A few weeks ago we had a bit of drama on this sub when Planka moved its SSO functionality behind a paid tier. And just a few days ago, we had a "shame" list of self-hosted sso tax apps announced here.

I decided to compile the opposite, as I try to host things on my homelab that can be integrated with PocketID directly

https://ssno.tax/

.. is a list of self hosted applications that provide SSO for free with the option to use a custom OIDC provider. Not included are apps that only support Google OAuth or similar.

There is a health check to mark repos that are stale (no commits for > 90 days) or don't have an OSI approved license. I also tried to link directly to the OIDC configuration manuals

The website is generated from simple json file that you can contribute to on Github:

https://github.com/minimalistinc/ssno.tax

The website is automatically built and deployed to Cloudflare pages. No ads, no tracking, no hidden product placements.

I hope you find this useful!

Hello r/selfhosted

I'm the developer of Chevereto, a self-hosted media sharing platform that I've been developing since 2007. It enables you to run your own Imgur/Flickr website with your own rules, it comes with 2FA and S3-Compatible storage support.

About a week ago I released v4.5.7, the final release in Chevereto V4 release cycle. This one adds supports for several email providers apis (19 total) including AhaSend, Brevo, Mailgun, SendGrid, etc. It also improves on our multi-tenant support with more configurable flags and password-reset endpoint.

We bumped PHP 8.2 support and fixed several bugs as usual, including CVE-2026-55417. You can dig the complete changelog at our documentation.

Demo: https://demo.chevereto.com
Docs: https://docs.chevereto.com
Repo: https://github.com/chevereto/chevereto

Thank you for your support.

TL;DR: learned how to automate SSL certificates in my homelab. Read on if you’re bored haha.

Hi everyone. I was looking at hosting my own private DNS server on the public cloud however I have a few concerns. I'm currently running pihole on Azure which is locked down to my static IP.

However I want to access my own DNS server using private DNS settings on android. My issue is I can't always use a VPN as it doesn't work with android auto. Would there be a way to have a locked down DNS that's not open to abuse. My IP on my phone Sims (I run dual SIM for mobile redundancy) so my IPs would always be changing.

Just hoping to get some advice on how to resolve this issue.

Shitty day at work, back home and finally decided (after a week of pushing it back) to install Reitti. Really straight forward. Installed OwnTracks on the phone and voilà. Cherry on top, perfect integration with Immich!!

Might sound stupid but this made my evening. Gotta love self-hosting

Can we be more explicit on the required AI disclosure requirements for posts? It seems like 80% of the time people seem to think the required discourse is about their post, not the project they are promoting. This sub is getting hammered with vibe coded slop and while not all vibe coded projects are bad... most of them are and they aren't being disclosed often enough.

EDIT: I'm not against AI. I have vibe coded a lot of stuff for my homelab. Hell, my homelab is completely declarative using nixos and k3s gitops and I use AI to do a vast majority of administrative tasks. I'm absolutely aware that AI is used in almost every project these days and I don't think it's necessarily a bad thing.

However, I do think that it is reasonable for someone promoting their project to disclose how AI was used. There's a huge difference between 100% vibe coded slop and a project ran by an actual software developer with some AI usage for boilerplate.

Yes, shitware existed before AI, but if you're being honest with yourself you'll agree that more AI slop shitware projects have shipped in the past year than the past decade combined. Everyone looking to make a quick buck has shipped some shitware SAAS product and, while I'm sure their intentions are good, many homelabbers are vibe coding projects with blind disregard to any sort of security posture and putting it on GitHub and making it other people's problem.

It just doesn't seem unreasonable to request people promoting their projects to write a couple sentences disclosing how AI was used in their project. That tells people a LOT of what they need to know before doing their own due diligence.

Hey guys, I need suggestions on what cool things I can host in my potato mini pc (Dell Optiplex 3020m, 4th-gen Core i3, 16 GB RAM)

I will be hosting stuff in Kubernetes because I wanna learn it. I know it's overkill for a homelab.

I have spun up a Jellyfin Media server already with Cockpit and Uptime Kuma.

TIA

I have a task manager where I put short form tasks I have decided to do.

I also want a supplementary project management app where I can dump into my backlog and plan milestones.

I've been looking everywhere and all solutions I've seen assume a team. Is there any solution focused on single person project management?

MoQ is the IETF's attempt to replace WebRTC and HLS with one protocol. Cloudflare runs relays for it. Until recently, if you wanted to self-host one, you were compiling Rust from a research repo.

I work at Ant Media, and we've bundled a moq-lite relay into the server, so a self-hosted setup is now: run the server, open one port on TCP and UDP, install the plugin. Browser publisher and player come with it.

