Yet another Hacker News

648 points BrunoBernardino 1 day ago 424 comments

austin-cheney 1 day ago | parent

People twist themselves into a knot talking about AI as the future. Its more of a bubble waiting to pop. Self hosting is the real disruptive future.

The hardware to accomplish most things that we rely on from cloud vendors is absolutely trivial. My own home server is a used super cheap and tiny machine. The hard disks don't even fit in the box and yet it has plenty of CPU and memory to spare.

The software is getting easier to configure year after year eventually creeping to the point where elderly people too lost to use a remote will be running this stuff. The real challenge will be solving for easy access to private networks from public spaces across the internet. Right now everybody seems to be centering on vendor solutions like TailScale for this.

mtoner23 1 day ago | parent

Self hosting has never been easier and I imagine the average person has never been further from trying it. No one will ever get anywhere close to hosting this much sruff

Gigachad 1 day ago | parent

Self hosting is mostly a hobby like home brewing beer or woodworking. It’s more accessible than ever but there’s still little incentive for the average person to do it.

The average user is much safer putting their photos on iCloud than a home server unless they are tech inclined and personally invested in keeping it secure and backed up.

MostlyStable 1 day ago | parent

I self host (I have a large overlap with the services in TFA), and love it. I will never go back and think that more people should self host (or at least...join small groups of people who designate one person to manage it for a small number of people).

And believing that the current AI economy might have a period of rapid devaluation in the near future is pretty reasonable. But, much like the original .com bubble, the idea that AI as a technology will not survive and thrive through such a pop, and become an ever more important part of our future, is a belief that I can't comprehend. Anthropic and OpenAI very well may go belly up. AI as a technology isn't going anywhere.

And as much as I'd like to believe that more people may self host more things in the future, self hosting will never, even if it was adopted by literally everyone, become as big a deal as AI, even if AI hit a wall tomorrow and didn't get any better than the current frontier models.

surgical_fire 1 day ago | parent

> Self hosting is the real disruptive future.

Self-hoster reporting in.

I got into it about a year ago. Bought a refurbished old Dell mini PC for 300 bucks and turned it into a home server. Debian + several docker containers.

I don't know if this is the future, but it feels disruptive. I think it is amazing that I can run my private home streaming service alongside a bunch of other cool things on old hardware and the experience is in many ways superior to actual services that I am charged to use.

Lucasoato 1 day ago | parent

> I prefer running services natively when possible, but will containerize complex services or those with many dependencies. Love: a service that’s a single Go binary. A service that only comes as a Docker compose file and wants to run MySQL, Redis, and three other containers? I’m already looking for an alternative.

Ok, I respect your opinion, but remember that there are poor souls like me out there that actually love the opposite.

sergiotapia 1 day ago | parent

A big reason I chose Rust and Sqlite for my project was that end users could just run the small binary and be done with it. https://github.com/sergiotapia/joyscroller

I think you can go very very far with this kind of setup especially if it's just for you.

mtlynch 1 day ago | parent

> Ok, I respect your opinion, but remember that there are poor souls like me out there that actually love the opposite.

All things being equal, why prefer Docker Compose? From my perspective, a single binary strictly dominates any Docker Compose solution.

unshavedyak 1 day ago | parent

Some isolation is nice. I say some because I’m told it’s security is not to be trusted, but I still like that even a non nefarious binary has ootb boundaries on what state will persist.

Gigachad 1 day ago | parent

Docker isolation is likely good enough if you keep your kernel up to date and aren't allowing 3rd parties to run code. If you are running a CI service or something you need micro VMs. But to host your nextcloud server, docker is good enough, it's unlikely someone will both exploit nextcloud and the kernel if you are keeping them up to date.

eddythompson80 1 day ago | parent

docker isolation is nice just as a management boundary. It's nice to be sure applications don't accidently shit all over each other. Like an application that decides to clear /tmp because reasons, or 2 random ones that both store temp state in a /tmp/state.dat for some odd reason.

My favorite is applications that conflict on ports. So you go to change the port an application is listening on, the docs say PORT env var so you set it, but it doesn't work.

You look through the code (and this is before LLMs) but the config is just a labyrinth of values flowing from god knows where. So you search the repo for PORT and eventually find a PR from 2 weeks ago that changes PORT to ENDPOINT, so you set ENDPOINT, but it still doesn't work.

Then you find an issue that was opened last night that the new `ENDPOINT` value doesn't load from env vars because it conflicts with another ENDPOINT_ prefix on another value, instead you need to create a config.toml and set an `endpoint =` in that, so you do that.

Then you realize that creating an empty config.toml has now overridden all the previously defaulted values into nulls or empty strings, instead you need to run `foo config-defaults > config.toml` and go edit the endpoint one.

Only to realize that there is a secret that the tool uses to encrypt an ephemeral session. if you don't specify one, the tool would auto generate one on startup. The only downside is restarting it logs your client out which isn't a big deal. But now that you switched to config.toml you must set some value there and it can't be empty

Then you're just wondering why the hell did I want to change the port?

dmtroyer 1 day ago | parent

for long-running services, I've never taken the time to learn something reliable like systemd. with Compose, I can see everything I need to know in one yml file and the commands to go with it. I also don't have to really understand any dependencies or their own configuration and can cleanly remove everything associated with that service with a few commands.

JamesLeonis 1 day ago | parent

You can use systemd and docker compose together. A systemd service is a single config file that runs the commands you give it, including `docker-compose` commands. Everything else about your service is still orchestrated via docker, and you can still run commands against the running containers just like before.

A big win with very little effort is systemd starting your docker compose service on boot. You have your systemd config file set `ExecStart` to call your docker-compose command, throw the config file into your systemd folder, and tell systemd to enable it. Docker compose handles the rest.

tracker1 1 day ago | parent

You don't need systemd to restart your compose service... Just have the service set to restart always or unless stopped.

And if you're running in Windows or Mac it's easier than the OS option usually.

turtlebits 1 day ago | parent

Its a single config that lets you run multiple services (and can keep them running), upgrades are just editing an image tag.

Don't have to look at cli docs to figure out how to run it.

Doesn't have access to my file system, logs are easy.

asciimov 1 day ago | parent

Isolation from the main system, other services, and other dependencies.

Easy to migrate to new system.

Easy to upgrade and downgrade. When a new version causes an issue just restart it with an older version.

One directory to backup and restore that contains all the services and their settings.

bigstrat2003 1 day ago | parent

A single binary accomplishes most of those things just fine. Only thing it doesn't get you is isolation, but you can isolate things if you want even then (for example, FreeBSD jails are dead easy to set up).

eddythompson80 1 day ago | parent

ok, so you're just using a container with a different name? You can put the single binary in a container and call it a jail if it makes you feel better.

solid_fuel 1 day ago | parent

Well yes, but that's the point entirely - you can easily put a binary into a docker container, or a jail, or on a VM. But when something is shipped as 5 different docker containers it is MUCH harder to extract it into something you can run without docker or in a different configuration (like sharing a postgres instance between multiple applications).

One distribution method is flexible and can be deployed however you want, the other prescribes solutions and makes any customization difficult.

nightski 1 day ago | parent

Are you saying it's hard to edit a docker compose file? Being one service or 5 doesn't really make things more complex. I often point servers at my own postgres container instead of spinning up an extra one (so just remove that from the compose for example). That's kind of the entire point of compose, it's so flexible.

eddythompson80 1 day ago | parent

I'm confused. The original post said "why docker compose? a single binary dominates any docker compose", (I assumed dominates here means wins over because it wouldn't make sense otherwise?) someone replied giving the additional benefit of containerization, then someone replied to that saying you get all those benefit from single binaries, and if you want the system isolation you can use a freebsd jail, which is like saying "if you want the benefit of containers you can use containers"

Most applications do ship in a single container. whether it's a single binary inside, or a bunch of python or js files or shell scripts is a separate issue. If there is a dockerfile then you know how to build the container. a single binary is easier to build the container for yourself, assuming you also know the binary dependencies of that single binary. Like maybe ffmpeg or yt-dl cli on the path?

Applications that ship as a list of containers are a completely different problem. Those applications are either a victim of their own success, or have developers that come from a particular background.

steezeburger 1 day ago | parent

I mean I've seen many single go binaries spin up docker before haha

steezeburger 1 day ago | parent

I've never felt hindered by docker. It's pretty flexible. If I need even more flexibility I'm reaching for k8s, where I am still containerizing any single go binaries

c-hendricks 1 day ago | parent

I use traefik so with docker compose/labels it's real easy to give things a reverse proxy with an auth gate and other middleware

There's lots of solutions, I also find compose hits the sweet spot for integration into my homelab

recroad 1 day ago | parent

Isolation is a pretty big deal to be glossed over.

attilaolah 1 day ago | parent

Or bwrap on linux, which is probably good-enough for most services' isolation needs.

wilted-iris 1 day ago | parent

It’s the unified interface for me. Updates, logs, service management, network routing, config and storage mapping are all uniform and I don’t have to wrangle many slightly different implementations of each. Isolation from installed packages is a nice bonus.

zzyzxd 1 day ago | parent

I don't use Docker but I love reading the compose file when a project has it. It is the quickest way for me to get a high level idea of this project's architecture. It's the best documentation :)

Lucasoato 1 day ago | parent

This. Docker compose is so great that you don’t even need to use it, for it to be useful. It can describe so well the dependencies your system needs (alongside proper documentation).

jmbwell 1 day ago | parent

I’ve been a die hard native package or static binary proponent for a long time. I still hold that there are real advantages.

As podman has improved and compose stacks have improved, I’ve conceded that containers simplify deployment and updates and isolation, and at this point I find for me the benefits more than outweigh the hassles.

Instead of crafting a set of ansible plays that do all the manual native installation steps, I have a relatively lightweight ansible rig that reads containers and relationships desired from a manifest in inventory, then builds or modifies compose files, then just deploys. Much less futzing. And I’m more likely to keep things up to date regularly as a result

Or, increasingly, dispatch codex to handle it for me

In this way I update home assistant across multiple instances now like magic. I don’t even dread it a little anymore

surgical_fire 1 day ago | parent

I too prefer the Docker compose route. If you give me a single binary, I'll go out of my way to run it inside a compose stack.

I manage my home server with a script that presumes the service is running on a compose stack. So I can run stuff like `stack freshrss restart`. I don't want to touch my scripts, I just add the compose file to some expected path and the script finds it based on naming conventions.

steezeburger 1 day ago | parent

I like to have consistent architecture across all my services, and I like to see and configure everything in (mostly) one place. If you're running a single go binary, sure do whatever, but if you're running a go binary, and a *arr stack, and a bookmarking service, home assistant, frigate, etc, it gets out of hand pretty quickly.

You trade a bit of upfront setup (I mean barely now in the age of LLMs) for easier automation and flexibility down the road. I use docker compose to run my local dev stack and qa envs, but then can do whatever I want with the containers for prod. Google Cloud Run, Amazon, whatever. Right now I do just actually use docker compose behind nginx in prod, but I've used basically the same docker compose setup for all my projects that aren't large distributed systems in the last 10 years. And when the system gets too big, I refactor it into k8s, but k8s is overkill for like 99% of my personal projects and like 75% of my professional projects.

mrheosuper 1 day ago | parent

Not OP, but i prefer a single binary on docker, at least i know it won't fuck up my filesystem when i do something stupid with it.

Or at least i can reinstall any time i want, because i know it won't leave any trash in my filesystem and when reinstalling, it won't reuse those outdated files

tracker1 1 day ago | parent

A single config file in a directory beats all.

All my home server apps are in /apps/app-name/ all have a docker config... All data and configurations are mounts under that directory or to my library. It's really straight forward.

I don't have to hunt for different configuration files, each app has what it needs.

I can spin down, move and get back up in a minute or two. All in a consistent way to the platform.

The overhead for Docker isn't near a full vm, it's maybe 2-3% if that.

wing-_-nuts 21 hours ago | parent

>The overhead for Docker isn't near a full vm, it's maybe 2-3% if that.

Interesting, I run audiobookshelf bare metal on my old laptop that only has 8gb of ram. I've considered using a docker container but my experience using rancher for work is that it sits there chewing up 4GB of ram on my company MBP.

Maybe I'm wrong but I've never seen the point in a self hosted app running in a container when it seems much lighter to just run the app?

Balinares 1 day ago | parent

I use Docker Compose so that I don't have to care if the daemon is a single binary or a whole stack: I can use the same setup for everything, and deploying an entire new thing in a maintainable way is quick and easy. Each app's startup/shutdown is managed using the same templated systemd unit, and Traefik handles the routing and Let's Encrypt cert creation and renewal.

Basically I want things reliable and low-maintenance and this setup gives me that.

tacker2000 1 day ago | parent

Same here, just give me a compose file and lets go!

skrtskrt 1 day ago | parent

Agreed and everyone’s talking about Docker Compose while I’m putting everything in k8s.

BrunoBernardino 1 day ago | parent

You're not alone!

ghrl 1 day ago | parent

I like "a service that's a single Go binary" just like the author does, but deploying that in a FROM scratch docker container is arguabdy the best of both worlds? You get the self contained container, it's not bloated, runs at native speed, works with docker tooling...

b3lvedere 1 day ago | parent

I don't hate docker. I just don't like that it seems to keep systems from going into sleep/standby mode, because it keeps writing things from time to time.

I would like to have Debian headless mini servers that consume as less power as possible when nobody needs them, only activate when someone needs them and then drop back to using as less power as possible as fast as possible. I'm not expert enough how to get that done using Docker. Debian just because i have the most experience with that linux OS. Curent pi-hole/samba/navidrome server powers down the 2.5" sata drive and goes to cpu C6/8 state pretty fast, but is avaiable within 2 seconds when needed. Don't have much time to tinker a lot. Sometimes stuff just has to work.

Using Immich without Docker also seems complicated.

pydry 1 day ago | parent

Whenever redis, mysql or postgres rear their head it raises all sorts of ugly questions like do you let apps share databases, how do you do backups, etc.

For apps that will have 1-3 users and a few hits a day a sqlite file is far less operational overhead and can be backed up with all of the other files that app has.

lgcmo 20 hours ago | parent

And I must also add that docker containers are not actually that heavy.

I have a 10 year old, dual core, 8gb DDR3 laptop serving somewhere around 20 dockers for different kinds of services and it runs just fine. Even 2 clients transcoding some media usually works ok.

