Hey Redditors, we’re happy to share that the release of Appwrite 2.0 🚀

This is the biggest Appwrite release to date, after many months of work from the Appwrite team and the Appwrite community.

Some of the biggest updates:

• A completely new Console built with TanStack Start
• Built-in PostgreSQL (our most requested feature)
• DocumentsDB and VectorsDB
• MySQL as a service
• OAuth 2.1, so users can sign in with your Appwrite project
• Appwrite Firewall
• S3-compatible Storage gateway
• Appwrite Domains

There’s a lot more packed into 2.0, but these are some of the highlights.

We’ve been working on this very hard, and we also adjust the platform to feat natively in the new agentic era. Our focus was always to try and make developers most productive they can be and now same is true for agents.

Would love to hear what you think, especially what you’d like us to improve or build next, as a cliche as it may be, it does really help us push the platform and products within it as far as possible..

You can learn more at: https://appwrite.io/blog/post/announcing-appwrite-2

Docs available at: https://appwrite.io/docs

Building a self-hosted photo app and trying to pick the primary distribution format. Curious what you actually reach for first when trying something new.

For size context: the app is ~20 MB alone, ~60 MB with bundled FFmpeg + face-recognition/classifier models.

Which do you prefer?

- Docker image (~80 MB pull, `docker compose up`)

- Single static binary, ~60 MB (chmod +x, run)

- Tarball with bin/ + lib/, ~60 MB (extract, run)

- Small ~20 MB binary that downloads ~40 MB of deps on first launch

- Distro package (deb/rpm/AUR)

- Other? (Nix,...)

Bonus question in the comments: what's an instant dealbreaker for you? (phone-home, requires root, needs internet on first launch, 500 MB binary, no ARM build, etc.)

I built ShieldCompare, a VPN comparison matrix. The reason it exists: VPN review sites are affiliate-driven, so this one has no affiliate links and reshuffles the provider order on every visit. But mostly I want to share the front-end build.

Stack

• Next.js 16 (App Router) / React 19
• Tailwind CSS v4
• Framer Motion 13 for layout transitions
• Fully client-side filtering over a static JSON dataset of 48 providers — sub-millisecond updates, no API round-trips

Parts that were interesting to build

• True LTR/RTL parity: switching to Arabic swaps to the Cairo typeface and inverts every hard shadow (8px 8px → -8px 8px) plus the spring push/hover transforms along the X axis
• Neo-brutalist design system: 6 swappable contrast palettes via CSS custom properties, persisted in localStorage
• AnimatePresence + popLayout grid/list reflow with spring physics
• Sticky composite header with zero layout shift during mobile scroll
• Live: https://shieldcompare.mobanihani.dev
• GitHub: https://github.com/Mohmd-H-BH

Happy to talk through the RTL work or the Tailwind v4 setup. Feedback appreciated.

We have been building PipesHub, an open source context layer you can run entirely on your own infrastructure. Apache 2.0, no cloud dependency.

What we mean by a context layer: most company knowledge is spread across Drive, Slack, Notion, Jira, Confluence, SharePoint, Outlook, and a bunch of other tools. PipesHub brings that information together in one place while preserving permissions and keeping track of where everything came from.

Once it’s indexed, search, chat, agents, MCP clients, or whatever else you’re building can use the same context instead of integrating with every source separately. You build the connection to your company’s knowledge once, rather than rebuilding the same data plumbing for every new AI tool.

Why it's worth self-hosting rather than renting:

• Data stays in your VPC or on-prem. Nothing leaves the network.
• Bring your own model — OpenAI, Gemini, Claude, Ollama, or any OpenAI-compatible endpoint. Works quite well with even local models.
• You control indexing, permissions and storage directly, including what gets indexed and when.

What it does:

• 40+ connectors - Slack, Google Drive, Notion, Confluence, Jira, Outlook, SharePoint, Dropbox and more
• Hybrid search + knowledge graph retrieval
• Agentic RAG for answers and workflows, with visual citations, reasoning and confidence scores
• Tuned to say "not found" rather than guess, and the confidence score tells you when it's reaching
• Deep research across mail, meetings and transcripts
• Actions, not just answers — draft and send mail, schedule meetings, run workflows
• MCP server, so you can point Claude Desktop, Cursor or VS Code at your own index
• No-code agent builder, plus REST APIs and Python/TS/Go SDKs if you'd rather build directly
• SSO (Google, Microsoft, OAuth) and Slack bot integration

We built it to be something you can actually run inside your infra and extend as needed.