Practical notes for anyone trying it:

• WebTransport requires HTTPS, so you need a real cert. No way around it.
• The port must be open on UDP too. TCP-only fails silently and looks like a working install.
• Chrome, Edge, and Brave work. Safari needs 26.4+.

I'd be interested to know whether anyone here has managed to get moq-relay running standalone and how that compares.

In this comparison, I am streaming the same audio stream to different asr models (whisper vs qwen) in parallel and observing the results in the real time.

All the code used is OSS and linked in github.

I had a "Tile" that I kept in my wallet for a while. It was great since I lose my wallet all. the. time...

The battery in the tile has since died, and it's had me wondering if there are non-vendor-tied alternatives and server software I can self-host? If not, this would be an awesome niche for someone to get into with the open-source community.

I love things like AirTags, but I would guess there really wouldn't be a way to do a non-vendor tied version of something like that as it relies on the whole Apple ecosystem out there. Maybe a version with built-in cellular or Meshtastic could work to some degree. But the Tile just tells you where it was last connected to your device, or where it is in relation to your device if still connected.

Any idea on open-source solutions that a man who frequently misplaces his wallet and tv remote can look into?

source: https://www.afp.gov.au/news-centre/media-release/two-wa-men-charged-following-afp-fbi-wapf-disruption-alleged-global

Most self-hosting security advice is just about the basics - don't expose ports directly to the internet and use containers for basic isolation

Beyond that what level of security do you actually enforce? Do you monitor what your apps are doing in the background, like tracking outbound network traffic or checking file access on the host? When updating, do you just let it auto-pull or read the release notes for breaking changes or inspect source code and dependencies before updating?

After a long time, I decided to reinstall my server; I mainly used Nextcloud. I’ve finally set everything up using Docker. Mainly Nextcloud AIO and the arr stack. I’d like to ask for suggestions on alternatives to the following programs, or perhaps recommendations for other interesting tools you use yourselves:

Nextcloud News (RSS) -> ?

Nextcloud Notes -> FUTO Notes (Nextcloud Notes has let me down too many times, for example, by failing to save changes)

Nextcloud Cookbook -> ?

Nextcloud Bookmarks -> ?

Recently, the idea of making a family tree has also come up in my family. Maybe you guys are using something like that yourselves?

I'm a layperson with small home server, so bear with me. I don't know how to resolve the tension between two popular bits of advice I see advanced here:

• Keep your stuff updated, for security reasons
• Pin your Docker container versions, so they don't surprise you with a security issue

These seem to be mutually exclusive. I'm not talking about updates that break things, I mean things like supply chain attacks that distribute malicious code through official update channels, or bugs that let bad actors exploit software. The solution I have settled on something like Renovate or dockcheck.sh and waiting until containers are 7 days old to install the update. My hope is that in the intervening week, most such issues will have been caught and the update retracted.

Is this a reasonable approach? How about with the OS itself? I really don't want to sit there reading changelogs for 30 containers every week, much of which I likely won't understand anyway. I don't even know how to use Github which is why I don't use Renovate, instead using the dockcheck script.

Choosing a totally random example, I googled 'sonarr changelog' and found this, clicked the first one, have no idea what I am looking at when I click a given changelog

Other things I have going on:

• UFW + binding Docker container ports to Tailscale IP
• SSH key only/Tailscale only via UFW/no root login
• Crowdsec (which seems to be broken in a new way every time I check if it's working or not)
• Only port 32400 open for my brother to use Plex

Got this 32GB VRAM card (basically 2x WX7100 in one card) for 100 USD. Gigasteal. I want to be running local LLMs for the most part but i was wondering what else can i do with it? Do you have any other uses

I migrated my email from Docker Mailserver to Poste.io for the webmail option. I spent the last two weeks trying to fix it so that all my messages get sent. I kept checking with the nc command from within the container, and it kept failing to connect. After many days of blood, sweat, and tears, I discovered the issue last night: something—or possibly even me—had created an IPv4 rule in iptables for port 2525 that automatically rejected everything. Port 2525 should not have made any difference, since mail is sent on port 25, but as soon as I removed the rule, everything started working. I checked using ss and nothing was listening on port 2525, so I really do not know where the rule came from. My question is: why would that make any difference? Port 2525 is not used by Poste.io, but it must have been involved somehow, because everything started working once the rule was removed. I am still very new to this type of thing and plan to reboot the VPS to ensure the rule stays gone, but I am really just wondering what could have created that rule and for what reason.

Building a self-hosted photo app and trying to pick the primary distribution format. Curious what you actually reach for first when trying something new.

For size context: the app is ~20 MB alone, ~60 MB with bundled FFmpeg + face-recognition/classifier models.

Which do you prefer?