PS: It is not currently on, more due to it being a clunky machine with structural problems then the hardware itself. I should get it a 3d printed desktop case

Havoc 1 day ago | parent

To each their own but running that much stuff without proxmox would drive me insane. Especially the native stuff straight on the machine.

c45y 1 day ago | parent

With some small systemd configs each native app is essentially a container these days. The overhead of unique kernels per app would really restrict what could fit on a small box like this

DynamicUser and ProtectSystem keep me sane.

Havoc 1 day ago | parent

Much prefer LXC + IaC to rebuild them, but much of a sameness

birdsongs 1 day ago | parent

Like the other person said, proxmox allows containers or full VMs, and the base OS takes less than 2 GB RAM.

My jellyfin LXC idles at a few hundred megs of ram, shares the base debian kernel, and if anyone does ever break in, they don't get access to anything else, anywhere else on my server. (All media is also mounted read-only to the jellyfin LXC.)

I really, really like it, just set it up recently. Everything in its right place.

VCFundedGenYer 1 day ago | parent

I stared self hosting in 2020 when Raspberry Pis were super cheap (not anymore :( ) and lots of things started becoming available in Docker. Haven't ever considered going back to the cloud. I love taking back full control.

seriocomic 1 day ago | parent

Same, Covid was a great time to spend shifting things from clouds to home. I have a small fleet of Pi4's and 1 newer 5 (for running Omada locally). Cost has shifted from subscriptions ($$$) to maintenance (time) :)

SftwareRenderer 1 day ago | parent

At least RPi stock has stabilized a bit... I first started hosting on secondhand hardware, but switched over to RPis since they drew less power.

Then I think more importantly in the event of a hardware issue: it's much easier to simply swap out the SD card into a replacement.

ThrowawayTestr 1 day ago | parent

After Google Assistant died I immediately installed Home Assistant on my old PC. Not as good, but at least it doesn't take 5 seconds to turn on a light like Gemini

jack_sunsetless 1 day ago | parent

Same here, Home Assistant is the one I'd keep if I dropped everything else. Mine talks to a wired automation system over the local network and runs the blinds, so a light switch never waits on someone's server.

scottydelta 1 day ago | parent

I have been self hosting for over a decade and recently have seen more people in my circle doing that and I have been helping them.

At first it was hard but then i made it into a product. I am working on Tarvis.io which makes self hosting accessible to non technical users as well. It comes with installation assistant, ssl domains and backups inbuilt into it.

You can install open source apps from a catalog or drop any github repo and it installs and run it for you.

With Tarvis, I have been self hosting more since I am able to install and delete apps with one click, it makes it easy to try things.

bix6 1 day ago | parent

For the self hosters: docker containers or not?

They are so easy / portable but perhaps systemd is a better option as the author suggests.

LaurensBER 1 day ago | parent

Podman + systemd is how I run production workloads at work.

For us it's the perfect balance between simplicity, observability (Beszel) and reliability. Not the right tool if you have dynamic workloads but definitely the right tool for boring and predictable workloads.

At home I run K3S, it's awesome. It also breaks a lot and does add a whole bunch of complexity that I would only recommend if you enjoy tinkering and fixing things.

andrewjf 1 day ago | parent

I second this, it's great. Commonly called "Quadlets".

I also use BGP advertised pod networks so each pod gets it's own IP address that's directly routable (l3 ipvlan) with the rest of my network (hint, don't use 100.64.0.0/10 for that if you use tailscale), so I don't bother with NAT on the host itself or port mapping or port conflicts. It also makes caddy in front of it super easy, barely an inconvenience.

chanux 1 day ago | parent

Quadlets looked super interesting when I stumbled upon it. However it still felt too much for my "few go binaries thrown on a server" setup. I ended up going with Ansible to set things up (and of course I use systemd).

LaurensBER 14 hours ago | parent

If you're already using systemd it's barely any effort to add quadlets. Give them a try!

rhymnz 1 day ago | parent

Personally I use docker with portainer to handle the stacks/containers, have done for many years. I like it.

overtone1000 1 day ago | parent

Why not have your cake and eat it too with quadlets?

nozzlegear 1 day ago | parent

Quadlets rule, I have tons of them configured for my professional and hobby/self-hosting services. Super convenient, I wish there was something equivalent for my Mac (launchd files just don't cut it).

ticoombs 1 day ago | parent

Docker containers are fine. I've moved between 5 NAS' over the years and docker has enabled it to be seemless.

rsync data directories. docker compose up. Done.

On the consumer or even prosumer nas products which have a semi-locked down system (ie Truenas/qnap/Synology). Technically you have root but as soon as you update the OS all/most of the changes end up being broken. Yes you could probably do something and deal with it. But personally I've spent too long babysitting it on the first and second nas that I no longer care.

jp191919 1 day ago | parent

For several years, Docker with portainer

drdexebtjl 1 day ago | parent

I personally use NixOS and a mix of systemd services and Quadlet-Nix for the few containers that have too many dependencies and moving parts. Works well.

overtone1000 1 day ago | parent

I had not heard of quadlet-nix. How interesting and tidy!

Cyph0n 1 day ago | parent

Yes. NixOS running Podman containers is where I ended up after trying almost everything :)

drdexebtjl 1 day ago | parent

Have you tried quadlet-nix? It sounds like it would fit your setup pretty nicely :)

Cyph0n 1 day ago | parent

I have considered it & heard good things about quadlets, but since I am more of a Compose person, I use compose2nix instead (self-plug).

kombine 1 day ago | parent

My server is running on NixOS and I went with systemd containers - really happy with my setup. It was not at all difficult to set it up with Claude

ChadNauseam 1 day ago | parent

I have a stupid question: if I'm using nixos why do I need docker or systemd containers? Especially with systemd sandboxing

Axsuul 1 day ago | parent

Yes, especially if you running a multi-node setup. I'm still running on HashiCorp Nomad.

Hikikomori 1 day ago | parent

Most of the time projects provide a ready to use compose file. I use dockge that provides a simple web interface for compose configs, so just paste in the compose file there and run it.

QGQBGdeZREunxLe 1 day ago | parent

Container manager on Synology. Don't have much choice. Some stuff can run native but it's easier to run containers.

The big issue with Synology is the really crappy db logs driver they use. If a container has been running for a while it takes an age to see the logs via the Web UI.

There is a solution though: https://github.com/telnetdoogie-labs/synology-docker

1shooner 1 day ago | parent

There are really easy to user docker app managers out there. The author says 'I already use systemd'. I mean, I guess I'm using systemd, but really I'm using e.g. runtipi with an app store, web-based config and logging, and a super easy app template. I can point claude at any project with a docker release and in a couple minutes have it show up in my app store to install, run, simple data backups, etc.

BLKNSLVR 1 day ago | parent

I prefer docker containers (on proxmox VMs), but that could just be the familiarity of a few years experience talking. It does add some distance from 'bare metal' but it also makes backup/restore, and therefore portability, quite simple. I backup both the VMs and the 'persistent' container data that I always create dedicated volumes for, so I have a couple of different avenues and granularity for restoring.

There's nothing else out there, that I know of, that offers improvements on any kind of scale that it would be worth my migrating to.

I do hear good things about podman, so if I was starting from scratch I'd look into that. I have one podman instance running UnifiOS, but that's only because there's no official docker compose from Ubiquiti (and maybe that's telling in itself). Podman feels more opaque to me than docker, but I have years under docker and essentially zero under podman.

pezgordo 1 day ago | parent

I had an easier time moving a project from docker compose to k3s after wasting so much time with podman compose (maybe expected considering than k3s is still root daemon)

waz0wski 1 day ago | parent

Currently testing out FreeBSD jails, but with OCI images and Podman :)

https://daemonless.io

BastilleBSD is another great way to run FreeBSD+jails using their templates

https://bastillebsd.org/projects/bastillebsd/

https://github.com/BastilleBSD/templates

kalcode 1 day ago | parent

For me, I say it depends on the service. I use Coolify for docker apps usually smaller apps, and LXC when docker won't cut it for whatever reason.

mbesto 18 hours ago | parent

Unraid (which is basically Docker and VMs)

Coolify running on a VM for my vibe coded apps

jordand 1 day ago | parent

I recently bought a Lenovo Mini PC (01Q8X10) for under £300 that has a Snapdragon X1 CPU (and 32GB LPDDR5 RAM!) and it's turning out to be perfect for self-hosting running the newly released WSL Containers on Windows 11 with WSL 3 (it doesn't fully support Linux yet). Podman had some issues with WSL 3 that they're still releasing fixes for, but it's all working with that too.

ebrahimh 1 day ago | parent

Good article. I have many of the same services in my setup.

Self-hosting email fully is tedious/unnecessary, but what you can do is mirror your various inboxes (Gmail, iCloud, proton, non-corporate outlook) with mbsync and use roundcube or some other frontend to view emails and compose.

I use this to easily access mail from different services, and I can also send from any of them.

I also have a seperate service that watches the mail directory and sends a ntfy.sh notification for new emails.

It’s a bit complicated cause theres so many services but here are the quadlets: https://github.com/ebrahim37/infra-template/tree/main/homela...

I implemented this about a month ago because the iphone Mail app was increasingly buggy.

birdsongs 1 day ago | parent

You can do this with Proton?? How does it handle decryption/encryption, etc?

Would absolutely love to do this, proton frontend annoys me at times.

ebrahimh 1 day ago | parent

I actually don't use protonmail but you should be able to access your mail with IMAP (both iCloud and Gmail support it so proton should as well).

If by encryption you mean PGP etc, that's handled in roundcube I believe.

mbsync mirrors your protonmail inbox to disk, dovecot shares that mail folder through IMAP, and roundcube or some other frontend connects to dovecot.

For gmail/icloud IMAP, you can't use your regular account password, you have to create an "app password" and use that password for mbsync.

birdsongs 1 day ago | parent

Yeah they have integrated end to end encryption, this made me go digging, and I found they have a bridge app that handles it.

https://proton.me/support/bridge-for-linux

Excited to set this up, I had assumed it wasn't a possibility.

binarin 1 day ago | parent

I'm mostly consume proton via proton-bridge, which is running in a dedicated VM. Then all my IMAP clients connect to that single instance.

Also, for email sending I use smtp2go free tier - primarily because I use random emails on my own domains to see who's leaking, and I don't want to set them up separately proton-side.

In that setup, proton itself is kinda unnecessary - I keep that path mostly as an insurance, just in case of acatastrophic homelab failure.

gerdesj 1 day ago | parent

"Self-hosting email fully is tedious/unnecessary"

If you IT, why do you particularly consider self hosting email as tedious?

ebrahimh 1 day ago | parent

I've never tried to set it up even though I know it can easily be done with things like mailcow.

The downside is never really knowing if your email reached your recipient (maybe it got blocked by Gmail because of your IP, maybe some other reason). If I use Gmail/proton etc, then I can be pretty sure that the other person got my email.

caymanjim 1 day ago | parent

You'll know from bounced email and logs, which you should have monitoring setup on.

It's not trivial to run your own email stack, but it's not hard either. It's more tedious than anything. Once it's up and running, it's low-maintenance. And it's fairly trivial to avoid spam. I get vastly more spam in my Gmail than I do on my self-hosted domains.

The biggest challenge with self-hosted email is getting an IP address that's not blocked or carrying low reputation. Most VPS IPs from e.g. Digital Ocean, Linode, Hetzner, AWS, etc. are going to get blocked from Google (the strictest) and Yahoo, Hotmail/Live/MS, etc. Cloud providers often block incoming and outgoing mail ports, too. I have a Digital Ocean VPS and my account is old enough to be grandfathered into the old policy, which means my email ports aren't blocked. I used to have no trouble sending email anywhere from my VPS, until I downsized it and got stuck with an IP in a bad reputation CIDR. Now I use smtp2go for relaying outbound mail, but still handle all inbound mail. 10/10 score on mail-tester.com, and I never have any problems or need to do any maintenance.

monocasa 1 day ago | parent

A few major vendors (I want to say Microsoft was among them) were infamous for silently dropping email without bounce backs. They'd perform then whole protocol sequence as if they accepted the email, then simply never actually put it in that user's inbox or even spam folder.

drnick1 1 day ago | parent

People should read the parent post and stop spreading FUD about email. The only part that isn't easy is the IP requirement. If you don't have a fixed public IP, preferably v4, then self-hosting email is out of reach, but so is hosting other things like game servers. It's the main cost of self-hosting, and one that isn't big relative to all the benefits. Privacy is the biggest one I think, and so is the ability to create unlimited aliases, one for each company/website.

efreak 1 day ago | parent

Dynamic DNS clients are a thing. I host a bunch of stuff on my domain, the only issues I have are related to having a local address when I'm at home. I don't host game servers much, but I hosted terraria (tshock) for few a few years.

caymanjim 14 hours ago | parent

You can't really host email with dynamic DNS. At least not well. You need stable MX records, you need various other DNS records for SPF/DMARC/DKIM, and most of all you need an IP address with a positive reputation. If you go changing your MX record constantly, you're not going to be receiving email reliably, if at all.

It's fine for casual game servers for friends.

kristofferR 1 day ago | parent

Because it's not about setting it up, it's about not getting outgoing mail perceived as spam by someone. Borderline impossible without scale. Even doing everything correct is not enough.

gerdesj 1 day ago | parent

and yet I manage to do it for multiple domains, for over 20 years in the UK.

Biganon 1 day ago | parent

Congratulations, your IP isn't considered smelly. Let me just change my IP entirely. Oh wait, that's tedious as fuck.

don-code 1 day ago | parent

I self-host e-mail, because I am stubborn - I have done it for 20 years. I would not recommend anyone do it if they aren't already, or if they well-and-truly want to be on call for their homelab.

So as not to reiterate, here's an HN comment where I described the most recent trial I endured with it: https://news.ycombinator.com/item?id=46297991

In the last 20 years, I've also run into problems like:

* My brand-new ISP wouldn't allow TCP port 25 inbound, and wouldn't relent. I had to go back to the old ISP.

* SPF became mandatory at Gmail, but I didn't get the memo, and Google started bouncing my mail one random day.

* My residential IP ended up on a "policy blacklist", one it could never get off because it's blacklisted by virtue of being a residential IP, not that it did something bad.

mikalauskas 1 day ago | parent

I host my email, my isp blocked mail ports too, my simple and reliant solution is to use 2 quite cheap VPS on different zones as front email servers, with haproxy and postfix forwarding, took some time to setup but works great and not dependent on isp rules.

drnick1 1 day ago | parent

> Self-hosting email fully is tedious/unnecessary

Certainly not unnecessary if you care about privacy and Google not reading your mail.

