the time to do it. For example, the app my kids' school uses to communicate with parents SUCKS (it's so slow), so I wrote something that logs in, pulls new updates, and feeds them to the same AI that manages my calendar/to-do list.

By "I" wrote something, I mean I had an AI do it in about ten minutes.

To your actual point, there used to be a philosophy among the tech literate that it's preferable to have something do one thing and do it very well.

It represents a couple weeks of on and off work, an experiment into how far I can push these tools to make sure I’m understanding them and not falling behind, and I like it a lot. I’ve considered open sourcing it, but to be honest, I don’t really want the burden of being a maintainer, and I have no interest in implementing or maintaining things that fall outside my use case, and so it’s just my own little toy. I imagine that many folks will end up doing the same given a bit of time.

Honestly you could open-source it with a not-maintained disclaimer just as a way for others to take it to not have to redo the work working with Agents and just build off of your existing work (and you can turn off github issues etc. to prevent nags). I for one would love to poke around with it and point an agent at it to see what it can do

release it to GH and disable issues and discussions tab and call it a day?

(personally I would love to see it, the idea of a single binary of all that stuff struck a chord)

1. Arrmada - https://github.com/tristenlammi/Arrmada 2. Mydia - https://github.com/getmydia/mydia 3. MediaManager - https://github.com/maxdorninger/MediaManager 4. Scryer - https://github.com/scryer-media/scryer

Note: I've not tried any of these

I think everyone has different definitions of what they consider heavy. I tend to think anything using over 30MB when idle is a bit much and anything over 300MB is something that really needs to earn it's spot.

Selecting good releases, for anime, classic cartoons, various dubbs, subtitles, and quality, size, etc can be troublesome. But it is like anything else, you iterate on it.

No required third-party dependencies (just the optional Google Drive and OneDrive features). Highly customizable (colors, site logo, default features) with a JSON file the player can produce. Responsively scales for any web browser: laptop, mobile, smart TVs, game consoles, even built-in in-car tablet browsers.

https://github.com/pseudosavant/player.html/

It is also a PWA though, so you can install the player (e.g. from my github pages test version: https://pseudosavant.github.io/player.html/player.html), and then use it as a local video player for any video file in your OS, like directly from the smb share if it is mounted.

Has neat stuff like remote-controlling other clients (zero conf/mdns/server relayed), modern user management (invite links, app passwords, api keys), the apps are pretty, low-resource, and consistent. Normal stuff like gapless, bit-perfect, share links, file-watching that is solid, etc.

Other killer feature is DSP/EQing that supports stuff like importing (or building) squig presets (great for IEM users), UPnP devices (from desktop, and supports DSP for room corrections etc). Should be a tad more lightweight than navidrome (though I do love navidrome <3).

https://koan.rocks

I am actually jealous of you, I can tell the difference between 4k low bitrate and 4k high bitrate, 1080p and 720p are like mud to my eyes.

But not in everything. I can't drink a cheap scotch.

The more interesting question is whether you can tell the difference between 720p and 4K at the same bitrate. Dividing that bitrate across more pixels usually results in a worse image at the higher resolution.

High-bitrate 720p generally looks better than low-bitrate 4K - it's not uncommon to find that a DVD looks better than the Netflix stream of the same content.

Case in point: Ghost in the Shell (1995)

http://comp.judging.it/index.php?seriesid=Koukaku%20Kidoutai...

Old TV version: http://comp.judging.it/content/Koukaku%20Kidoutai/4K-1/Judgm...

New 4K BD: http://comp.judging.it/content/Koukaku%20Kidoutai/4K-1/4K%20...

You are better off getting the used business mini-PC from HP/Dell/Leveno/Asus. They have better specs and run great.

Fans spin a lot near-constantly though, I think it is the on board M.2 SSD that is hot, I need to get around to adding a thermal pad or something one of these days.

Ok, I respect your opinion, but remember that there are poor souls like me out there that actually love the opposite.

All things being equal, why prefer Docker Compose? From my perspective, a single binary strictly dominates any Docker Compose solution.

Easy to migrate to new system.

Easy to upgrade and downgrade. When a new version causes an issue just restart it with an older version.

One directory to backup and restore that contains all the services and their settings.

There's lots of solutions, I also find compose hits the sweet spot for integration into my homelab

One distribution method is flexible and can be deployed however you want, the other prescribes solutions and makes any customization difficult.

Most applications do ship in a single container. whether it's a single binary inside, or a bunch of python or js files or shell scripts is a separate issue. If there is a dockerfile then you know how to build the container. a single binary is easier to build the container for yourself, assuming you also know the binary dependencies of that single binary. Like maybe ffmpeg or yt-dl cli on the path?

Applications that ship as a list of containers are a completely different problem. Those applications are either a victim of their own success, or have developers that come from a particular background.

As podman has improved and compose stacks have improved, I’ve conceded that containers simplify deployment and updates and isolation, and at this point I find for me the benefits more than outweigh the hassles.