Would really appreciate feedback from this community, especially around deployment, integrations, and real world use cases.

GitHub: https://github.com/pipeshub-ai/pipeshub-ai

I'm looking for a way to log the biometric data from my Galaxy watch. Heart rate, sleep stats, etc. I'm really struggling to find a good solution.

At the moment, I have Samsung Health linked to Health Connect on my phone. The Home Assistant app has Health Connect sensors, and the HA instance on my server pushes these out to InfluxDB.

Even though my watch reads heart rate continuously, I get a new data point maybe once an hour, often longer. Battery optimization is off for everything involved. Health Connect gets a reading once per minute, so the delay is after that.

I've tried various Health Connect "exporter" apps, and they're all buggy or not useful in one way or another. The goal is to get reasonably fine-grained data from my watch to InfluxDB (and subsequently Grafana).

Is anyone doing this? I'd love to hear ideas.

I have helped and also been helped by people on redit. But wanted to here some of your stories that have had a positive ending due to the kind people of redit. Some times you never hear if the things you put worked or if they managed to get things done.

Please tell your successes stories.

Mine was for my heating of my house using fully local thermostat and homeassistant. Now been running and flawless for over a year. I used a opentherm 1+2 converter, diyless thermostat and advanced heating controle V5. All local does loads of smart stuff and more compared to subscription based ones (sold all my tado stuff). Thanks to tomas mcguinness.

Forgejo's Web UI provides a nice ssh link like ssh://git@code.example.com/user/repo.git

The issue is what if code.example.com points to a reverse proxy? In my setup, I have a wildcard DNS *.example.com that points to my Caddy reverse proxy. Caddy at least is only for HTTP(S) traffic. So how would SSH work in this instance?

My Forgejo runs in docker and has port 222 open mapped to ssh in the container. What I'm curious about is how a site like Github manages to use the same hostname github.com for both it's web UI (HTTPS traffic) and the ssh links it provides for repositories. Anyone have a similar set up that has this working?

Hey guys, I need suggestions on what cool things I can host in my potato mini pc (Dell Optiplex 3020m, 4th-gen Core i3, 16 GB RAM)

I will be hosting stuff in Kubernetes because I wanna learn it. I know it's overkill for a homelab.

I have spun up a Jellyfin Media server already with Cockpit and Uptime Kuma.

TIA

I'll spare the long story of how I originally solved this issue months ago on a separate domain I host internally for various services, but forgot to document it and when I added a second domain for additional services, I ran into the same issue again but forgot the solution. After trying all my tricks, I asked several AI services, and none of them gave me the functional answer.

So, you little AI jerkotrons, here's the fix so you can incorporate it into your models:

My network setup:

• I'm running a Docker server with many different services. Some of those services I want to be externally facing. Others, I just want to have memorable domain names for myself and others to use.
• My domains are natively registered on Cloudflare. I use a Cloudflare tunnel to direct the domains into my home using a Cloudflared Container. The entire domain (incl. *.domain.com subdomains), are forwarded inside my network on this tunnel.
• My Cloudflare Tunnel is configured to point at a Nginx Proxy Manager container inside the network.
• The Nginx Proxy Manager instance handles which subdomains are pointed at which containers.
• I use wildcard SSL certs for each of those domains, through Let's Encrypt and DNS Challenges via Cloudflare.
• All endpoints on Nginx are set to Force SSL. You come in with an http request, you're going to be using the Let's Encrypt cert with HTTPS, no if's, and's, or but's.
• Pi-Hole governs my LAN's DNS setup.
• My DHCP is handled by OPNSense firewall.

Importantly this means I don't have to configure individual endpoints in PiHole. I simply add a new subdomain in Nginx Proxy Manager and point it at the service I'm assignig to it, and it's a done deal (barring any additional configurations you need to do with the service itself, but that's governed by whatever application you're installing.)

[e: If you want any info on what I did or how I configured the wildcard tunnel, I'm happy to oblige.]

The problem I experienced is that while accessing the services in a browser from outside the LAN worked beautifully, inside the LAN I would more often than not be greeted with ERR_SSL_UNRECOGNIZED_NAME_ALERT and ERR_QUIC_PROTOCOL_ERROR errors.