Is it tedious? Not really for someone with a basic command of Linux and computer networking. Even in the pre-AI days, it only took me an afternoon to set up Postfix/Dovecot, and a few more days to refine various aspects of the setup and to write a bash script that can rebuild the whole thing on a new machine. There is basically no ongoing maintenance at all. The Dovecot syntax changed in Debian 13, and Claude translated the old config file in less than a minute. If you are willing to use a Dockerized solution, it's even less work, but I personally like to run this kind of thing bare metal and control every aspect of the setup.

sejje 1 day ago | parent

> Certainly not unnecessary if you care about privacy and Google not reading your mail.

Fastmail exists

jamesstidard 1 day ago | parent

Heya, nice read. I’m wondering how you managed to get LetsEncrypt certs minted when your caddy isn’t exposed to the public internet. Doesn’t LetsEncrypt need to make a request back as part of the handshake to mint/refresh the certificate?

Would love to know as I wanted to do the same in the past and ended up self signing certs.

hexfish 1 day ago | parent

Use the DNS-01 challenge.

jamesstidard 1 day ago | parent

Much appreciated

cromka 1 day ago | parent

Or DNS-PERSIST-01 once it's ready: https://letsencrypt.org/2026/02/18/dns-persist-01.html

XCSme 1 day ago | parent

I've been building and self-hosting my own analytics platform[0] for 13+ years and never had any major issues with it.

The advantage is that if I do want a specific feature, I can just add it, and I am never worried about subscription limits or surprise charged, because I host it on a fixed-cost VPS.

Things don't really need maintenance and don't really break by themselves, the only time when they can sometimes break is when changing things.

You do need to have a proper setup though, for stuff like disk space alerts, knowing the common gotchas of disabling settings that can cause issues, etc.

[0]: https://uxwizz.com

turtlebits 1 day ago | parent

Running all these services without a declarative/standard way of deployment, ie docker compose or k3s/k8s is a bit mind boggling to me.

I self host on a bunch of different hardware, OSes, providers. I want the least fiddling as possible.

jauntywundrkind 1 day ago | parent

Especially now when you can snap your fingers and get a semi responsible codified version. Heck just do what you want to them ask the LLM to port your work to something marginally better than a totally hand cobbled bucket of bits system.

qwerpy 1 day ago | parent

That’s what I’ve been doing. Managing this stuff by hand is awful and I’m not a sysadmin who is good at it. I just added single sign on to my home network for a wide variety of various services. Some of them didn’t even support SSO but a quick AI patch fixed that. There is no way I would even attempt that by hand let alone succeed.

I saw statements to the effect of “this would be nice but it’s a lot of work” several times in the post. I don’t understand why that has to be a blocker anymore. All this tedium is gone.

steezeburger 1 day ago | parent

I see people say the same things in threads discussing open source agent harness repos that are MIT licensed. I don't understand how it isn't obvious to them at that point haha. I don't think people realize they can just... do whatever they want to

threecheese 1 day ago | parent

Pets are OK sometimes! They do need care and feeding, though; some of us don't see that as chores, instead delightful hobbies. I can definitely see the perspective of "there are better things to do", especially if you don't like those things.

surgical_fire 1 day ago | parent

There is something satisfying in handling a home server as cattle though!

I don't do it because I don't care; I do it because it is super satisfying when it has been boringly running for weeks without me doing anything to keep it up beyond paying the electricity bill, upgrades are extremely predictable, etc.

Boredom is a feature :D

usefulcat 1 day ago | parent

28 is a lot of pets.

turtlebits 1 day ago | parent

Pets are totally fine if you consistency/reliability arent that important. Homelabs can be fun ;)

steezeburger 1 day ago | parent

I mean I'm not self hosting my password manager like this guy, but my self hosted services have better uptime than github actions

swiftcoder 1 day ago | parent

> if consistency/reliability aren't that important

I've administered linux systems with uptime longer than docker has existed. consistency/reliability is perfectly achievable with without modern containerisation

ravenstine 1 day ago | parent

In my experience, when something involves words like "declarative", "deployment", "docker", "k8s", that's a sign that it will actually involve more fiddling rather than less. But that's just me.

turtlebits 1 day ago | parent

Noone builds anything without a vision of what it will look like. Blueprints are declarative specs. Why bother with instructions if you dont need to?

Many projects, like Immich, only provide docs for docker images/compose deployment.

steezeburger 1 day ago | parent

I'm running like 10 services on a VPS. I'm a professional software engineer. Do you think I want to ssh into my server and find a bunch of single binaries all over the place to run them? What if a service stops, how do you automatically restart it? How would you automate creation of a qa environment when you create a PR on github so that you can test your changes before they go to prod? Gonna ssh into the server and pull down your repo and build the app and run it?

It takes like a day to figure out docker compose and like a week to figure out k8s at a level where you can get things done. Honestly, you can get something working now with LLMs and have them help you understand it in probably less time.

Of course I want a declarative deployment for my complex home server. Do you run like 1 app on your home server? It's not "fiddling" if you know how these things actually work.

I imagine it's more fiddly to figure out how to wire up all your individual services to Uptime Kuma and Homepage. You don't even need Uptime Kuma with docker compose, instead you just set a container restart policy and have a healthcheck endpoint.

ravenstine 1 day ago | parent

> Do you run like 1 app on your home server?

I could just as well ask you why you need to be running 10 services at home.

> I'm a professional software engineer.

Good for you, mate.

> Do you think I want to ssh into my server

Clearly you don't, so why even make this a point? No one told you that you have to do it this way.

> What if a service stops, how do you automatically restart it?

It's called systemd, launchd, OpenRC, or any number of various mechanisms used to manage services and restart them.

> How would you automate creation of a qa environment when you create a PR on github so that you can test your changes before they go to prod?

No doubt, containers can be beneficial when deploying services exposed to the public. That doesn't mean a layer of complexity isn't added on top that one could consider "fiddling" when applied to the context of self-hosting.

I really hope you aren't orchestrating a QA environment just for software you run at home, unless that's truly your passion. I assume you were referring to what you do in your day job.

> Gonna ssh into the server and pull down your repo and build the app and run it?

As if all server software can only be installed that way without Docker containers. Even when that is the way, you're speaking like running a few commands is akin to landing astronauts on the Moon.

> It takes like a day to figure out docker compose and like a week to figure out k8s at a level where you can get things done.

Or I can just install the thing I want, make sure it binds to whatever port I need it to, and not need to think about docker-compose.yml.

> Of course I want a declarative deployment for my complex home server.

Then go ahead and do that. No one's stopping you, mate. I prefer to avoid that as much as I can because it's another thing to learn that, in all the years I've used Docker, rarely provided me that much benefit. I have zero interest in understanding the nuances of docker-compose.yml. (and yes, I am very familiar with it)

> It's not "fiddling" if you know how these things actually work.

Whoa, buddy. We already know you're a professional software engineer. No need to be punching down.

> You don't even need Uptime Kuma with docker compose,

You don't even need either of those things.

> instead you just set a container restart policy and have a healthcheck endpoint.

That's cool man. I don't care about any of that. Again, from my perspective, those are things I consider a waste of time for self-hosting. Especially the health check thing. More power to you if that's your style, but I have other priorities in life, and I'm not wrong for considering all these added technologies to result in more fiddling.

steezeburger 22 hours ago | parent

How is it a waste of time to health check your self hosted services? I use these services. I need them to work and be available. Bookmark manager, media server, my note taking app, a book server for friends, a few Discord bots I run, I've ran long running game servers for friends and a couple of little apps, home automation with CV ran on premise. We're obviously doing different things and have different priorities, but you can't act like k8s and docker are overkill and fiddly simply because you haven't found a need for them yet. Imo it is a huge pain the ass to manage this stuff without good iac. It's never been easier to implement something that makes my life easier. Seems like an obvious choice when you reach a certain scale.

When I said I was a professional software engineer, I just meant that I have a lot of experience doing this stuff, so to set it up at home isn't really fiddly or cumbersome.

OroPla 1 day ago | parent

What benefit does k8s introduce in a home server? I currently have about a dozen services, but only use docker compose and a bit of shell scripting.

steezeburger 20 hours ago | parent

I'm sure you could achieve almost all the things I needed with docker compose, but I was using it at work and had designed some clean helm charts so just used them at home.

I use it when I need to deploy a service across multiple machines. For personal projects that's pretty much my biggest decider. Otherwise I'm using the same docker compose setup I've been using for a while!

skydhash 1 day ago | parent

I have a single home server (debian on an old mac mini) and this thing is like my router. Power on and just wait. Jellyfin and other stuff are taken care off by apt upgrade. I don’t usually bother upgrading the others unless they fail due to dependency updates (which only happened once).

steezeburger 20 hours ago | parent

I'm running some of my own software that I'm constantly working on, so it was important to me to have good ci/cd. And uptime is important because of some of the home automations. Nothing catastrophic would happen, but I'm just not always able to go reset something manually whether due to time or space.

At other times in my life I've ran Plex on a laptop in the corner with a note on it saying not to close it.

I have no issues with how someone wants to run their setup, I just took issue with saying they're fiddly. I guess they're fiddly when you fiddle with them haha.

darkwater 1 day ago | parent

That was the case 10 years ago, maybe even 5. But nowadays the API is mature enough, tooling is good enough and every LLM out there know about them enough to not be a problem anymore.

seabrookmx 1 day ago | parent

I agree. But you could easily automate the systemd/podman based setup the OP has using ansible, if you wanted a declarative approach using OP's tools.

For my part, my home server is a single compose file :shrug:

viceconsole 1 day ago | parent

Do you not consider systemd services to be declarative/standard?

steezeburger 1 day ago | parent

How do you declare the dependencies though? The unit file only covers starting the process.

binarin 1 day ago | parent

NixOS?

GetTheFacts 18 hours ago | parent

>How do you declare the dependencies though? The unit file only covers starting the process.

That's not really true anymore. I can understand why you might not be familiar with declaring systemd dependencies as it's a fairly new thing. Don't blink or you might miss it.

Check out the article[0] below, it just came out...in 2015.

[0] https://fedoramagazine.org/systemd-unit-dependencies-and-ord...

steezeburger 11 hours ago | parent

That's not what I'm talking about. I'm talking about installing the software you need to run whatever service you're declaring you want to run

viceconsole 4 hours ago | parent

That's why I tend to prefer services that are single go binaries, for example.

For complex stuff like Immich, I'll use podman. But these days with uv, even managing python services with systemd is fine.

turtlebits 23 hours ago | parent

Systemd is declarative runtime, but doesn't handle the deployment spec.

steezeburger 1 day ago | parent

It's been really interesting seeing the divide in the comments! I have a completely different philosophy from the OP on how to self host haha, and it comes from not wanting to fiddle with my server all the time! But they say our ci/cd is fiddly! The whole point of it is to NOT be fiddly! People gotta start figuring out how things work instead of throwing spaghetti at the wall.

tonymet 1 day ago | parent

midwit meme where caveman & wizard are editing files and midwit man is writing terraforms.

bengalister 1 day ago | parent

With NixOS you get the declarative approach.

lifeisloving 1 day ago | parent

Seems like dealing with this is a part time job. I commend it though.

eleventen 1 day ago | parent

> Sonarr, Lidarr, Radarr, etc. Every time I read about setting it up, it just sounds like a resource-intensive mess that’s fundamentally prone to frequent breakage. That’s the opposite of what I’m looking for when choosing self-hosted services.

I just checked on my *arr stack. Sonarr and Radarr idle at 157MB and 159MB of memory and approximately no CPU. Jellyfin currently idles at 330MB. I'm not sure where you got this impression from. I grant these tools are complicated and have somewhat clumsy UX, but they aren't especially heavy to run and are not fragile.

OP, point your :robot: at https://github.com/subdavis/selfhosted/blob/main/docker-comp... and ask for an explanation. It's a single compose file that illustrates how the *arrs, transmission, and jellyfin all work together. I'm sure you can set it up :)

birdsongs 1 day ago | parent

I think it just sounds intimidating if one hasn't tried, but they are really well designed pieces of software, that are relatively simple to set up (just have to go through the motions and connect everything with API keys).

Highly recommend them to OP. My stack went down once in the past 4 years and it was my fault.

Cyph0n 1 day ago | parent

Indeed. The other thing to point out is that, once you have set them up, they will chug along fine for years with near zero input.

Here is the stack I recommend:

* Radarr (movies) with optional second instance for 4K versions

* Sonarr (shows) with optional second instance for 4K versions

* Sonarr (anime), separate instance to have control over quality settings

* Prowlarr (tracker/indexer management)

* SABnzbd (Usenet)

* qBittorrent (torrents)

I would also recommend consulting the TRaSH guide to tune your setup and ensure you’re grabbing quality releases. From there, the next logical step is Profilarr :)

arcastroe 1 day ago | parent

sabnzbd can be replaced with nzbdav or similar tools (infinidysk, altmount) if you want to free up storage and stream directly from usenet.

Or, even better, the entire arr stack can be replaced with stremio to just keep everything on-demand instead of curating a library at all.

Cyph0n 1 day ago | parent

“Even better” is relative. Some people like having media stored locally instead of relying on torrent streaming availability.

Usenet streaming sounds cool, but with releases being DMCAd so frequently, I don’t see how it would be practical for anything but the most recent content.

Also, I imagine that Stremio without Debrid (or equivalent) is kind of a terrible experience most of the time.

dawnerd 1 day ago | parent

I tried it once and it barely worked at all. Plex would just show everything as unavailable. Really awful experience even when it did work.

jonnyscholes 1 day ago | parent

If you're not worried about black-ish pixels, it's surprisingly reliable.

steezeburger 1 day ago | parent

> stremio

Is this the latest rendition of Popcorn Time?

Cyph0n 1 day ago | parent

Yep basically. The real magic is when you combine it with a Debrid service, which essentially puts a cache in front of torrents. If the torrent has been downloaded before, you get a direct hosted stream instead of having to stream your movie from active seeders (i.e. buffering hell).

steezeburger 1 day ago | parent

That sounds slick. I'll have to check it out!

Where does that hosted stream live? I'll have to peep their docs. Sounds interesting

LaurensBER 1 day ago | parent

A debrid service is a paid hosted cache so I guess it usually lives on wherever they can source cheap storage and disk cache ;) the original source is the torrent.

I have never had any issues with the speed though and I regularly stream 50+ GB files.

QGQBGdeZREunxLe 1 day ago | parent

Prowlarr replaces Jackett?

https://github.com/Jackett/Jackett

kristofferR 1 day ago | parent

Yeah, it interfaces way better with Radarr/Sonarr. I still run Jackett though, good for manual searches.

fyredge 1 day ago | parent

Curious question, I host a single instance of sonarr that supports anime through tags. Is there an advantage to hosting 2 instances instead?