Instead of crafting a set of ansible plays that do all the manual native installation steps, I have a relatively lightweight ansible rig that reads containers and relationships desired from a manifest in inventory, then builds or modifies compose files, then just deploys. Much less futzing. And I’m more likely to keep things up to date regularly as a result

Or, increasingly, dispatch codex to handle it for me

In this way I update home assistant across multiple instances now like magic. I don’t even dread it a little anymore

A big win with very little effort is systemd starting your docker compose service on boot. You have your systemd config file set `ExecStart` to call your docker-compose command, throw the config file into your systemd folder, and tell systemd to enable it. Docker compose handles the rest.

And if you're running in Windows or Mac it's easier than the OS option usually.

Don't have to look at cli docs to figure out how to run it.

Doesn't have access to my file system, logs are easy.

My favorite is applications that conflict on ports. So you go to change the port an application is listening on, the docs say PORT env var so you set it, but it doesn't work.

You look through the code (and this is before LLMs) but the config is just a labyrinth of values flowing from god knows where. So you search the repo for PORT and eventually find a PR from 2 weeks ago that changes PORT to ENDPOINT, so you set ENDPOINT, but it still doesn't work.

Then you find an issue that was opened last night that the new `ENDPOINT` value doesn't load from env vars because it conflicts with another ENDPOINT_ prefix on another value, instead you need to create a config.toml and set an `endpoint =` in that, so you do that.

Then you realize that creating an empty config.toml has now overridden all the previously defaulted values into nulls or empty strings, instead you need to run `foo config-defaults > config.toml` and go edit the endpoint one.

Only to realize that there is a secret that the tool uses to encrypt an ephemeral session. if you don't specify one, the tool would auto generate one on startup. The only downside is restarting it logs your client out which isn't a big deal. But now that you switched to config.toml you must set some value there and it can't be empty

Then you're just wondering why the hell did I want to change the port?

I manage my home server with a script that presumes the service is running on a compose stack. So I can run stuff like `stack freshrss restart`. I don't want to touch my scripts, I just add the compose file to some expected path and the script finds it based on naming conventions.

You trade a bit of upfront setup (I mean barely now in the age of LLMs) for easier automation and flexibility down the road. I use docker compose to run my local dev stack and qa envs, but then can do whatever I want with the containers for prod. Google Cloud Run, Amazon, whatever. Right now I do just actually use docker compose behind nginx in prod, but I've used basically the same docker compose setup for all my projects that aren't large distributed systems in the last 10 years. And when the system gets too big, I refactor it into k8s, but k8s is overkill for like 99% of my personal projects and like 75% of my professional projects.

Or at least i can reinstall any time i want, because i know it won't leave any trash in my filesystem and when reinstalling, it won't reuse those outdated files

All my home server apps are in /apps/app-name/ all have a docker config... All data and configurations are mounts under that directory or to my library. It's really straight forward.

I don't have to hunt for different configuration files, each app has what it needs.

I can spin down, move and get back up in a minute or two. All in a consistent way to the platform.

The overhead for Docker isn't near a full vm, it's maybe 2-3% if that.

Interesting, I run audiobookshelf bare metal on my old laptop that only has 8gb of ram. I've considered using a docker container but my experience using rancher for work is that it sits there chewing up 4GB of ram on my company MBP.

Maybe I'm wrong but I've never seen the point in a self hosted app running in a container when it seems much lighter to just run the app?

On its native Linux, it's a very thin set of isolations from the host OS. Not a full virtual machine.

Basically I want things reliable and low-maintenance and this setup gives me that.

I think you can go very very far with this kind of setup especially if it's just for you.

I would like to have Debian headless mini servers that consume as less power as possible when nobody needs them, only activate when someone needs them and then drop back to using as less power as possible as fast as possible. I'm not expert enough how to get that done using Docker. Debian just because i have the most experience with that linux OS. Curent pi-hole/samba/navidrome server powers down the 2.5" sata drive and goes to cpu C6/8 state pretty fast, but is avaiable within 2 seconds when needed. Don't have much time to tinker a lot. Sometimes stuff just has to work.

Using Immich without Docker also seems complicated.

For apps that will have 1-3 users and a few hits a day a sqlite file is far less operational overhead and can be backed up with all of the other files that app has.

I have a 10 year old, dual core, 8gb DDR3 laptop serving somewhere around 20 dockers for different kinds of services and it runs just fine. Even 2 clients transcoding some media usually works ok.

PS: It is not currently on, more due to it being a clunky machine with structural problems then the hardware itself. I should get it a 3d printed desktop case

It’s not pretty nor great with bad connections, but there is basically no maintenance.

But I recently looked into self hosting and several things each wanted their own Postgres container. Immich wants a Postgres and a redis instance.

If you’re building apps targeted at self hosters, SQLite is really all you need.

The getting started would be a lot different if it first instructed you to install postgres, run a script or create a database and users and configure access controls. Also certain things become easier if you assume you can also manage the postgres instance, like on an upgrade, maybe you just create a completely new database and drop the old one, or isolate tenants within one application into different databases, etc.

In general, I agree with OP that sqlite is all you need for selfhosted applications (most of the time at least)

Even in work environments for apps that likely won't have thousands of simultaneous users. Modern SSD drives are so fast that so many apps don't need the advanced features of a full blown rdbms. And I think options like Turso and Cloudflare D1 fill the in between as a hosted option.

I do wish that sqlite had a couple more native types, it works really well as it stands.