- Docker image (~80 MB pull, `docker compose up`)

- Single static binary, ~60 MB (chmod +x, run)

- Tarball with bin/ + lib/, ~60 MB (extract, run)

- Small ~20 MB binary that downloads ~40 MB of deps on first launch

- Distro package (deb/rpm/AUR)

- Other? (Nix,...)

Bonus question in the comments: what's an instant dealbreaker for you? (phone-home, requires root, needs internet on first launch, 500 MB binary, no ARM build, etc.)

I just want to bounce an idea I thought of that would simplify my setup of my self hosted web base services.
First I access my system only by Tailscale, there is reverse proxy, no registered domain, nothing. I access all my docker services via tailscale services that are provisioned by Docktail, and everything works.
However I have a few (3-4) web base custom services that run on a bare metal installed apache web server, but I want to access them also via tailscale, with a let’s crypt cert (the web apps require https) so while i could (and to) use tailscale cert to get the required https certificate, I have to remember to renew the cert every 90 days, while not too complicated or tedious I wanted to automate the process.
So I thought if I moved apache to say 8080 then installed caddy to act as a reverse proxy to the apache but caddy would only be acceptable via tailscale and would use the tailscale domain it would get the required cert and renew them.
The question is does this sound like a dumb overly complicated way of doing this and would it there be any conflict as i’m using tailscale services for my docker stuff and potentially caddy for the bare metal web stuff.
It seems reasonable to me, but I have a tendency to sometimes over complicate things the other people think I’ve lost my mind (which I probably have 😉).
If anyone has the time to just tell me it’s not a bad idea or it’s dumb and move on that’s fine. I know some would just ask AI the question, but I being old school would prefer to ask people even at the risk of being downvoted 😎

Ok, so, I am asking as a dev who has two self-hosted tools, one with a handful of users and one with a somewhat larger user base (I think, I'm estimating, I don't have any hard numbers)

I feel like I don't have any kind of channel to communicate with my userbase. There's no good place for me to get a message out to them about if they have opinions on say, some UI changes I am planning, or what UX they'd prefer for a new feature.

The smaller project is on GitLab, the bigger on GitHub. Using Discussions on GitHub could work I guess, for that project, but I doubt people return to the repo often or check if there are discussions.

I don't personally follow people, social media isn't a strong suite of mine and I never got into using RSS feeds either so I don't have a good reference point for how (or if at all) people keep up with development updates. I'm usually in a discord server for projects where I've wanted to give feedback. But starting a server for an app I don't known if it has 15 users or 50 feels weird.

So: do you follow any app for development updates at all, and if so, where? And if you're a dev, what's worked for you?

Forgejo's Web UI provides a nice ssh link like ssh://git@code.example.com/user/repo.git

The issue is what if code.example.com points to a reverse proxy? In my setup, I have a wildcard DNS *.example.com that points to my Caddy reverse proxy. Caddy at least is only for HTTP(S) traffic. So how would SSH work in this instance?

My Forgejo runs in docker and has port 222 open mapped to ssh in the container. What I'm curious about is how a site like Github manages to use the same hostname github.com for both it's web UI (HTTPS traffic) and the ssh links it provides for repositories. Anyone have a similar set up that has this working?

I've been thinking, what is the best OS and setup for "home theatre PC" in your opinion?

Right now I'm using Bazzite (because it's simple, just in case other people need to use it) with desktop icons to apps, smb directories, and websites of my server utilities. There's also a shortcut to Moonlight that can WoL and connect to my gaming PC.

It's functional, but having to use a bluetooth keyboard and/or bluetooth remote from the couchis a chore, especially if a house guest wants to use it.

I want to test out SteamOS or Plasma Bigscreen, since they've both become available lately, but while they give a better UX, their functionality is not as diverse as my current setup.

So, yeah, did you also have a similar issue and how did you solve it?

I built ShieldCompare, a VPN comparison matrix. The reason it exists: VPN review sites are affiliate-driven, so this one has no affiliate links and reshuffles the provider order on every visit. But mostly I want to share the front-end build.

Stack

• Next.js 16 (App Router) / React 19
• Tailwind CSS v4
• Framer Motion 13 for layout transitions
• Fully client-side filtering over a static JSON dataset of 48 providers — sub-millisecond updates, no API round-trips

Parts that were interesting to build

• True LTR/RTL parity: switching to Arabic swaps to the Cairo typeface and inverts every hard shadow (8px 8px → -8px 8px) plus the spring push/hover transforms along the X axis
• Neo-brutalist design system: 6 swappable contrast palettes via CSS custom properties, persisted in localStorage
• AnimatePresence + popLayout grid/list reflow with spring physics
• Sticky composite header with zero layout shift during mobile scroll
• Live: https://shieldcompare.mobanihani.dev
• GitHub: https://github.com/Mohmd-H-BH

Happy to talk through the RTL work or the Tailwind v4 setup. Feedback appreciated.