Cyph0n 1 day ago | parent

Single instance works fine, but a separate instance allows you to set global quality settings that are more accurate for anime: https://trash-guides.info/Sonarr/Sonarr-Quality-Settings-Fil...

ffsm8 1 day ago | parent

You can configure quality profile via the tags too (I do have separate profiles for anime vs liveaction). I didn't even set the tag, as I don't intermingle them in the same directory, and automatic tagging by sub path is possible too

So I'm also surprised why someone would configure a second instance for that

Cyph0n 1 day ago | parent

Can you explain? Are you manually setting tags for every anime you add? How does it work with requests made thru Seerr?

ffsm8 1 day ago | parent

I'm not using seerr, I've used overseer and jellyseer for a while years ago, but as I'm the only person interacting with radarr/sonarr... The value wasn't there for me.

I suspect it's would still work, but haven't tried it out

Sonarr/radarr has the ability to configure multiple library roots. Those are available in a drop-down when adding a new series through the (son|rad)arr interface

This is eg /media/(anime-series|series) for me. Then I defined a rule for those paths to add an anime|lifeaction Tag.

This then controls the tracker and quality profiles, as well as language preferences etc

Cyph0n 1 day ago | parent

Ah, I know about root paths, but didn’t know about path-specific rules. Thanks, will check this out. And yeah, it should work fine with Seerr.

russelg 1 day ago | parent

If using the TRaSH guides (synced automatically with recyclarr), with all their quality profiles etc, I find that those mostly don't make sense for anime. It's easier for me to keep the anime specific stuff separate, different naming conventions, different episode numbering, etc.

aborsy 1 day ago | parent

The interfaces of arr stack are ugly, and linking qbit to indexer manager to arr app is needlessly complex. Maybe there could be plugins in one app like qbit.

navanchauhan 1 day ago | parent

I used to think so too, but now I usually just have Muse or another AI agent on my box do those things for me. I should maybe create a slimmed down API first *arr stack equivalent then hmm

mbesto 1 day ago | parent

Sonarr just got a big UI upgrade FYI

shepherdjerred 1 day ago | parent

With agents I am surprised nobody has combined Plex + qbittorrrent + seerr + *arr into one mega app

vachina 1 day ago | parent

There is, it was an Android app called Popcorn Time.

Quite a feat considering it was developed without AI help.

cowlevel 1 day ago | parent

That app would be blatantly illegal

lgcmo 23 hours ago | parent

This is all hypothetical, isn't it...? All academic?

jkman 21 hours ago | parent

How would that app be illegal when its constituent components are 100% legal?

cowlevel 2 hours ago | parent

Because it's illegal to make a thing whose primary purpose is to facilitate copyright infringement. A thick steel pipe becomes illegal if you fill it with <I'm not telling you what to fill it with> and screw the ends shut, even though none of those components are illegal, because then it's a bomb.

deaton 1 day ago | parent

There are a million docker-compose files floating around for exactly this that just need a little bit of configuration.

shepherdjerred 15 hours ago | parent

You still have to navigate through a bunch of different interfaces. I'm talking about micro services vs monolith

Cyph0n 23 hours ago | parent

I actually prefer the separation. Limited blast radius is one advantage, but I also think that the media server and downloader should be separate things anyways.

But I do think that there is an opportunity to merge Sonarr and Radarr.

khriss 1 day ago | parent

Instead of multiple Radarr and Sonarr instances, wouldn't it be simpler to have multiple quality profiles on a single instance?

charlesabarnes 1 day ago | parent

Multiple instances are needed if you want multiple versions of a given movie or episode. For example, I have a Dolby Vision device that works great with certain files, but on some other devices the file works poorly and doesn't transcode well. Plex handles multiple files fine.

Definitely not a usecase for everyone

wisidisi 1 day ago | parent

Obviously the instance is to hide away from wife, kids and rest of the family. I recommend stashapp.

Gareth321 1 day ago | parent

+1. Many people do not see the value in storing their own adult content but mine is high quality, full length, VR, niche, and full of the stuff and actresses I like.

ang_cire 1 day ago | parent

Or you could be considerate and set them up with their own instances (of stash), too!

ibizaman 1 day ago | parent

I have a setup where I tag kids friendly movies with a specific radarr and sonarr tag. It gets written to the NFO so it trickles down to Jellyfin. The kids have their own Jellyfin account that can only see assets with that tag. It’s extremely simple to setup https://blog.tiserbox.com/posts/2025-03-01-parental-control-...

snapplebobapple 20 hours ago | parent

I did the same but put kids stuff n a seperate directory with a seperate library. will have to lo(k at thia, it seems cleaner

9935c101ab17a66 4 hours ago | parent

The arrs have extensive and solid capabilities for filtering for the quality you want, but they don’t really offer the ability to manage multiple qualities for one specific item.

It’s also nice to have them separated because you can set up distinct plex libraries mapped to the sonarr and radarr 4K media directories. I don’t give everyone access to 4K content because no matter how many times I explain direct play, some people just seem to love transcoding to 720p. So I can limit 4K library access on plex and disable transcoding altogether for plex content.

I also don’t want every item I add in both 4K and 1080p.

m4xp 1 day ago | parent

I have this stack for 1 year and had 0 issues, 0 maintenance. It just werks.

Im having problem on some new releases where it downloads clear malware with. Exe files, its detecting it and not moving them to my jellyfine storage but it always requires manual intervention. I havent been able to find a way to stop sonarr from grabbing releases before their official releas and with n amount of seedwrs/leechers

troupo 1 day ago | parent

> I would also recommend consulting the TRaSH guide to tune your setup

Yes and no. E.g. I find Trash guide to quality profiles/settings useless. I wish *arr apps shipped with decent modern quality by default. No, I'm not downloading and watching a Quantum Quality UXZHD Post-Partum HDR BVIU-49.3 format. No one is.

E.g. profilarr pulls in a more sane set of profiles: https://dictionarry.dev/quality-profile

Cyph0n 1 day ago | parent

TRaSH is definitely for power users. It becomes much easier to work with when configured with Recyclarr, but there is still a learning curve.

One of the most valuable things for me is the ability to rank different aspects of releases across media types. For example, I prefer dual audio anime, unless the sub is much higher quality. Same idea for surround sound and release groups. I also want to ignore things like dual audio that is non-English, or hardcoded French subs, etc.

troupo 22 hours ago | parent

> It becomes much easier to work with when configured with Recyclarr

I tried it once, and it just polluted the profiles with dozens of Trash Guide profiles :)

So I went with Profilarr which has sensible setups like "2160p Quality" etc.

> One of the most valuable things for me is the ability to rank different aspects of releases across media types.

Oh, this is something I tried to setup as well, and failed. It doesn't help that IIRC languages are not properly indexed/set up in ^arrs if I remember. Like you have to set "language = 53" for English or something like that.

I think all this complexity is down to the fact that ^arr apps grew organically on top of other things that grew organically, so the data models are all screwed up, and no one has the time or knowledge to clean it up and make better.

benoau 1 day ago | parent

There's been two major disruptions in my experience.

First was Lidarr went for months last year (was it this year?) unable to search/add musicians due to complications with how they were relaying those searches. It took them a long time to refactor that part of the software and make it usable again.

Second was the retirement of Readarr, the ebook-version of this software, which was an absolute shame.

But aside from that this is pretty much set-and-forget software. Although the setting is harder than it should be, should be much easier to favour smallest x265 rips at <resolution>, lossless audio, season rips with subtitles.

BlueSialia 1 day ago | parent

What did you replace Readarr with?

benoau 1 day ago | parent

I'm trying out LazyLibrarian but I don't really like it, I've been manually going to Anna's Archive.

epiccoleman 1 day ago | parent

Highly, highly recommend shelfmark and an instance of calibre-web-automated.

Take a look at https://github.com/epiccoleman/tharmas/blob/main/schooner/do... for an example if you like.

Apparently I haven't pushed, shelfmark used to be `calibre-automated-book-downloader`

ChadNauseam 1 day ago | parent

Another good option is nixflix: https://github.com/kiriwalawren/nixflix (a nixos equivalent)

BorisMelnik 1 day ago | parent

I've been running my instances for over 5 years, I update the Dockers every few months and that's it. I have about five users in different households that rely on it it has never missed a beat.

dawnerd 1 day ago | parent

I’ve had mine going for what feels like ten years now no issues. Even longer if you could some of the earlier managers out there. The arrs are some of the most solid apps I’ve run. Especially once I switched them to use Postgres.

BorisMelnik 18 hours ago | parent

oh I never even thought about switching to postgres.

figassis 1 day ago | parent

I build my own version, single binary that does every thing. While I built it, I learned I cannot make it open source or distribute, bc it might be illegal to do so, so I assume many people have built that, but you're always locked into the narrowly scoped lego pieces. So I enjoy my media now, without hassles, all the features I need, none I don't. I hope one day I get to share.

j1elo 1 day ago | parent

Solution is easy, in fact there are 2 solutions:

1. Clear that "might", it either is or isn't. An AI can get you 90% there, maybe the definitive confirmation would be good from a lawyer.

2. None of this matters if you share it from a foreign code forge and an anonymous pseudonym.

dgently7 1 day ago | parent

ianal, but presumably you could share a research document that explains the theoretical kinds of broad strokes of an all in one type system, and how youd verify it works.

if anyone decided on their own to put that it into a local model and generate their own version of something that met the theoretical spec thats their own deal...

figassis 1 day ago | parent

To the parent, I am not about to FAFO. To you, I am also not about to FAFO. Good luck.

internet101010 1 day ago | parent

Same. I made the mistake of adding the downloader to it at the start but brute forced my way through. Single Rust binary for all of the *arrs + sabnzbd is nice though. Unfortunately it is not something I am comfortable making public due to the all-in-oneness of it.

Almost all of the time went to to the downloader (usenet is more complicated than I thought). If I had just focused on the basics (sonarr, radarr, seerr) I could probably could have knocked it out in a day or so.

Cyph0n 1 day ago | parent

It is important to point out that “a day or so” - or even the ability to spin up your own version - is only possible because these projects already exist.

Without a tested and validated reference implementation that already accounts for the numerous edge conditions and quirks of media releases, APIs, etc., your vibecoded version would have taken much longer to iterate on.

figassis 1 day ago | parent

That's fine, I am certain that if laws allowed, these projects would have been exactly as intended. Not their fault and nothing against them. They solved the problem the best way they could.

weedfroglozenge 1 day ago | parent

The bigger reason is Sonarr and Radarr opens you up to a plethora of attack vectors and realistically at this point you're probably already compromised.

caymanjim 1 day ago | parent

I don't see how. I run them with no public ingress, no plugins or mods. I don't torrent. I'm not sure there's really any attack vector worth worrying about. Certainly no more than many of the other services I host.

QGQBGdeZREunxLe 1 day ago | parent

https://news.ycombinator.com/item?id=50108872

IncreasePosts 1 day ago | parent

Unless there's a bug where jellyfin or plex decides to execute a random exe it tries to index, exploitation seems unlikely.

dawnerd 1 day ago | parent

And even then you should be running in a container at least.

russelg 1 day ago | parent

Simply put, skill issue. Never ran into anything like this when using reputable private trackers and indexers.

dawnerd 1 day ago | parent

That’s been a thing for years. No one is actually running the exes, or at least they shouldn’t be. Its such a simple thing to prevent too…

serf 1 day ago | parent

what the hell are you smoking? even the silly article earlier had the caveat "Yeah it downloads EXEs but its up to you or your family to run them"

and that's totally ignoring the fact that it's only a supremely naive user that hasn't yet refined their filters to exclude dangerous extensions (or, if they're too lazy to do that, rely on one of the many many pre-assembled filter/grabber settings across the net which already do so.)

what fear-mongering and FUD-spread.

You may also want to warn the public about the dangers of having curl, wget, python or gcc installed.

They expose a PLETHORA of attack vectors! you're probably already compromised, realistically!"

... and they're actually more dangerous than a free-floating EXE.

tclancy 1 day ago | parent

Oh cool! I have been running it happily for a bit over a year but found the interplay to be annoying. Currently working on https://github.com/tclancy/lintarr to try to "prove" rules across the stack don't conflict with each other.

gib444 1 day ago | parent

There must be large amounts of similar code between Radarr, Lidarr, Sonarr etc.

Whenever I use them I wonder if they could be one unified app with plugins...?

willio58 1 day ago | parent

Also the barrier to entry for these things has dropped immensely with ai

epcoa 1 day ago | parent

> Sonarr, Lidarr, Radarr

There’s no value to this post honestly.

mrheosuper 1 day ago | parent

In this day of vibeslop, it's insane no one thinks to combine all these into single app. The best we can do is having single docker compose file that has to manually point each service into each other.

A single dream app that combines: Media server, crawler, downloader, subtitle, cloudflare bypass etc, with plugin support.

jerpint 1 day ago | parent

This basically all comes for free in woltspace [0]. Woltspace believes that you should no longer bother building “scalable” apps, but personal apps that literally only run on your own machine. You can access them from anywhere (cloudflare, tailscale eg) and continuously improve them with your wolts over time - from anywhere.

It’s all open source and harness agnostic [1]. I’m the park ranger for life aka maintainer of the project. Did a recent YouTube video with what i think the future of open source multiagent setups will look like [2]

Happy to chat more about it

[0] https://woltspace.com/ [1] https://github.com/jerpint/woltspace [2] https://www.youtube.com/watch?v=H-4khO7o0XQ

shepherdjerred 1 day ago | parent

This is not reasonable for complex software, which the *arr stack most certainly is.

Most people do not want to solve the problem of: "how do I download and match arbitrary user-uploaded media across multiple databases"

jerpint 1 day ago | parent

Im not sure I follow, but the point of woltspace is to get out the way and let you build

hackernudes 1 day ago | parent

I agree. What is stopping me is primarily the metadata stuff. For example, Sonarr runs a closed-source service called Skyhook which exists to make efficient use of TheTVDB. Since Sonarr is free open source software maybe they don't have to pay (looking at https://www.thetvdb.com/api-information and https://opencollective.com/sonarr).

My dream app is split into two parts. One that serves podcasts, music, books (with OPDS so I can browse my library with KOReader), tv, movies, other multimedia (youtube, whatever else). The other handling the metadata APIs and downloading files from different sources (torrent trackers, torrent DHT, nntp, etc...). Sort of like uber-Jellyfin + uber-Arr.