A possible restore only affects that app. Plus I can guarantee the files and DB were snapshotted at the same moment this way.

It may just be a way for me to avoid managing the DB.

Does a DB fall apart every time that happens? It does happen, but I might argue it shouldn’t happen, especially in simple configurations.

I do have an automatic daily dump in case of emergencies.

You end up in a situation where you are following some complex guide (hopefully written by the actual developer) where you make a huge backup, have to tear everything down, and then hope the migration from SQLite or MariaDB doesn't hit any issues. Postgres is heavier but at the scales of self hosting it should not matter on any modern system. Multiple docker containers even on a Pi isn't something you have to worry about. Solutions like Immich are usually run on a NAS where there would never be an issue

Those things are dirt cheap. A Postgres container on my machine uses 200MB of memory. Redis is nearly free. It's a small price to pay to not have services cross paths with each other and mucking everything up.

It's what powers the ability to search your photos for "a dog on a beach".

It's also a fairly sensible decision.

And for small enough vector sets, holding them in memory is reasonable. Most personal photo collections would fit that scale.

It also makes it much easier to just point my Postgres GUI client to my remote server (Behind Tailscale of course) and query the database there without copying over the SQLite file to my local machine, or mount it somehow. Even for simple projects that I start I always prefer Postgres.

In the "end" (after a couple of months actually) I did add support for MySQL and Postgres because I found it massively helps adoption for those self-hosters that already have those (and associated stuff, e.g. backups) in place.

[0] https://www.bugsink.com/blog/database-transactions/

Self-hosting email fully is tedious/unnecessary, but what you can do is mirror your various inboxes (Gmail, iCloud, proton, non-corporate outlook) with mbsync and use roundcube or some other frontend to view emails and compose.

I use this to easily access mail from different services, and I can also send from any of them.

I also have a seperate service that watches the mail directory and sends a ntfy.sh notification for new emails.

It’s a bit complicated cause theres so many services but here are the quadlets: https://github.com/ebrahim37/infra-template/tree/main/homela...

I implemented this about a month ago because the iphone Mail app was increasingly buggy.

If you IT, why do you particularly consider self hosting email as tedious?

So as not to reiterate, here's an HN comment where I described the most recent trial I endured with it: https://news.ycombinator.com/item?id=46297991

In the last 20 years, I've also run into problems like:

* My brand-new ISP wouldn't allow TCP port 25 inbound, and wouldn't relent. I had to go back to the old ISP.

* SPF became mandatory at Gmail, but I didn't get the memo, and Google started bouncing my mail one random day.

* My residential IP ended up on a "policy blacklist", one it could never get off because it's blacklisted by virtue of being a residential IP, not that it did something bad.

The downside is never really knowing if your email reached your recipient (maybe it got blocked by Gmail because of your IP, maybe some other reason). If I use Gmail/proton etc, then I can be pretty sure that the other person got my email.

It's not trivial to run your own email stack, but it's not hard either. It's more tedious than anything. Once it's up and running, it's low-maintenance. And it's fairly trivial to avoid spam. I get vastly more spam in my Gmail than I do on my self-hosted domains.

The biggest challenge with self-hosted email is getting an IP address that's not blocked or carrying low reputation. Most VPS IPs from e.g. Digital Ocean, Linode, Hetzner, AWS, etc. are going to get blocked from Google (the strictest) and Yahoo, Hotmail/Live/MS, etc. Cloud providers often block incoming and outgoing mail ports, too. I have a Digital Ocean VPS and my account is old enough to be grandfathered into the old policy, which means my email ports aren't blocked. I used to have no trouble sending email anywhere from my VPS, until I downsized it and got stuck with an IP in a bad reputation CIDR. Now I use smtp2go for relaying outbound mail, but still handle all inbound mail. 10/10 score on mail-tester.com, and I never have any problems or need to do any maintenance.

It's fine for casual game servers for friends.

Would absolutely love to do this, proton frontend annoys me at times.

If by encryption you mean PGP etc, that's handled in roundcube I believe.

mbsync mirrors your protonmail inbox to disk, dovecot shares that mail folder through IMAP, and roundcube or some other frontend connects to dovecot.

For gmail/icloud IMAP, you can't use your regular account password, you have to create an "app password" and use that password for mbsync.

https://proton.me/support/bridge-for-linux

Excited to set this up, I had assumed it wasn't a possibility.

Also, for email sending I use smtp2go free tier - primarily because I use random emails on my own domains to see who's leaking, and I don't want to set them up separately proton-side.

In that setup, proton itself is kinda unnecessary - I keep that path mostly as an insurance, just in case of acatastrophic homelab failure.

Certainly not unnecessary if you care about privacy and Google not reading your mail.

Is it tedious? Not really for someone with a basic command of Linux and computer networking. Even in the pre-AI days, it only took me an afternoon to set up Postfix/Dovecot, and a few more days to refine various aspects of the setup and to write a bash script that can rebuild the whole thing on a new machine. There is basically no ongoing maintenance at all. The Dovecot syntax changed in Debian 13, and Claude translated the old config file in less than a minute. If you are willing to use a Dockerized solution, it's even less work, but I personally like to run this kind of thing bare metal and control every aspect of the setup.