I guess I can probably get a personal API key for TheTVDB, etc... and develop my own sort of proxy and it wouldn't be so bad. Hmm...

darkwater 1 day ago | parent

So we monoliths are now back in vogue instead of microservices? /s

(And I agree, for most workloads monoliths are much easier to grasp and deploy than microservices)

KPGv2 1 day ago | parent

Now you don't need fifteen apps, all of which do text gripping. You just use the same grep.

Same for the above setup: I don't give a crap about BitTorrent, so why would I want RAM devoted to running anything related to that? RAM is expensive, yo!

mrheosuper 23 hours ago | parent

With the userbase of 10(at max), i think monolith is fine.

m4xp 1 day ago | parent

There arent many vibeslop that actually have a userbase tho, who wants a program that changes radically and is not stable?

KPGv2 1 day ago | parent

Well, it's apparently easy, so you should do it.

Literally my only AI use case (I'm retired) is having it write all the software for things I want to do in my life, without having to take the time to do it. For example, the app my kids' school uses to communicate with parents SUCKS (it's so slow), so I wrote something that logs in, pulls new updates, and feeds them to the same AI that manages my calendar/to-do list.

By "I" wrote something, I mean I had an AI do it in about ten minutes.

To your actual point, there used to be a philosophy among the tech literate that it's preferable to have something do one thing and do it very well.

mirashii 1 day ago | parent

I have one that combines most of this. I left Jellyfin out so far because it has clients for all the various devices, but I’ve replaced the arr stack, sabnzbd, jellyseerr, kavita, audio bookshelf, etc into one Rust binary and a SQLite database. As a bonus, uses local LLMs/decision models to replace a lot of the custom regex based detection of the arr stack, and a mini built in agent with tools for finding, downloading, and manipulating media so that I can find Spanish language content for my kid a bit more easily, as language stuff being tagged is still pretty weak in the ecosystem.

It represents a couple weeks of on and off work, an experiment into how far I can push these tools to make sure I’m understanding them and not falling behind, and I like it a lot. I’ve considered open sourcing it, but to be honest, I don’t really want the burden of being a maintainer, and I have no interest in implementing or maintaining things that fall outside my use case, and so it’s just my own little toy. I imagine that many folks will end up doing the same given a bit of time.

the_lucifer 22 hours ago | parent

> I’ve considered open sourcing it, but to be honest, I don’t really want the burden of being a maintainer

Honestly you could open-source it with a not-maintained disclaimer just as a way for others to take it to not have to redo the work working with Agents and just build off of your existing work (and you can turn off github issues etc. to prevent nags). I for one would love to poke around with it and point an agent at it to see what it can do

_rwo 7 hours ago | parent

> but to be honest, I don’t really want the burden of being a maintainer

release it to GH and disable issues and discussions tab and call it a day?

(personally I would love to see it, the idea of a single binary of all that stuff struck a chord)

ehaughee 23 hours ago | parent

People have been doing just that:

1. Arrmada - https://github.com/tristenlammi/Arrmada 2. Mydia - https://github.com/getmydia/mydia 3. MediaManager - https://github.com/maxdorninger/MediaManager 4. Scryer - https://github.com/scryer-media/scryer

Note: I've not tried any of these

nonethewiser 1 day ago | parent

Maybe the resources in question arent RAM.

chillfox 1 day ago | parent

For comparison, audiobookshelf idles at 89MB, emby at 178MB and navidrome at 29MB for me.

I think everyone has different definitions of what they consider heavy. I tend to think anything using over 30MB when idle is a bit much and anything over 300MB is something that really needs to earn it's spot.

kappar 1 day ago | parent

It appears the large majority agrees that the *arr stack is fantastic and fundamental context to any vibe coded solution for similar services. I can also confirm resource contention or maintainability is not the issue for me with these.

Selecting good releases, for anime, classic cartoons, various dubbs, subtitles, and quality, size, etc can be troublesome. But it is like anything else, you iterate on it.

dewey 1 day ago | parent

There’s also https://autobrr.com/ - not exactly the same but many overlapping features, lightweight, written in Go and works well with que and qbitorrent.

Gareth321 1 day ago | parent

I found this trickier to set up and use. I tried it for sports but ended up switching to Sportarr.

bottled_poe 23 hours ago | parent

This is a fine sample of Cunningham’s law in action.

scottydelta 1 day ago | parent

With the recent change in Bitwarden's license, not sure for how long they will continue to be self hosting friendly.

I am also using Vikunja instead of trello.

Tbh in general I am fine if the self hosted app uses postgres or a container Db instead of sqlite only.

turtlebits 1 day ago | parent

Self hosting is great. The access part is hard.

Pangolin was the missing piece I needed, to not expose my servers to the internet and easily have my services publicly accessible with built in auth.

Tailscale kind of worked, but it was a hassle needing the client on mobile device and it being a VPN.

With vibe coding, I have more of my own apps running than pre-built.

oscarteg 1 day ago | parent

What tools did you create yourself?

bubblemoth 1 day ago | parent

Wireguard is relatively simple. The VPN on my phone automatically connects when I disconnect from my home wifi, then it's like I'm at home.

spacephysics 1 day ago | parent

Why the downvotes? Genuinely curious, I do this and don’t know of a downside after setup (with help from {AGENT})

turtlebits 1 day ago | parent

Not requiring friends/family to use a client to access my services is so much simpler.

I also use Adguard which act a VPN to filter traffic. I dont feel like messing around to get both working.

cromka 1 day ago | parent

I use Brave and never had a kneed for AdGuard, specifically because of how it uses VPN. Then I use Wireguard to seamlessly access my home setup. Honestly, I choose security and very little admin anxiety over random ads in other, non-browser apps or sites.

theoreticalmal 1 day ago | parent

Pfsense and maybe openwrt allow split horizon DNS that allows Wireguard tunnels to work seamlessly whether you’re on or off your home network. Took me years to figure out but it’s what I use now

ycuser2 1 day ago | parent

That's a cool feature. Do you run Android? How did you set this up?

hammycheesy 1 day ago | parent

I'm not the user you replied to, but I run a similar set-up using "WG Tunnel," which is available on F-Droid and the Play Store.

You can configure a WireGuard tunnel to auto-connect when you are not on a set list of "trusted networks."

Hikikomori 1 day ago | parent

Cloudflare zero trust also works for this, nice if you already use them for DNS and proxy. You install cloudflared tunnel, expose select ports as a service in zero trust, then whitelist email addresses that can log in to zero trust and when they a one time password to log in when they try it. When logged in you get a page showing the services available as clickable links.

Vibe coded a python script to configure Cloudflare, it just looks on docker annotations so I can select which containers to expose.

thi2 1 day ago | parent

I always love reading other peoples self hosted stacks. I never heared of SnapCast but it sounds interesting! Will check it out.

seplox 1 day ago | parent

I'm puzzled that OP seems stumped on syncing keepass when they're already using syncthing. I've been using keepass+syncthing for years, and I've never had any issues.

viceconsole 1 day ago | parent

I considered KeePass+ Synching but tended to run into the same issues as with Owntracks - Android is hostile to always on background apps. Then when it came time to onboard my spouse, KeePass wasn't an option.

cromka 1 day ago | parent

Both Android and iOS have issues with syncthing here for my obsidian syncing and it drives me nuts.

I don't understand how people keep recommending Syncthing like it's a magical solution. It is not, it fails constantly, has weird, unfixed upstream bugs if you use encryption. It's definitely a maintenance burden as well.

6ak74rfy 1 day ago | parent

Do you have a use case to share some credentials with family etc.? How do you do that?

einhard 1 day ago | parent

I've been using Syncthing + KeePass for a few no this now after leaving Bitwarden. I do find that I often get sync conflicts, though; I think it's because I will open Keepass on my computer, then on my phone while forgetting to close the one on the computer, but I'm not sure.

any suggestions?

jonny2811 1 day ago | parent

my keepassxc syncs without closing, it autosaves changes and they get directly synced. i tested in the beginning leaving apps on on mutiple pcs and syncs landed pretty quick.

unless you make changes on the same db on two different devices in under 1minute you shouldnt get any problems

Hikikomori 1 day ago | parent

About to retire the NUC I used for 10 years running arr stack, jellyfin, home assistant, pi hole and a few more containers. Bought a new bee link mini pc, new Intel CPU, 500gb SSD and 16gb ram for less than $500.

maherbeg 22 hours ago | parent

Which nuc were you running on? I've got an 8th gen that I'm also considering upgrading but wish I could up to way more RAM.

Hikikomori 17 hours ago | parent

7th gen, Skylake. You can get the bee link 304 with more ram if you want. Didn't think I would need more and the 16GB is soldered.

uzairhaq 1 day ago | parent

The best thing to self host (if you have some international family/friends you trust) is a VPN. Get each household a raspberry pi joined into one vpn. It means you actually get local tv to work (unlike Nord vpn etc). Each pi sits on a guest network so traffic passing through can't touch anything in the house

moecables 1 day ago | parent

I am surprised author said *arr stack is a mess, it's probably one of the few things I haven't touched much since setting it up and it saves me a ton of time managing new media.

dspillett 1 day ago | parent

I've looked at *arr before, and while I didn't get the impression it would be flaky once setup every time I've looked into it I've decided that I'd rather keep spending many very small bits of time doing things more manually than have the block of initial time to setup and tweaking to my tastes at the start. I'm actually consuming less TV & films these days than I used to, so I suspect this decision will stick.

moecables 18 hours ago | parent

If you're sailing the high seas, *arr stack saves you a ton of time managing anything related to that. And now with an LLM quickly being able to set up a docker-compose for you, it's a no-brainer setup only if you're willing to spend a weekend getting it up and running on an always on computer behind a VPN, and for some people that's not worth the time/effort/money so I understand

disposition2 1 day ago | parent

Great write up, thanks for sharing. I run some of the services mentioned, but got some good ideas from the article and the comments.

One suggestion in place of MPD is lyron (https://lyrion.org/). I’ve used MPD for years but recently switched to lyrion and for me, it’s a lot easier and suitable when you have many clients. It’s nice to have a single (nice) UX/UI for my music and all the “speakers” on the local network.

flaunf221 1 day ago | parent

> Jellyfin

I wanted to self-host Jellyfin, but hit the problem. It's bad at the main thing that player should offer - media playback.

If you open https://jellyfin.org/docs/general/clients/codec-support/ you can see that this doesn't support HDR and that doesn't support H265. There is Jellyfin Desktop and it breaks when display scaling is over 100% (what year is it?). Some clients have atrocious subtitle support. And then none of them apparently can't properly pace frames so I still see judder as if I'm on 60 Hz screen (24->60 can't be even translation). But my screen can do up to 165 Hz, so that should never be the issue.

In then I just went back to playing media files from Samba share with MPC + madVR. No automation or catalogization or anything, but it is supreme at actually displaying things, and that's what it's important to me.

ivanjermakov 1 day ago | parent

I understand use cases for Jellyfin and selfhost it myself for music (in combination with incredible Finamp[1]), but for movies/shows plain MiniDLNA[2] works like a charm and is accessible from any device.

[1]: https://github.com/finamp-app/finamp

[2]: https://minidlna.com/

singron 1 day ago | parent

I used jellyfin-mpv-shim. You select what to play from any ui and it starts playing in mpv, which seems to have excellent support for everything you would want a player to do.

flaunf221 1 day ago | parent

Tried it too, it still had judder as all other clients I've seen. I think it's either server software problem or maybe all clients fail to do this properly.

rossy 1 day ago | parent

video-sync=display-resample in jellyfin-mpv-shim's mpv.conf should fix frame pacing

viceconsole 1 day ago | parent

Fair, I just never use the web clients. I mainly use the Android phone or TV apps, which do support H.265. The Android TV subtitle support seemed ok, I think I did have issues with the Roku app and subtitles.

mikeocool 1 day ago | parent

I am generally not onboard with the “all you need is SQLite” articles that pop up on HN regularly.

But I recently looked into self hosting and several things each wanted their own Postgres container. Immich wants a Postgres and a redis instance.

If you’re building apps targeted at self hosters, SQLite is really all you need.

skrtskrt 1 day ago | parent

SQLite has a bunch of cool stuff happening around it right now too like Turso and Litestream.

Gigachad 1 day ago | parent

How do backups work with SQLite? Postgres is nice in that it can run them live without any corruption issues for writes in the middle of the backup.

blactuary 1 day ago | parent

https://litestream.io/

shim__ 1 day ago | parent

Much simpler since you just need to backup a single file, if you're not running a public service with heavy traffic it's safe to assume that your db state is always consistent

solid_fuel 1 day ago | parent

I would rather keep things on postgres but everything wanting its own postgres container is really annoying. Postgres already has support for multiple databases, users, and access controls. I would personally prefer to just set up one postgres instance with proper backups and have everything run against that, unfortunately some self-hosting projects have fairly poor support for that.

eddythompson80 1 day ago | parent

You could sometimes get there. The problem is in an effort to simplify the getting-started with postgres (or other databases) most projects assume they would also automate the management of that postgres instance.

The getting started would be a lot different if it first instructed you to install postgres, run a script or create a database and users and configure access controls. Also certain things become easier if you assume you can also manage the postgres instance, like on an upgrade, maybe you just create a completely new database and drop the old one, or isolate tenants within one application into different databases, etc.

In general, I agree with OP that sqlite is all you need for selfhosted applications (most of the time at least)

doubled112 1 day ago | parent

I prefer a separate DB instance for each app. Each app is on a separate ZFS filesystem so I can snapshot/backup the app data and DB together as one.

A possible restore only affects that app. Plus I can guarantee the files and DB were snapshotted at the same moment this way.

It may just be a way for me to avoid managing the DB.

olavgg 1 day ago | parent

I do the same, a single app on a zfs filesystem I can snapshot/send/receive

nmlt 1 hour ago | parent

Isn't a snapshot of the db a bad idea? At least you won't always be able to restore from that. You'll need a dump for that to work.

steezeburger 1 day ago | parent

That sounds like a mess. What do you do when the open source projects you're running need different versions of postgres?

tracker1 1 day ago | parent

That's a large part of why I lean more and more into just preferring sqlite for applications.

Even in work environments for apps that likely won't have thousands of simultaneous users. Modern SSD drives are so fast that so many apps don't need the advanced features of a full blown rdbms. And I think options like Turso and Cloudflare D1 fill the in between as a hosted option.

I do wish that sqlite had a couple more native types, it works really well as it stands.

Larrikin 1 day ago | parent

My experience with this is that all of the projects that are worthwhile, continue to grow and then at some point some kind of bottleneck is hit. Migrations become slow or overly complicated, lookups start taking forever, etc and the app just starts to slowly become unusable the more you try to use it.

You end up in a situation where you are following some complex guide (hopefully written by the actual developer) where you make a huge backup, have to tear everything down, and then hope the migration from SQLite or MariaDB doesn't hit any issues. Postgres is heavier but at the scales of self hosting it should not matter on any modern system. Multiple docker containers even on a Pi isn't something you have to worry about. Solutions like Immich are usually run on a NAS where there would never be an issue

eddythompson80 1 day ago | parent

Also you don't always know who your users are gonna be. You could create a cool personal photo backup app for your <20k library, then get people with a dozen terabytes of photos wondering why is it so slow?

IllIIlIlIlIIIIl 1 day ago | parent

> several things each wanted their own Postgres container. Immich wants a Postgres and a redis instance.

Those things are dirt cheap. A Postgres container on my machine uses 200MB of memory. Redis is nearly free. It's a small price to pay to not have services cross paths with each other and mucking everything up.

dewey 1 day ago | parent

Also you don't need a separate container for each of them. Why not run one and have multiple databases in there?

jamesgeck0 21 hours ago | parent

Postgres can use less RAM than Redis, depending on how much you're putting in Redis. I've got ~150MB database sitting in a Postgres container that's hovering around 13-25MB memory.

a10c 1 day ago | parent

Immich uses postgres because it relies on VectorChord for smart search.

It's what powers the ability to search your photos for "a dog on a beach".

It's also a fairly sensible decision.

frumiousirc 1 day ago | parent

There exists https://github.com/asg017/sqlite-vec

And for small enough vector sets, holding them in memory is reasonable. Most personal photo collections would fit that scale.

dewey 1 day ago | parent

I actually always find SQLite more annoying than Postgres. Postgres I just run on the host and let all my containers talk to the same instance, one thing to backup. With SQLite it's always about volumes, permissions, backing up individual files for multiple projects.

It also makes it much easier to just point my Postgres GUI client to my remote server (Behind Tailscale of course) and query the database there without copying over the SQLite file to my local machine, or mount it somehow. Even for simple projects that I start I always prefer Postgres.

eddieroger 21 hours ago | parent

If you're comfortable doing that, and plenty of folks are (especially us oldies who remember the shared hosting days), then that's a great way to go. I think that many who pull a docker compose file probably aren't ready to also be a PG admin, and if not shared, Postgres is probably overkill for most things. But, I've also had bouts of "just use a single PG/MySQL instance" myself. I get it.

4ndrewl 1 day ago | parent

Wanted their own postgres container or database? Why should the service know/care how postgres is running?

vanschelven 1 day ago | parent

Yes very much so! Also has the happy side-effect of making your architecture so much simpler to reason about[0]

In the "end" (after a couple of months actually) I did add support for MySQL and Postgres because I found it massively helps adoption for those self-hosters that already have those (and associated stuff, e.g. backups) in place.

[0] https://www.bugsink.com/blog/database-transactions/

pseudosavant 1 day ago | parent

Shameless plug for my web video player that is especially designed for self-hosting situations. Drop a single html file in your web server folder with your videos and you get thumbnails, library, search, subtitle support, etc.

No required third-party dependencies (just the optional Google Drive and OneDrive features). Highly customizable (colors, site logo, default features) with a JSON file the player can produce. Responsively scales for any web browser: laptop, mobile, smart TVs, game consoles, even built-in in-car tablet browsers.

https://github.com/pseudosavant/player.html/

steezeburger 1 day ago | parent

Hey that's pretty neat. Thanks for making and sharing.

b3lvedere 1 day ago | parent

This looks awesome. Very quickly read the Github page. It does seems to need a webserver. Would i just drop the html file in a smb shared folder and open it in a webbrowser, could that work ? Apologies for asking weird questions.

pseudosavant 1 day ago | parent

The main use for it is as a webpage you can serve with any web server. If the folder for your smb video share is also served with any web server, drop player.html in there, access it from the webserver URL, and it'll work great.

It is also a PWA though, so you can install the player (e.g. from my github pages test version: https://pseudosavant.github.io/player.html/player.html), and then use it as a local video player for any video file in your OS, like directly from the smb share if it is mounted.

b3lvedere 1 day ago | parent

Thank you for your response! Much appreciated.

antihero 1 day ago | parent

If we're plugging stuff, here's my little ecosystem I've been working on for about 8 months. It replaces (but is fully compatible with) navidrome/subsonic, iOS client, macOS client, tvOS client (with modern QR/code based login flow), WebUI, and soon, Android clients. Also supports local libraries.

Has neat stuff like remote-controlling other clients (zero conf/mdns/server relayed), modern user management (invite links, app passwords, api keys), the apps are pretty, low-resource, and consistent. Normal stuff like gapless, bit-perfect, share links, file-watching that is solid, etc.

Other killer feature is DSP/EQing that supports stuff like importing (or building) squig presets (great for IEM users), UPnP devices (from desktop, and supports DSP for room corrections etc). Should be a tad more lightweight than navidrome (though I do love navidrome <3).

https://koan.rocks

GalaxyNova 1 day ago | parent

I don't know why so many people host personal forgejo / gitea instances. You only really ever need a server with ssh access (and cgit if you really want a web interface).

c-hendricks 23 hours ago | parent

I like ci, issue tracking, and mirroring repos though

mrkaye97 1 day ago | parent

Out of curiosity, do you have any concerns about backups (especially for e.g. VaultWarden and Immich)? I've been pondering running them, but figure that I'd need to back up to The Cloud for me to feel less concerned about losing everything, at which point: what's the point? Curious what you're doing on that front!

Gigachad 1 day ago | parent

I use restic to create encrypted snapshots on external cloud storage for the data I care about. My media is stored on a nas which covers me for drive failures. If I accidentally delete everything or my house catches fire I can download my personal data again and just redownload the terabytes of media.

viceconsole 1 day ago | parent

I use both Restic and Syncthing. I have considered putting encrypted backups on a cloud blob storage, but my preference would be to set up an offsite backup at a relative's house.

dspillett 1 day ago | parent

> but figure that I'd need to back up to The Cloud for me to feel less concerned about losing everything, at which point: what's the point?

You need to backup to an independent network in any case, surely? If not self-hosting with, for example, Imich, how do you assure backups of what you chose instead? I wouldn't trust a cloud service's promises to keep everything securely backed up and available to you, not because I simply don't trust cloud services but because with that arrangement they are a single point of failure so you can lose your data and your backup at the same time if something drastic happens at their end.

Things I run out there backup to home and things I host a home backup out there, in both cases via an intermediate to get “soft offline” behaviour (sources can't directly connect to backup hosts and vice versa meaning in the case of malicious damage both have to be independently hacked for me to lose both the source and the backup), with snapshots (a source can push a corrupted backup to the intermediate and the backups will happily pull it down as they'd not know, but the older snapshots would be untouched on the backups). Both sources and backup hosts could damage data on the intermediate if hacked or broken by my carelessness, but the damage can't spread further than that.

drawkcabdaernac 1 day ago | parent

That's a problem I keep myself concerned with even for stuff I have in the cloud. I don't trust that they actually have functional backups of the things that are important to me (or if they do, that I will always be able to access them).

ww520 1 day ago | parent

Just a note on OP's hardware choice. I used to have a Beelink with the N100 CPU. That thing overheated and reboot intermittently after couple months of usage. I suspected they overclocked the CPU to look good in benchmarks. I tried to underclock in the BIOS. The temperatures dropped but the setting was reverted after the next power down. Nothing in the BIOS stuck. Their support was worse than useless. The machine ended up as spare parts.

You are better off getting the used business mini-PC from HP/Dell/Leveno/Asus. They have better specs and run great.

Rohansi 1 day ago | parent

Most likely something wrong with the cooler, maybe it's not making proper contact with the CPU. Should be repairable if you give it a try, but yes, the used thin clients are higher quality.

ww520 1 day ago | parent

I did clean the thermal paste between the CPU and the heat sink, and re-applied new thermal gel. That didn't help. It was the raised voltage preset in the BIOS. If I lowered the voltage, the temperature stayed low and it would run fine, until the next power down reverting the BIOS changes. The box was too small, the heat sink was too cheap, and the fan was too lacking to be a proper overclocking setup. It would run fine out of the box for couple months until the CPU and hardware worn out due to stress and heat.

Rohansi 1 day ago | parent

Hmm that's too bad. I have bought a few of those (different models) over the years to use as HTPCs for different family TVs. Only one had cooling issues (bad fan bearings). I avoid the extra small ones and just get the NUC-like ones.

mcmcmc 1 day ago | parent

New CMOS battery might’ve fixed the BIOS resets

mk12 1 day ago | parent

Just another data point, I got a Beelink S13 Pro N150 running similar things as OP and haven't had any issues. I made changes in BIOS (set "Chipset > PCH-IO > State After G3" to S0 so it boots up again after regaining power) and they are sticking for me.

monk_grilla 1 day ago | parent

Same here, N150, no issues. Don't think I've made any changes to the BIOS.

Fans spin a lot near-constantly though, I think it is the on board M.2 SSD that is hot, I need to get around to adding a thermal pad or something one of these days.

ww520 21 hours ago | parent

It's the CPU voltage setting in BIOS that got reverted.

drnick1 1 day ago | parent

This. Or just buy an N100 motherboard (Asrock makes one) and put it in a standard ATX case with a proper cooler, power supply, and enough space for expansion cards and hard drives etc. Maybe you will want a GPU in the future, even if it is unncessary now. Small nonstandard form factors always come back to bite you sooner or later. It's better not to cut corners and build something modular.

drittich 1 day ago | parent

I have the opposite experience. Plex, nextcloud, minecraft servers, and ~10 websites are all hosted on a Beelink N100. It stays cool and quiet.

Hikikomori 22 hours ago | parent

I just got a bee link with intel i3 304, idles at 40c with fan off.

ww520 21 hours ago | parent

That's i3. Also what's the temperature when it's doing work instead of idling?

Hikikomori 20 hours ago | parent

I'll see when I got it set up more. The i3 304 is essentially the successor to the n100/150/200 CPUs.

jwrallie 1 day ago | parent

For people interested in a minimalist setup, Tailscale + Samba can go very far. I personally use Foobar2000 and VLC on the client side.

It’s not pretty nor great with bad connections, but there is basically no maintenance.

drnick1 1 day ago | parent

This, but plain Wireguard instead of Tailscale. This assumes you have a public IP. But you can't do true self-hosting without one.

poisonborz 1 day ago | parent

Tailscale IS Wireguard. With all the reasonable management added. You can selfhost the control part via Headscale. Plain Wireguard can be a hassle for most - that bore Netbird, WG-Easy, Netmaker... out of those Tailscale got it the most right.

exographicskip 1 day ago | parent

foobar's rock solid. I have a portable copy on a mounted NAS share and it's great for transcoding and being an ad hoc music player while setting up new computers

jofzar 1 day ago | parent

> . I do have a 4k TV, but it’s not extremely large, and while I can tell the difference in resolution between SD and HD, for almost everything, 720p seems to be good enough for me.

I am actually jealous of you, I can tell the difference between 4k low bitrate and 4k high bitrate, 1080p and 720p are like mud to my eyes.

russelg 1 day ago | parent

The difference between a 4K bluray encode by pirates who care, and a 4K WEB-DL from Netflix and co, is simply staggering.

sudobash1 1 day ago | parent

I got a VHS player and a load of free tapes. It hasn't changed since I was young (well they've degraded a little), so if I enjoyed it then I can enjoy it as well now. In some things I try to resist a little the encroachment of higher standards.

But not in everything. I can't drink a cheap scotch.

swiftcoder 1 day ago | parent

> I can tell the difference between 4k low bitrate and 4k high bitrate, 1080p and 720p are like mud to my eyes

The more interesting question is whether you can tell the difference between 720p and 4K at the same bitrate. Dividing that bitrate across more pixels usually results in a worse image at the higher resolution.

High-bitrate 720p generally looks better than low-bitrate 4K - it's not uncommon to find that a DVD looks better than the Netflix stream of the same content.

OroPla 1 day ago | parent

This stuff is so complicated and insane, that a 720p TV version from a decade ago can look better than a modern 4K Blu-ray release.

Case in point: Ghost in the Shell (1995)

http://comp.judging.it/index.php?seriesid=Koukaku%20Kidoutai...

Old TV version: http://comp.judging.it/content/Koukaku%20Kidoutai/4K-1/Judgm...

New 4K BD: http://comp.judging.it/content/Koukaku%20Kidoutai/4K-1/4K%20...

cavoirom 23 hours ago | parent

I think the screen size matter, 720p seems good on 32" but could be noticeable bad on 50". Another factor, if I'm familiar with the high resolution, I will notice the lower one easily.

jbs789 1 day ago | parent

> I need to think about realistic ways to handle potential server failure without compromising the functionality of my home

Sounds like his family is in a pickle if he’s out of town and the server goes down.

viceconsole 1 day ago | parent

They might have to turn on/off some lights using the buttons on the smart switch, yes. Or maybe lose access to Jellyfin for a while. But on whole things have been pretty reliable.

bahmboo 1 day ago | parent

Just FYI you can get a M1 Macbook Air with a broken or cracked screen for about $250 on eBay. It's a headless device at that point but it has a keyboard and touchpad.

I use it for my Home Assistant setup and more. It still has headroom. No fan, very low power consumption. Not true Linux container stuff but pretty much everything works on it in this area.

alrs 1 day ago | parent

My go-to for low power consumption is a Chromebook running some vanilla flavor of Linux. I have some HP units that will run for almost a day on battery with the lid closed. $25<$250.

bahmboo 1 day ago | parent

How do they do with staying on and then restarting everything after power off? Can they automatically repower?

I don't have my embedded macbook fully configured but gemini says I can get it to repower itself.

By repower I mean if the power goes out and then returns the machine needs to power on and boot.

I have a couple of older Chromebooks I use in rando locations (basement, shop, car, rv, boat etc). And they are great for that casual scene-specific use. Very much recommend and amazing what you can get for sub $50 easily.

One can create a gmail account like my-robots-73489@gmail.com to sync everything too without touching your main google account. Very handy.