Fastmail exists

I self host on a bunch of different hardware, OSes, providers. I want the least fiddling as possible.

I don't do it because I don't care; I do it because it is super satisfying when it has been boringly running for weeks without me doing anything to keep it up beyond paying the electricity bill, upgrades are extremely predictable, etc.

Boredom is a feature :D

I've administered linux systems with uptime longer than docker has existed. consistency/reliability is perfectly achievable with without modern containerisation

I saw statements to the effect of “this would be nice but it’s a lot of work” several times in the post. I don’t understand why that has to be a blocker anymore. All this tedium is gone.

It takes like a day to figure out docker compose and like a week to figure out k8s at a level where you can get things done. Honestly, you can get something working now with LLMs and have them help you understand it in probably less time.

Of course I want a declarative deployment for my complex home server. Do you run like 1 app on your home server? It's not "fiddling" if you know how these things actually work.

I imagine it's more fiddly to figure out how to wire up all your individual services to Uptime Kuma and Homepage. You don't even need Uptime Kuma with docker compose, instead you just set a container restart policy and have a healthcheck endpoint.

I could just as well ask you why you need to be running 10 services at home.

> I'm a professional software engineer.

Good for you, mate.

> Do you think I want to ssh into my server

Clearly you don't, so why even make this a point? No one told you that you have to do it this way.

> What if a service stops, how do you automatically restart it?

It's called systemd, launchd, OpenRC, or any number of various mechanisms used to manage services and restart them.

> How would you automate creation of a qa environment when you create a PR on github so that you can test your changes before they go to prod?

No doubt, containers can be beneficial when deploying services exposed to the public. That doesn't mean a layer of complexity isn't added on top that one could consider "fiddling" when applied to the context of self-hosting.

I really hope you aren't orchestrating a QA environment just for software you run at home, unless that's truly your passion. I assume you were referring to what you do in your day job.

> Gonna ssh into the server and pull down your repo and build the app and run it?

As if all server software can only be installed that way without Docker containers. Even when that is the way, you're speaking like running a few commands is akin to landing astronauts on the Moon.

> It takes like a day to figure out docker compose and like a week to figure out k8s at a level where you can get things done.

Or I can just install the thing I want, make sure it binds to whatever port I need it to, and not need to think about docker-compose.yml.

> Of course I want a declarative deployment for my complex home server.

Then go ahead and do that. No one's stopping you, mate. I prefer to avoid that as much as I can because it's another thing to learn that, in all the years I've used Docker, rarely provided me that much benefit. I have zero interest in understanding the nuances of docker-compose.yml. (and yes, I am very familiar with it)

> It's not "fiddling" if you know how these things actually work.

Whoa, buddy. We already know you're a professional software engineer. No need to be punching down.

> You don't even need Uptime Kuma with docker compose,

You don't even need either of those things.

> instead you just set a container restart policy and have a healthcheck endpoint.

That's cool man. I don't care about any of that. Again, from my perspective, those are things I consider a waste of time for self-hosting. Especially the health check thing. More power to you if that's your style, but I have other priorities in life, and I'm not wrong for considering all these added technologies to result in more fiddling.

When I said I was a professional software engineer, I just meant that I have a lot of experience doing this stuff, so to set it up at home isn't really fiddly or cumbersome.

I use it when I need to deploy a service across multiple machines. For personal projects that's pretty much my biggest decider. Otherwise I'm using the same docker compose setup I've been using for a while!

At other times in my life I've ran Plex on a laptop in the corner with a note on it saying not to close it.

I have no issues with how someone wants to run their setup, I just took issue with saying they're fiddly. I guess they're fiddly when you fiddle with them haha.

Many projects, like Immich, only provide docs for docker images/compose deployment.

For my part, my home server is a single compose file :shrug:

That's not really true anymore. I can understand why you might not be familiar with declaring systemd dependencies as it's a fairly new thing. Don't blink or you might miss it.

Check out the article[0] below, it just came out...in 2015.

[0] https://fedoramagazine.org/systemd-unit-dependencies-and-ord...

For complex stuff like Immich, I'll use podman. But these days with uv, even managing python services with systemd is fine.

Would love to know as I wanted to do the same in the past and ended up self signing certs.

I am also using Vikunja instead of trello.

Tbh in general I am fine if the self hosted app uses postgres or a container Db instead of sqlite only.

DynamicUser and ProtectSystem keep me sane.

My jellyfin LXC idles at a few hundred megs of ram, shares the base debian kernel, and if anyone does ever break in, they don't get access to anything else, anywhere else on my server. (All media is also mounted read-only to the jellyfin LXC.)

I really, really like it, just set it up recently. Everything in its right place.

One suggestion in place of MPD is lyron (https://lyrion.org/). I’ve used MPD for years but recently switched to lyrion and for me, it’s a lot easier and suitable when you have many clients. It’s nice to have a single (nice) UX/UI for my music and all the “speakers” on the local network.

Pangolin was the missing piece I needed, to not expose my servers to the internet and easily have my services publicly accessible with built in auth.

Tailscale kind of worked, but it was a hassle needing the client on mobile device and it being a VPN.