[edit: one thing about the M1 is that it has native h.264 h.265 and prores hardware encoder decoders if you are doing video intake of multiple streams]

diebillionaires 1 day ago | parent

yeah, they make a great homelab, especially with a fast external drive or 4

trevithick 1 day ago | parent

I forgot all about MPD. MPD is great, I used it long ago, just exposed to the public internet. Nothing bad ever happened.

ioneer 1 day ago | parent

Maybe I skimmed your blog too fast, but I'm surprised I didn't see a dns ad blocker. Thats the first thing I'm seting up when I have a more permanent.

yoz-y 1 day ago | parent

Never tried it myself but I’d be afraid of stuff being randomly broken. Eg at some point pi-hole made YouTube history not work.

cromka 1 day ago | parent

That's my experience as well. Also need to intentionally disable it e.g. when using Cashback sites. And you can't easily do that with a single click.

Not to mention it only can do DNS blocking, so you still need an in browser AdBlock for more advanced stuff.

I use Brave and see no reason why would anyone chose differently. Maybe if they use freemium apps on their phones with a ton of ads?

MattTheRealOne 21 hours ago | parent

For the cash back sites, I have a separate Firefox profile that uses a public DNS over HTTPS provider to bypass my internal DNS.

cromka 5 hours ago | parent

That's a good workaround, did not consider it before.

viceconsole 1 day ago | parent

I run Adguard on my router, not on my server. I did write a subsequent post about the rest of the stuff I run on my router and my Proxmox cluster, but forgot to mention Adguard.

rsync 1 day ago | parent

Dns4eu is free, has adblocking, and you can deploy it right now.

nicce 1 day ago | parent

That should be probably in the router.

aanet 1 day ago | parent

/Aside/

Realizing (not just now, btw) that some folks have such a complex setup in their home networks... Make me go :wide_eyed.gif:

I dont even know half (most?!) of the apps/services listed there, let alone know why one would use, or even self-host, them..

/Aside

peterdemin 1 day ago | parent

How do people use let’s encrypt on a host that is not accessible from public Internet? Do they manually renew every three months through DNS challenge?

anygivnthursday 1 day ago | parent

You can automatically renew through DNS challenge?

viceconsole 1 day ago | parent

Yes.

sudobash1 1 day ago | parent

I used to have my server publicly facing, but now I use Caddy with automatic DNS challenges.

binarin 1 day ago | parent

I renew it automatically via DNS. But as I use Cloudflare for DNS, and it doesn't allow to precisely control access to subdomains, I use a separate locked down VM that is only responsible for issuance and makes the resulting certs available for download.

dspillett 1 day ago | parent

You don't need to do it manually - the DNS challenge works automatically as long as the machine doing the renewing can call out to something to update the DNS entry, and you can use the dns-alias option¹ if your main DNS provider isn't easy to automate this way (this also limits the opportunities for something going wrong with the automatic DNS updates for certs breaking your main DNS at the same time).

I'm interested in the new DNS-persist method² which will make this even easier, though with some obvious trade-offs, but despite the announcements in Feb/May suggesting it would be rolled out in Q2, I've heard nothing recently and we are now in Q4.

There are various ways to separate managing certs via regular ACME renews and the hosts that actually use the certificates, meaning that hosts which can never see or be touched by the outside network (except via whatever VPN you may use when away yourself) can have ACME certs instead of you setting up your own CA arrangement to serve them. One option if you don't mind all your services having one private key, is to get a wildcard cert on one host (a small server just answering the top level domain.tld for HTTPS based validation, or again one of the DNS options) and have your other services regularly refresh the certificate they use by reading it from there.

----

[1] Docs for acme.sh: https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... (other tools work just as well with it)

[2] https://letsencrypt.org/2026/02/18/dns-persist-01

diebillionaires 1 day ago | parent

to each their own i guess. i love docker and exposing my services publicly. and fortunately i bought 64gb 3 years ago :)

diebillionaires 1 day ago | parent

As someone that loves docker compose and doesn't mind services with the benefits of software better than sqlite, I guess I'm the minority here. I wish more apps were based on postgres. I also have never had a problem with my publicly exposed applications. Not once in 8 years.

harry8 1 day ago | parent

8 years to now may not be indicative of what's to come.

People with script-kiddie level skills now have access to nation-state level attack expertise via LLM.

anotherevan 1 day ago | parent

As long as you can use one instance of Postgresql. There's another comment thread here[1] about each thing wanting its own Postgresql container.

[1] https://news.ycombinator.com/item?id=50111944

steezeburger 1 day ago | parent

I'm a big fan of Tailscale

drnick1 1 day ago | parent

But can you still call it "self-hosting" when a corporation is now controlling access to your own network?

steezeburger 1 day ago | parent

I mean I'm just lazy. I could use Headscale or implement my own wireguard control plane.

The apps and data are still all on my hardware, Tailscale just brokers the wireguard connections and can't see the traffic.

I get what you mean though. It's a link in the chain for sure. Never had an issue with it so far though.

steezeburger 1 day ago | parent

Nah I thought their setup was pretty ridiculous and seemed hard to maintain. I run all my stuff via docker compose and am very happy with it. I don't understand the comments praising single go binaries, which I've actually seen reach out to the docker engine api and start containers for their dependencies

spatterl1ght 1 day ago | parent

I highly recommend https://github.com/mother-of-all-self-hosting/mash-playbook for those interested in secure containerized self hosting.

A tremendous number of services are supported

non-root user execution, read-only, and cap-drop where possible

anotherevan 1 day ago | parent

I'd be interested in a list of services he uses that he could self-host but chooses not to. I think the only one he listed was email.

privybox_dev 1 day ago | parent

i used to setup a NAS. it was closed few years ago. plan to buy a new one. you are a legend.

harry8 1 day ago | parent

Alternative for music:

owntone + shairport-sync

Owntone holds your collection on the sever and can stream to airport, airport2, dlna.

Shairport-sync turns a raspberry pi zero 2w, or orange pi zero 2w into an airport {1,2} speaker. Or use a (super cheap) esp32 airport 2 from aliexpress.

Can sync every room in the house with owntone OR "I want my phone or laptop's sound to come out of the speakers in this room"

Owntone has access to your paid spotify account if you want that. Can stream to your phone with http (remotely with wireguard vpn). Also has mpd controls if you want those and can use apple remote app on your phone if you like that.

Owntone, pihole and wireguard is reason enough alone to put an old laptop into service as a home server.

eventuallyok 1 day ago | parent

I have gone down the self-hosted rabbit hole, like many it all started with setting up a pihole on a raspberry pi.

I have since gone down the jellyfin + arr stack route. Resource wise the entire stack uses very little. I have Sonarr, Radarr, Prowlarr, Bazarr, FlareSolverr, Jellyseerr, SABnzbd, qBittorrent, Gluetun, qui, Decluttarr, Recyclarr, arr-dashboard all running on my dell optiplex (previously on the raspberry pi).

All up this uses about 2GB of RAM and 0.5% CPU.

I found it extremely fiddly to set up, understand what each component does and have everything integrated well across all my devices.

Without the help of an AI assistant I just wouldn't have had the time to debug every little issue. It took me a good 12 months of tinkering around work hours to have everything stable. However now it runs along fine with very little intervention and I'm able to share it with friends and family.

So the resource argument I don't think is valid. However the fiddly mess I do agree with. Although personally I found it fun and rewarding when things finally worked. But I can understand why people would not want do spend all that time on it.

sigbottle 1 day ago | parent

Is putting your reverse proxy in a VM not secure enough? What can break out of a sandboxed VMM?

I suppose there was a KVM exploit on twitter a while back...

hypfer 1 day ago | parent

I bought a used 8th gen intel NUC a few weeks ago, and was surprised by what I got for the price.

110€ for 8GB of RAM, an m.2 slot with a 240GB SSD and a 7781 Passmark multi-core score i5-8259U with a GPU usable for stuff like frigate but also QuickSync transcoding.

Plus a second DIMM slot to upgrade to 16GB RAM for another 30€. Plus a SATA Port. Thunderbolt. WiFi/Bluetooth, and ~4.7W Idle power consumption.

For all the "HW has gotten so expensive", that.. kinda isn't? I mean it's still 8 year old used hardware, but it's also perfectly fine still performance-wise. And it's just some x86 thing, so it runs mainline linux.

For reference, the N100 mentioned in the article has a passmark multi-core score of 5305. Granted, it also has a TDP of 6W, but still.

vladgur 1 day ago | parent

Have you measured how much energy it uses once you have your frigate continuously recording and go2rtc multiplexing all the streams

hypfer 1 day ago | parent

I don't use it for that. I just put the option there for the context of the thread.

In my setup, Frigate runs on some 6th gen Intel desktop chip with a coral accelerator that regularly dies, however, on this old mainboard, it does not take the whole USB controller with it (contrary to the 9th gen intel host I've used previously).

I couldn't tell you how much of that system's power draw is frigate as it does a lot of stuff beyond just that.

Hikikomori 1 day ago | parent

Just upgraded from 7th gen NUC to a new bee link with the new intel Core 3 304, 16GB ram, 500GB ssd for $469 (EU price), my NUC was struggling with jellyfin and some 4k content. The old NUC cost $410 in todays $ without memory and ssd, so maybe $550-580 with those included.

trilogic 1 day ago | parent

All I see is server and google blah blah! This is called using your device as a node for other apps to be served. You have no chance of knowing what selfhosting is, but good try.

bengalister 1 day ago | parent

I also self host some services: keycloak, forgejo, home assistant, immich, grafana/prometheus, jellyfin, pureftp (to store my surveillance cameras videos), and a vibecoded financial app, and soon hermes agent on a 2023 laptop.

I chose to run most of them on Kubernetes since I am used to work with it. I use:

- ha-proxy running on the host and istio running inside the cluster for the sni based ingress routing - cert-manager with a self-signed CA I had to import the CA cert on my devices - cloudnative pg for postgresql dbs (keycloak and immich)

For the backup it is mainly some cron jobs that save to the cloud.

It is overkill I admit but kubernetes makes some integrations easier. Even though it was also a way for me to maintain some Kubernetes skills for my work. The tricky part is the network connectivity, for instance home assistant runs inside the cluster on its own network and it makes things more complex like homekit bridge integration (different network than my devices). But with the help of AI the iptables configuration makes wonders.

The kubernetes cluster is k3s running on NixOS micro vms, fully managed declaratively thanks to NixOS.

The services that run outside the cluster (ha-proxy, jellyfin) are all managed declaratively.

At some point I had thought of using proxmox with lxc but I am very happy with NixOS.

pydry 1 day ago | parent

isn't it a nightmare running home assistant with kubernetes? i had a bad enough time just using docker compose.

bengalister 1 day ago | parent

So far it is ok. I even have a usb zigbee dongle receiver in usb passthrough and the container in privileged mode. I am moving to the Apple ecosystem and I managed to have homekit bridge connected to Apple home. I had to use an avahi relay on the NixOS host for the discovery protocol to work. The home assistant is not the same network as my devices. The homekit bridge allows to configure the advertised IP.

I use tailscale (outside the k8s cluster) for connectivity. My phone companion app is not connected to my home assistant server outside my home but could through tailscale.

So definitely there is added complexity, especially on the iptables configuration. Without the AI help, I don’t think I would have managed to do it regardless of the time saving.

attilaolah 1 day ago | parent

I also used to run everything on K8s (hybrid Talos / Alpine+k0s on nodes too small for Talos). It is a fun exercise, but with many small nodes eventually I realised I was burning a quarter of my fleet's CPU on just monitoring and routing services.

Eventually I switched to Systemd only, Clan-managed NixOS instances on bare metal.

The killer feature for me is socket activation. It even works with Jellyfin, wrapped in systemd-socket-proxyd. I have Jellyfin listen on a UDS, and Systemd will activate it when my TV connects. The downside is a few more seconds of waiting when I open Jellyfin on the TV. The upside is, after 20 minutes of idling, it is fully powered down.

This allows packing even more services on smaller machines, provided you don't e.g. play Minecraft and watch Jellyfin at the same time.

apexalpha 1 day ago | parent

Just looked up Clan since I'm a big fan of Nix but currently run my cluster with k3s, which indeed has some overhead.

It seems however that Clan is one of those classic projects where the website and the docs assume that everyone already knows what it is and how it works and goes straight to the benefits of doing it this (whatever 'this' is) way.

After reading both the site, docs and guides I am now scouring Reddit and YouTube for an actual explanation of whatever the hell it is and how it works.

attilaolah 23 hours ago | parent

Yeah Clan does have some rough edges. And the website is indeed like that, especially the bits about disko / partitioning, etc.

bengalister 1 day ago | parent

Yes i will probably end up using systemd services when I will hit resource limits. So far everything works just fine on my LG16 32 GB i7 laptop and consumes around 15w.

dv_dt 1 day ago | parent

We have come full circle back to inetd, only systemd is a little maze of twisty little passages in comparison

gf000 23 hours ago | parent

How does 20 minutes of idling work? Is that jellyfin shutting itself down?

attilaolah 23 hours ago | parent

No it doesn't support that, but systemd-socket-proxyd does. So my Systemd service exec line looks like this:

ExecStart = /path/to/systemd/lib/systemd/systemd-socket-proxyd --exit-idle-time=20min /path/to/jellyfin.socket;

https://github.com/attilaolah/dotfiles/blob/144d1711755d7a9e...

attilaolah 23 hours ago | parent

To be clear, it will shut down Jellyfin after 20 minutes of inactivity on the socket. It may as well be that Jellyfin is doing some background work like re-indexing videos, so it is not perfect, but it is the next best thing until Jellyfin supports first-class socket activation.

wing-_-nuts 22 hours ago | parent

I see so it's not shutting down your computer and using WOL to wake it up?

mirthflat83 1 day ago | parent

How's your vibecoded financial app setup? Are you using Plaid?

bengalister 19 hours ago | parent

It's a standalone multi-asset portfolio tracker for securities and currencies, using PostgreSQL for data storage and Grafana dashboards for visualization across asset classes, sectors, and regions. Public market pricing is periodically pulled from public financial web sources, and helper scripts allow ingesting manually exported position files. It does not connect to bank or financial institution accounts, nor does it provide investment advice or recommendations.

chanux 1 day ago | parent

Do you mind sharing your use case for Keycloak? Is it for the various personal apps?

bengalister 19 hours ago | parent

I use it only as id (idp) broker and SSO to authenticate to my apps. I don't have a use case that requires sharing identity across applications. It is definitely overkill for now, I could have used a password manager and a browser extension.

kstenerud 1 day ago | parent

I'm currently building a Plex competitor, minus the rug pull. I'll be opening a beta soon, and I'm wondering what the interest is from the hn crowd.

Basically: easy self hosting, includes a discovery server you can run on your VPS, all the usual stuff you expect from this kind of software, and free forever.

The only thing I'd charge for is my own discovery service which gives you convenience because you don't have to host your own. Any feature that can be hosted yourself remains free forever.

vincentkriek 1 day ago | parent

What is the benefit compared to Jellyfin?

kstenerud 1 day ago | parent

- Single binary

- I've addressed the most common complaints and unfixed issues in all of the competitors

- "Watch together" mode because my gf is stuck in another country for the next few months. Includes voice chat and will soon have tv casting to watch on the big screen and chat on the phone.

- all the hole punching tricks to get access from remote if you want it (or just keep it local only if you'd rather not)

- more features I'll talk about later - out of time atm

Hikikomori 1 day ago | parent

Could give it a try, currently happy with Jellyfin. What clients will you support?

kstenerud 23 hours ago | parent

Early beta will be web browser only, but I'll be adding shims to support existing clients (for the functionality they support). Ultimately I'll be adding native clients but those are some time off.

cicko 1 day ago | parent

Almost all of these are totally useless to me, except the one he believes is not worth it - email. So many different views.

romainio 1 day ago | parent

Super interesting article! I love how you found a solution for almost every daily app!!

I also run into the “what should I watch next?” problem, as well as the lack of a Netflix-style recommendation experience in Jellyfin. That’s why I forked Wholphin (huge thanks to the original project!) and added TMDB watchlist and popular-list syncing, all connected to Sonarr and Radarr with direct possibility to add movie in list.

Feel free to take a look: https://github.com/romainio/JellyVault

comandillos 1 day ago | parent

Dont get it but... the starting page says that the blog itself is self-hosted but the article says he only exposes VPN services...?

cromka 1 day ago | parent

Maybe on a public VPS?

neLrivVK 1 day ago | parent

Regarding Immich, you write: "I’ve come up with a solution for sharing albums with family, as well."

Could you elaborate on that a bit?

bschwindHN 1 day ago | parent

Yes please! I'm curious to hear this as well.

krypttt 1 day ago | parent

I still don't think the benefits of self-hosting is worth the trouble unless you are doing it as some sort of an hobby.

ssernikk 1 day ago | parent

I'd love to NOT expose my services to the internet, but I often share stuff from opencloud/seafile or immich. If somebody has a convinient (for non-technical people I share stuff with) solution, please share because as the author of the post said, with AI assisted hacking now I'm really concerned. I hope that dockploy is secured poperly.

olavgg 1 day ago | parent

Shameless plug...

MatterMost was actually a great file sharing platform for our business. But they was not true open-source and removed features we needed like SSO.

So instead we vibe-coded a MatterMost Slack alternative which we have been running on the internet fine for months now https://intellistream-datahub.github.io/intellistream-chat/ Its super convenient to share files on. And it comes with built-in secret sharing like YoPass. We occasionally implement new features and fix bugs we discover.

Its one jar file, and supports Vault/OpenBao and requires Keycloak and PostgreSQL. Lucene is embedded.

apexalpha 1 day ago | parent

My *arr stack is so rock solid and hands-off that the only downside is that I get 'inactivity' warnings from certain websites that the *arr stack uses to get 'stuff' done because they don't count API access as activity.

aktenlage 1 day ago | parent

Talk is cheap, show us the code ;-).

Seriously, I would be interested in your setup files. Similarly to you, I bought a Beelink 16GB mini-pc last year for self-hosting immich, paperless-ngx and jellyfin. I tried to use podman, but couldn't figure out how to set the mentioned services up with it (on debian 13). I had no experience with it, not much time to tinker (two small kids) and installation manuals and tutorials usually focus on docker compose.

I guess with AI now it would be trivial, but I'd prefer getting a blueprint already known to work in practice and actually understand the why and how.

So please, write a blog post explaining the technical side of your setup.

nicce 1 day ago | parent

Not the author of the blog, but these days self-hosting with NixOS is breeze, especially because of the AI that helps with missing documentation. Everything is fully reproducible, revertable and maintainable. You can use nix eval to check if syntax is correct before even deploying anything. And if the actual build files, changes are not applied.

Under the hood, with NixOS, you get the authors setup as described. I run some of the mentioned services as described, under NixOS, just defined by .nix files.

aktenlage 1 day ago | parent

Thanks. I watched videos on NixOS recently, it sounds great. I anyway abandoned the very appealing thought of using it. The reasons are already in my comment: "not much time to tinker (two small kids)" and "I guess with AI now it would be trivial, but I'd prefer getting a blueprint already known to work in practice and actually understand the why and how.".

I think this makes me incompatible with NixOS. Either I would need to spend the time to learn it, or I wouldn't understand much of what's going on. Maybe when the kids are older.

nicce 1 day ago | parent

I think the requirement:

> but I'd prefer getting a blueprint already known to work in practice and actually understand the why and how.".

from "working part" is fulfilled. It is known to be work very well and many businesses use it on scale. Even drones run NixOS because it is more reliable. But it takes time to learn, which is the main negative side. I would recommend watching a bit more before making the final decision!

aktenlage 21 hours ago | parent

I am sure nixos works perfectly reliable. I meant a specific setup (I've the configuration as home server with immich, paperless-ngx, jellyfish, samba, ...) as I am sure there still are better and worse ways to configure such a system. Is there a good "library" of NixOS configurations?

nicce 19 hours ago | parent

So, for most common services, you don't need a library. NixOS itself disallows invalid states and provides configuration options in pure .nix to represent the configuration of the target service regardless of how it actually works.

For example, configuring basic Immich setup is few lines of code, this also includes downloading Immich and relevant dependencies, following uses unstable channel, so using latest version:

  {
    services.immich = {
      enable = true;
      package = nixpkgs-unstable.legacyPackages ${pkgs.stdenv.hostPlatform.system}.immich;
      host = "127.0.0.1";
      port = 2283;
      mediaLocation = "/myzfs/media/immich";
      machine-learning.enable = false;
  };

  systemd.services.immich-server = {
    unitConfig.RequiresMountsFor = "/myzfs/media/immich";
    serviceConfig.ExecStartPre = [
      "+${pkgs.coreutils}/bin/install -d -m 0750 -o immich -g immich /myzfs/media/immich"
    ];
  };

}

Jellyfin is even less with defaults:

  services.jellyfin = {
    enable = true;
    openFirewall = true;
  };

  users.users.jellyfin.extraGroups = [ "media" ];

Samba is a bit more but less than 30 lines. And then you run `nixos-rebuild switch` on remote target to have previous to run as systemd services.

For those that are not part of the core NixOS, are usually provided with NixOS Home Manager: https://wiki.nixos.org/wiki/Home_Manager

Libraries are usually something more complex than single service in NixOS. Complete build pipelines for some package or specific kind of complex configuration that has many services to provide some single goal.

Hikikomori 22 hours ago | parent

I would install latest ubuntu server. I use dockge that provides a simple web interface to manage docker compose files, most projects provide a ready to use compose file that you can copy paste. Then you can use tailscale for remote access, expose to the internet via your router, or expose services with Cloudflared tunnel if you have your own domain, I use cloudflare zero trust just to avoid exposing the service directly, requires login via email code.

Can easily do this with AI now.

forever_frey 1 day ago | parent

Hello! Dawarich needs not "at least" but precisely four containers to run: the app itself, background jobs process, database and redis for cache and background jobs queues. I also have some ideas on how to reduce number of containers in the future :)

puti_machh 1 day ago | parent

I have been building a private cloud for small businesses for last few months. Like the OP, I'm also behind CGNAT so I have to use a VPS to expose my services.

For running services, Incus, particularly IncusOS has been godsend. Clustering, containers, vm, networking, storage, monitoring; so much is streamlined. I put an OpenWRT router(using a Pi 4) in front as the internet gateway that handles DNS and Wireguard with the VPS. For configuration management, I'm using justfile and a bunch of shell scripts.

tinykerneldev 1 day ago | parent

Wait, Usenet downloads is still a thing? Thought torrents have taken over for decades.

cromka 1 day ago | parent

Usenet is the only way to not commit crime in many jurisdictions, e.g. in Germany.

IceDane 1 day ago | parent

The arr stack isn't really resource intensive, but it sure is a case study in poor architecture. You need 10 services that each do a tiny job and often rather poorly. Setting it up by hand would be maddening but it was trivial with Claude.

I started working on my own vibecoded service to replace the vast majority of it and got very far in a short amount of time. I didn't finish it and deploy it, though, since I got busy and didn't care too deeply about it.

stego-tech 1 day ago | parent

Shoutout to another happy N100 miniPC user! I have two myself from before the RAMpocalypse, with one doing standard Proxmox + VMs work in a similar vein to ESXi, and the other straight Debian + Docker for more container hands-on time. Just the perfect little homelab boxes at the perfect price point (~$180US) before things got insane.

My stack is currently a mix of usual end user services (Jellyfin, FreshRSS) and identity infra, and it chugs along brilliantly without issue. I’m fairly certain that I could leave it running to the heat death of the universe if I built lifecycle management into my backup scripts.

poisonborz 1 day ago | parent

They are absolutely great except: - you need a beefier GPU for transcoding. It heats up fast under heavy load and most builds are fanless. - you start to have NAS requirements / +2 hard drives, RAID etc. There are a few chinese motherboards/minipc options now that do 6 SATAs or 4 NVMEs (via PCIE 3.0 x1) but you will be quickly constrained.

It is the perfect gateway drug setup though.

stego-tech 1 day ago | parent

Oh goodness, I would never make this thing into a NAS. It’s a compute node with bootable storage and a second SSD for temporary storage of transcodes, nothing more.

Speaking of transcodes, I haven’t had an issue with either unit despite both handling hardware transcoding on a semi-regular basis (one for Plex, one for Jellyfin). The system cranks through them pretty decently provided you’re doing one or two at a time, and I’ve had no heating issues with them jammed in a rack with my NAS and network kit. The hardest part was getting Intel’s proprietary drivers working for such a feature, and that was more a (lack of) skill issue on my end than anything else.

drowntoge 1 day ago | parent

Hey, great write-up and thanks for Snapcast. Can’t wait to give it a try once I get home.

csakaszamok 1 day ago | parent

anyone here got something close to the Vercel experience on their own box? I mean docker compose up and a few seconds later there's a working https URL

TheSecondMouse 22 hours ago | parent

I use Dokploy for that. There is also Coolify, but I have migrated away from it, not for any reason other than I prefer the interface for Dokploy.

https://github.com/Dokploy/dokploy

Bigpet 1 day ago | parent

Went through the same Firefly III -> Actual Budget journey.

Actual is really nice and the local-first nature is really neat.

timendum 1 day ago | parent

Firefly III is also local-first.

In my experience, Firefly is nice and the developer very friendly.

dd_xplore 23 hours ago | parent

I had a N100 mini PC with 16GB DDR5 (the chinese ones with 4 Ethernet for router use). That thing ran lot's of my services - arr stack, jellyfin, immich (iGPU + ML + another container running on my PC for additional ML resource), n8n, it-tools, handbrake, and another project that I used to do. This mini PC also handled 4k hevc quite fine! This is a surprisingly capable chip.But I wanted more so I bought a core Ultra 7 155H mini pc and took the RAM, ssd from the n100 machine (couldn't afford more due to ramocalypse).

I now also host this (shameless plug):https://news.freestuffsthat.work This simple site uses the built-in NPU, iGPU and the GPU on my desktop to summarise, sort topics etc for the news headlines.

ibizaman 22 hours ago | parent

What models do you use with hermes agent on such a machine?

Grombobulous 23 hours ago | parent

> After a few instances of my wife saying “X isn’t working” and needing to restart a service manually

This seemed like a good point of the article to mention that when self-hosting you need to consider bus factor.

Can your wife retrieve the family photos off of Immich if you die suddenly? If you die suddenly these will become even more important than they are now.

This is why my self-hosting is mostly for my own needs and not something the whole family depends on. I still use a cloud hosted photos service (Ente photos) and mostly use the NAS for a self-hosted backup.

If I die my family can just unplug my junk and get AT&T to turn the router/modem back to normal WiFi mode and throw my OpnSense box in the estate sale.

4chandaily 23 hours ago | parent

I set up a 'Karpathy-style' llm wiki for this purpose. I had a local model help me build a dataset which included links to all of my self hosted services, how they operate, how they are maintained, and common free and commercial alternatives if they stop and my partner is unable to get them going again. It includes everything needed to keep the system running (if desired) were anything to happen to me. It includes a lot of other information that is only in my head also, less relevant to this article, like contact information and things that I take care of routinely.

This took less than a few hours to set up, and resulted in a nice organized obsidian vault, easy for a non-technical person to access, that will hopefully make the first year or two after I am gone easier on those I leave behind.

https://gist.github.com/karpathy/442a6bf555914893e9891c11519...

JosNun 23 hours ago | parent

Seeing the *arr stack mentioned a handful of times, so this may be the best place to ask... Is the *arr stack primarily used for obtaining content that you haven't purchased? Or is there a way you can legally "buy" the content that you are downloading?

Can it be used for the dark gray area of "I have all this content on physical media, and I don't want to rip it myself", so I just hand it to the *arr stack, and it does the work?

jkman 21 hours ago | parent

Yeah ofc you can just rip the media you already own, e.g. Automatic Ripping Machine for physical disks. It's more involved than just drag and dropping files in, but it really is bulletproof once you've got it up and running.

And on "obtaining content you haven't purchased", that content is just another .mkv or .flac file. Doesn't make a difference to your media organizer.

tobias2014 23 hours ago | parent

I recommend https://github.com/awesome-selfhosted/awesome-selfhosted for exploration, and once you know a piece of software, a good resource is also https://alternativeto.net/ to explore FOSS/self-hosted options.

youtmommy666 23 hours ago | parent

Black Mirror, but self-hosted and open-source.

1vuio0pswjnm7 21 hours ago | parent

"For several years I ran MythTV ..."

"I prefer running services natively when possible..."

"If the dependencies aren't overwhelming, native is better, faster, and more efficient."

"Related, I don't do Docker anymore."

MetroWind 21 hours ago | parent

I self-host about 30 services. I exclusively pick software that's written either in C++, Rust, or Go. If I can't find one I write my own in C++.

jkman 21 hours ago | parent

What do you run instead of the *arr stack then?

MetroWind 21 hours ago | parent

TrueNAS with file system folders. I don't consume media that much so I get away with it. The only media I need to consume remotely is music, which I have gonic for.

jkman 21 hours ago | parent

I need to check out gonic, thanks for dropping that. Just was wondering since the whole *arr ecosystem seems like it doesn't have any mature alternatives that could cover the whole use case.

neLrivVK 3 hours ago | parent

Thank you for pointing out Readeck. It's amazing!