With vibe coding, I have more of my own apps running than pre-built.

I also use Adguard which act a VPN to filter traffic. I dont feel like messing around to get both working.

You can configure a WireGuard tunnel to auto-connect when you are not on a set list of "trusted networks."

Vibe coded a python script to configure Cloudflare, it just looks on docker annotations so I can select which containers to expose.

I don't understand how people keep recommending Syncthing like it's a magical solution. It is not, it fails constantly, has weird, unfixed upstream bugs if you use encryption. It's definitely a maintenance burden as well.

any suggestions?

unless you make changes on the same db on two different devices in under 1minute you shouldnt get any problems

The advantage is that if I do want a specific feature, I can just add it, and I am never worried about subscription limits or surprise charged, because I host it on a fixed-cost VPS.

Things don't really need maintenance and don't really break by themselves, the only time when they can sometimes break is when changing things.

You do need to have a proper setup though, for stuff like disk space alerts, knowing the common gotchas of disabling settings that can cause issues, etc.

[0]: https://uxwizz.com

They are so easy / portable but perhaps systemd is a better option as the author suggests.

https://daemonless.io

BastilleBSD is another great way to run FreeBSD+jails using their templates

https://bastillebsd.org/projects/bastillebsd/

https://github.com/BastilleBSD/templates

For us it's the perfect balance between simplicity, observability (Beszel) and reliability. Not the right tool if you have dynamic workloads but definitely the right tool for boring and predictable workloads.

At home I run K3S, it's awesome. It also breaks a lot and does add a whole bunch of complexity that I would only recommend if you enjoy tinkering and fixing things.

I also use BGP advertised pod networks so each pod gets it's own IP address that's directly routable (l3 ipvlan) with the rest of my network (hint, don't use 100.64.0.0/10 for that if you use tailscale), so I don't bother with NAT on the host itself or port mapping or port conflicts. It also makes caddy in front of it super easy, barely an inconvenience.

There's nothing else out there, that I know of, that offers improvements on any kind of scale that it would be worth my migrating to.

I do hear good things about podman, so if I was starting from scratch I'd look into that. I have one podman instance running UnifiOS, but that's only because there's no official docker compose from Ubiquiti (and maybe that's telling in itself). Podman feels more opaque to me than docker, but I have years under docker and essentially zero under podman.

The big issue with Synology is the really crappy db logs driver they use. If a container has been running for a while it takes an age to see the logs via the Web UI.

There is a solution though: https://github.com/telnetdoogie-labs/synology-docker

rsync data directories. docker compose up. Done.

On the consumer or even prosumer nas products which have a semi-locked down system (ie Truenas/qnap/Synology). Technically you have root but as soon as you update the OS all/most of the changes end up being broken. Yes you could probably do something and deal with it. But personally I've spent too long babysitting it on the first and second nas that I no longer care.

Coolify running on a VM for my vibe coded apps

You need to backup to an independent network in any case, surely? If not self-hosting with, for example, Imich, how do you assure backups of what you chose instead? I wouldn't trust a cloud service's promises to keep everything securely backed up and available to you, not because I simply don't trust cloud services but because with that arrangement they are a single point of failure so you can lose your data and your backup at the same time if something drastic happens at their end.

Things I run out there backup to home and things I host a home backup out there, in both cases via an intermediate to get “soft offline” behaviour (sources can't directly connect to backup hosts and vice versa meaning in the case of malicious damage both have to be independently hacked for me to lose both the source and the backup), with snapshots (a source can push a corrupted backup to the intermediate and the backups will happily pull it down as they'd not know, but the older snapshots would be untouched on the backups). Both sources and backup hosts could damage data on the intermediate if hacked or broken by my carelessness, but the damage can't spread further than that.

I wanted to self-host Jellyfin, but hit the problem. It's bad at the main thing that player should offer - media playback.

If you open https://jellyfin.org/docs/general/clients/codec-support/ you can see that this doesn't support HDR and that doesn't support H265. There is Jellyfin Desktop and it breaks when display scaling is over 100% (what year is it?). Some clients have atrocious subtitle support. And then none of them apparently can't properly pace frames so I still see judder as if I'm on 60 Hz screen (24->60 can't be even translation). But my screen can do up to 165 Hz, so that should never be the issue.

In then I just went back to playing media files from Samba share with MPC + madVR. No automation or catalogization or anything, but it is supreme at actually displaying things, and that's what it's important to me.

[1]: https://github.com/finamp-app/finamp

[2]: https://minidlna.com/

The hardware to accomplish most things that we rely on from cloud vendors is absolutely trivial. My own home server is a used super cheap and tiny machine. The hard disks don't even fit in the box and yet it has plenty of CPU and memory to spare.

The software is getting easier to configure year after year eventually creeping to the point where elderly people too lost to use a remote will be running this stuff. The real challenge will be solving for easy access to private networks from public spaces across the internet. Right now everybody seems to be centering on vendor solutions like TailScale for this.

And believing that the current AI economy might have a period of rapid devaluation in the near future is pretty reasonable. But, much like the original .com bubble, the idea that AI as a technology will not survive and thrive through such a pop, and become an ever more important part of our future, is a belief that I can't comprehend. Anthropic and OpenAI very well may go belly up. AI as a technology isn't going anywhere.

And as much as I'd like to believe that more people may self host more things in the future, self hosting will never, even if it was adopted by literally everyone, become as big a deal as AI, even if AI hit a wall tomorrow and didn't get any better than the current frontier models.

The average user is much safer putting their photos on iCloud than a home server unless they are tech inclined and personally invested in keeping it secure and backed up.

Self-hoster reporting in.

I got into it about a year ago. Bought a refurbished old Dell mini PC for 300 bucks and turned it into a home server. Debian + several docker containers.

I don't know if this is the future, but it feels disruptive. I think it is amazing that I can run my private home streaming service alongside a bunch of other cool things on old hardware and the experience is in many ways superior to actual services that I am charged to use.

Then I think more importantly in the event of a hardware issue: it's much easier to simply swap out the SD card into a replacement.

At first it was hard but then i made it into a product. I am working on Tarvis.io which makes self hosting accessible to non technical users as well. It comes with installation assistant, ssl domains and backups inbuilt into it.

You can install open source apps from a catalog or drop any github repo and it installs and run it for you.

With Tarvis, I have been self hosting more since I am able to install and delete apps with one click, it makes it easy to try things.

I use it for my Home Assistant setup and more. It still has headroom. No fan, very low power consumption. Not true Linux container stuff but pretty much everything works on it in this area.

I don't have my embedded macbook fully configured but gemini says I can get it to repower itself.

By repower I mean if the power goes out and then returns the machine needs to power on and boot.

I have a couple of older Chromebooks I use in rando locations (basement, shop, car, rv, boat etc). And they are great for that casual scene-specific use. Very much recommend and amazing what you can get for sub $50 easily.

One can create a gmail account like [email protected] to sync everything too without touching your main google account. Very handy.

[edit: one thing about the M1 is that it has native h.264 h.265 and prores hardware encoder decoders if you are doing video intake of multiple streams]

Not to mention it only can do DNS blocking, so you still need an in browser AdBlock for more advanced stuff.

I use Brave and see no reason why would anyone chose differently. Maybe if they use freemium apps on their phones with a ton of ads?

Realizing (not just now, btw) that some folks have such a complex setup in their home networks... Make me go :wide_eyed.gif:

I dont even know half (most?!) of the apps/services listed there, let alone know why one would use, or even self-host, them..

/Aside

I'm interested in the new DNS-persist method² which will make this even easier, though with some obvious trade-offs, but despite the announcements in Feb/May suggesting it would be rolled out in Q2, I've heard nothing recently and we are now in Q4.

There are various ways to separate managing certs via regular ACME renews and the hosts that actually use the certificates, meaning that hosts which can never see or be touched by the outside network (except via whatever VPN you may use when away yourself) can have ACME certs instead of you setting up your own CA arrangement to serve them. One option if you don't mind all your services having one private key, is to get a wildcard cert on one host (a small server just answering the top level domain.tld for HTTPS based validation, or again one of the DNS options) and have your other services regularly refresh the certificate they use by reading it from there.

----

[1] Docs for acme.sh: https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... (other tools work just as well with it)

[2] https://letsencrypt.org/2026/02/18/dns-persist-01

[1] https://news.ycombinator.com/item?id=50111944

People with script-kiddie level skills now have access to nation-state level attack expertise via LLM.

The apps and data are still all on my hardware, Tailscale just brokers the wireguard connections and can't see the traffic.

I get what you mean though. It's a link in the chain for sure. Never had an issue with it so far though.

A tremendous number of services are supported

non-root user execution, read-only, and cap-drop where possible

owntone + shairport-sync

Owntone holds your collection on the sever and can stream to airport, airport2, dlna.

Shairport-sync turns a raspberry pi zero 2w, or orange pi zero 2w into an airport {1,2} speaker. Or use a (super cheap) esp32 airport 2 from aliexpress.

Can sync every room in the house with owntone OR "I want my phone or laptop's sound to come out of the speakers in this room"

Owntone has access to your paid spotify account if you want that. Can stream to your phone with http (remotely with wireguard vpn). Also has mpd controls if you want those and can use apple remote app on your phone if you like that.

Owntone, pihole and wireguard is reason enough alone to put an old laptop into service as a home server.

I have since gone down the jellyfin + arr stack route. Resource wise the entire stack uses very little. I have Sonarr, Radarr, Prowlarr, Bazarr, FlareSolverr, Jellyseerr, SABnzbd, qBittorrent, Gluetun, qui, Decluttarr, Recyclarr, arr-dashboard all running on my dell optiplex (previously on the raspberry pi).

All up this uses about 2GB of RAM and 0.5% CPU.

I found it extremely fiddly to set up, understand what each component does and have everything integrated well across all my devices.

Without the help of an AI assistant I just wouldn't have had the time to debug every little issue. It took me a good 12 months of tinkering around work hours to have everything stable. However now it runs along fine with very little intervention and I'm able to share it with friends and family.

So the resource argument I don't think is valid. However the fiddly mess I do agree with. Although personally I found it fun and rewarding when things finally worked. But I can understand why people would not want do spend all that time on it.

I suppose there was a KVM exploit on twitter a while back...

110€ for 8GB of RAM, an m.2 slot with a 240GB SSD and a 7781 Passmark multi-core score i5-8259U with a GPU usable for stuff like frigate but also QuickSync transcoding.

Plus a second DIMM slot to upgrade to 16GB RAM for another 30€. Plus a SATA Port. Thunderbolt. WiFi/Bluetooth, and ~4.7W Idle power consumption.

For all the "HW has gotten so expensive", that.. kinda isn't? I mean it's still 8 year old used hardware, but it's also perfectly fine still performance-wise. And it's just some x86 thing, so it runs mainline linux.

For reference, the N100 mentioned in the article has a passmark multi-core score of 5305. Granted, it also has a TDP of 6W, but still.

In my setup, Frigate runs on some 6th gen Intel desktop chip with a coral accelerator that regularly dies, however, on this old mainboard, it does not take the whole USB controller with it (contrary to the 9th gen intel host I've used previously).

I couldn't tell you how much of that system's power draw is frigate as it does a lot of stuff beyond just that.

I chose to run most of them on Kubernetes since I am used to work with it. I use:

- ha-proxy running on the host and istio running inside the cluster for the sni based ingress routing - cert-manager with a self-signed CA I had to import the CA cert on my devices - cloudnative pg for postgresql dbs (keycloak and immich)

For the backup it is mainly some cron jobs that save to the cloud.

It is overkill I admit but kubernetes makes some integrations easier. Even though it was also a way for me to maintain some Kubernetes skills for my work. The tricky part is the network connectivity, for instance home assistant runs inside the cluster on its own network and it makes things more complex like homekit bridge integration (different network than my devices). But with the help of AI the iptables configuration makes wonders.

The kubernetes cluster is k3s running on NixOS micro vms, fully managed declaratively thanks to NixOS.

The services that run outside the cluster (ha-proxy, jellyfin) are all managed declaratively.

At some point I had thought of using proxmox with lxc but I am very happy with NixOS.

Eventually I switched to Systemd only, Clan-managed NixOS instances on bare metal.

The killer feature for me is socket activation. It even works with Jellyfin, wrapped in systemd-socket-proxyd. I have Jellyfin listen on a UDS, and Systemd will activate it when my TV connects. The downside is a few more seconds of waiting when I open Jellyfin on the TV. The upside is, after 20 minutes of idling, it is fully powered down.

This allows packing even more services on smaller machines, provided you don't e.g. play Minecraft and watch Jellyfin at the same time.

It seems however that Clan is one of those classic projects where the website and the docs assume that everyone already knows what it is and how it works and goes straight to the benefits of doing it this (whatever 'this' is) way.

After reading both the site, docs and guides I am now scouring Reddit and YouTube for an actual explanation of whatever the hell it is and how it works.

ExecStart = /path/to/systemd/lib/systemd/systemd-socket-proxyd --exit-idle-time=20min /path/to/jellyfin.socket;

https://github.com/attilaolah/dotfiles/blob/144d1711755d7a9e...

I use tailscale (outside the k8s cluster) for connectivity. My phone companion app is not connected to my home assistant server outside my home but could through tailscale.

So definitely there is added complexity, especially on the iptables configuration. Without the AI help, I don’t think I would have managed to do it regardless of the time saving.

Basically: easy self hosting, includes a discovery server you can run on your VPS, all the usual stuff you expect from this kind of software, and free forever.

The only thing I'd charge for is my own discovery service which gives you convenience because you don't have to host your own. Any feature that can be hosted yourself remains free forever.

- I've addressed the most common complaints and unfixed issues in all of the competitors

- "Watch together" mode because my gf is stuck in another country for the next few months. Includes voice chat and will soon have tv casting to watch on the big screen and chat on the phone.

- all the hole punching tricks to get access from remote if you want it (or just keep it local only if you'd rather not)

- more features I'll talk about later - out of time atm

I also run into the “what should I watch next?” problem, as well as the lack of a Netflix-style recommendation experience in Jellyfin. That’s why I forked Wholphin (huge thanks to the original project!) and added TMDB watchlist and popular-list syncing, all connected to Sonarr and Radarr with direct possibility to add movie in list.

Feel free to take a look: https://github.com/romainio/JellyVault

Could you elaborate on that a bit?

MatterMost was actually a great file sharing platform for our business. But they was not true open-source and removed features we needed like SSO.

So instead we vibe-coded a MatterMost Slack alternative which we have been running on the internet fine for months now https://intellistream-datahub.github.io/intellistream-chat/ Its super convenient to share files on. And it comes with built-in secret sharing like YoPass. We occasionally implement new features and fix bugs we discover.

Its one jar file, and supports Vault/OpenBao and requires Keycloak and PostgreSQL. Lucene is embedded.

Seriously, I would be interested in your setup files. Similarly to you, I bought a Beelink 16GB mini-pc last year for self-hosting immich, paperless-ngx and jellyfin. I tried to use podman, but couldn't figure out how to set the mentioned services up with it (on debian 13). I had no experience with it, not much time to tinker (two small kids) and installation manuals and tutorials usually focus on docker compose.

I guess with AI now it would be trivial, but I'd prefer getting a blueprint already known to work in practice and actually understand the why and how.

So please, write a blog post explaining the technical side of your setup.

Under the hood, with NixOS, you get the authors setup as described. I run some of the mentioned services as described, under NixOS, just defined by .nix files.

I think this makes me incompatible with NixOS. Either I would need to spend the time to learn it, or I wouldn't understand much of what's going on. Maybe when the kids are older.

> but I'd prefer getting a blueprint already known to work in practice and actually understand the why and how.".

from "working part" is fulfilled. It is known to be work very well and many businesses use it on scale. Even drones run NixOS because it is more reliable. But it takes time to learn, which is the main negative side. I would recommend watching a bit more before making the final decision!

For example, configuring basic Immich setup is few lines of code, this also includes downloading Immich and relevant dependencies, following uses unstable channel, so using latest version:

  {
    services.immich = {
      enable = true;
      package = nixpkgs-unstable.legacyPackages ${pkgs.stdenv.hostPlatform.system}.immich;
      host = "127.0.0.1";
      port = 2283;
      mediaLocation = "/myzfs/media/immich";
      machine-learning.enable = false;
  };

  systemd.services.immich-server = {
    unitConfig.RequiresMountsFor = "/myzfs/media/immich";
    serviceConfig.ExecStartPre = [
      "+${pkgs.coreutils}/bin/install -d -m 0750 -o immich -g immich /myzfs/media/immich"
    ];
  };

Jellyfin is even less with defaults:

  services.jellyfin = {
    enable = true;
    openFirewall = true;
  };

  users.users.jellyfin.extraGroups = [ "media" ];

For those that are not part of the core NixOS, are usually provided with NixOS Home Manager: https://wiki.nixos.org/wiki/Home_Manager

Libraries are usually something more complex than single service in NixOS. Complete build pipelines for some package or specific kind of complex configuration that has many services to provide some single goal.

Can easily do this with AI now.

For running services, Incus, particularly IncusOS has been godsend. Clustering, containers, vm, networking, storage, monitoring; so much is streamlined. I put an OpenWRT router(using a Pi 4) in front as the internet gateway that handles DNS and Wireguard with the VPS. For configuration management, I'm using justfile and a bunch of shell scripts.

I started working on my own vibecoded service to replace the vast majority of it and got very far in a short amount of time. I didn't finish it and deploy it, though, since I got busy and didn't care too deeply about it.

My stack is currently a mix of usual end user services (Jellyfin, FreshRSS) and identity infra, and it chugs along brilliantly without issue. I’m fairly certain that I could leave it running to the heat death of the universe if I built lifecycle management into my backup scripts.

It is the perfect gateway drug setup though.

Speaking of transcodes, I haven’t had an issue with either unit despite both handling hardware transcoding on a semi-regular basis (one for Plex, one for Jellyfin). The system cranks through them pretty decently provided you’re doing one or two at a time, and I’ve had no heating issues with them jammed in a rack with my NAS and network kit. The hardest part was getting Intel’s proprietary drivers working for such a feature, and that was more a (lack of) skill issue on my end than anything else.

https://github.com/Dokploy/dokploy

Actual is really nice and the local-first nature is really neat.

In my experience, Firefly is nice and the developer very friendly.

Even if your web-server is down or you don't have a network connection you can still use Actual as a PWA and later sync to the server when you're back online.

When I tried out Firefly III that wasn't really how it worked, it was more of a traditional php CRUD application.

I now also host this (shameless plug):https://news.freestuffsthat.work This simple site uses the built-in NPU, iGPU and the GPU on my desktop to summarise, sort topics etc for the news headlines.

This seemed like a good point of the article to mention that when self-hosting you need to consider bus factor.

Can your wife retrieve the family photos off of Immich if you die suddenly? If you die suddenly these will become even more important than they are now.

This is why my self-hosting is mostly for my own needs and not something the whole family depends on. I still use a cloud hosted photos service (Ente photos) and mostly use the NAS for a self-hosted backup.

If I die my family can just unplug my junk and get AT&T to turn the router/modem back to normal WiFi mode and throw my OpnSense box in the estate sale.

This took less than a few hours to set up, and resulted in a nice organized obsidian vault, easy for a non-technical person to access, that will hopefully make the first year or two after I am gone easier on those I leave behind.

https://gist.github.com/karpathy/442a6bf555914893e9891c11519...

Can it be used for the dark gray area of "I have all this content on physical media, and I don't want to rip it myself", so I just hand it to the *arr stack, and it does the work?

And on "obtaining content you haven't purchased", that content is just another .mkv or .flac file. Doesn't make a difference to your media organizer.

"I prefer running services natively when possible..."

"If the dependencies aren't overwhelming, native is better, faster, and more efficient."

"Related, I don't do Docker anymore."

A few weeks ago, I had trouble with audio and video calls. Sometimes they worked; sometimes they did not. So I gave an agent access to my phone via ADB and access to the server logs, and within 30 minutes the problem was clear, and the fix was deployed.

Background: During the last migration, I forgot to enable STUN/TURN discovery, and therefore the client did not find it and could not connect when both were behind NATs. And you don't have to trust those agents blindly; you can use it as a learning opportunity and understand everything before you do anything or ask questions.