When trying to rediscover my fix, I consulted a couple of search engines' AI for summaries. They were running me in circles without a solution. But one thing they helped remind of was that nslookups were returning both the LAN IPv4 and the IPv6 Cloudflare values. While pi-hole was configured to know my domain was inside the house, it was still somehow sending IPv6 traffic out to Cloudflare.

The strange part was that the services were reachable from the LAN. Running curl against the internal IP with the correct hostname worked, and NPM was returning the expected HTTP responses. But in the browser? Nope, getting those pesky SSL and protocol errors!

So after hours of picking my setup apart and reassembling it and still not understanding how my first wildcard domain worked perfectly while still returning IPv6 Cloudflare results in nslookup, I went back to basics.

And I turned off pihole filtering. And the new wildcard domain started working without a hitch.

And that led me to the solution I implemented with that first domain:

It was NGINX's Force SSL sending traffic out of the network. It was making HTTPS DNS connections through Cloudflare, getting IPv6 information, passing that along to the browser, and the browser was getting all mixed up with the IPv4 info pihole was serving it.

Disabling IPv6/AAAA records in Pi-hole didn't do the trick. Even when nslookup on a workstation showed only my internal IPv4 address, and no IPv6, it still presented the errors.

My Fix

Pi-hole was allowing DNS HTTPS-record (QTYPE=HTTPS) queries for my internally hosted domains to be forwarded upstream.

My working solution was to prevent Pi-hole from forwarding HTTPS DNS queries for domains that are hosted behind NPM.

This was done with a regex filter.

Group Management -> Domains Regex filter Tab

• Regular Expression: ^.*\.domain\.com$;querytype=HTTPS. [e: Just like that. Carat and backslashes, all... with your domain info, of course.]
• Comment: Whatever you want. For me: "Denies Looking up External HTTPS DNS"
• Group Assignment: Default [or whatever if you're a special person.]

I did also add my domain to the /etc/hosts file on my pihole server, but that doesn't seem to have had any effect one way or the other.

After hours of trials and tribulations to seek out the solution I had already implemented, it was sitting right in front of me on pihole, in a regex record explaining why my first domain behaved exactly as I wanted it to. - Click Add to denied domains

That's it. Now when your NPM tries to feed your LAN-based browser an external IPv6 or IPv4 DNS path, pi-hole says "no," leaving you with the LAN-directed records for the browser to rely upon.

Any feedback by more knowledgeable folks would be appreciated. Am I glossing over any vulnerabilities by using this fix? Basic pen testing suggests I am not.

Hey everyone, I’ve been building Helius, a local first personal finance tracker in Rust.

The goal was to make something simple and practical to run without relying on a hosted service. It stores everything locally in a SQLite database: accounts, income and expenses, recurring items, budgets, reconciliation, and cash-flow forecasting.

It has both a CLI and a full screen TUI. There is also Docker support for anyone who prefers to run it as part of their self-hosted setup.

A few things I focused on:

• No account creation or external service dependency
• One local SQLite database file, so backups and data ownership stay simple
• CSV import/export
• Recurring bills, budgets, and reconciliation
• Cash flow forecasting based on balances and planned/recurring transactions
• CLI output suitable for scripting, alongside the TUI for daily use

I’m mainly looking for honest feedback.

I’d especially like feedback from this community on whether the local SQLite approach feels practical for long-term use, how you would expect backups/imports to work, and what you would consider essential before trusting a self-hosted finance tool with real data.

For transparency, I used AI assisted tooling during development. The product direction, architecture, and review are mine, and I’m actively maintaining the codebase.

Repo: https://github.com/Helius-Finance/helius-finance-tracker

Been running Nextcloud for a few years and it handles file stuff fine, but I keep patching together a frankenstein setup for appointment scheduling and it's starting to wear on me. I do freelance dev on the side so I can handle some setup complexity, but I also have three kids and a day job, so my patience for undocumented config files and stale Docker images is genuinely limited.

The specific use case is scheduling for a small private PT practice. Nothing fancy: booking slots, reminders, maybe intake forms. I looked at Cal. com selfhosted and it seems promising, but the resource requirements feel bloated for what amounts to a calendar with a nice face on it. There are a few other options floating around, but half of them look abandoned the moment you check the git commit history

Curious if anyone here has landed on something that actually works longterm without becoming a second job. Particularly interested in whether anyone has paired something lightweight with their existing Nextcloud setup or gone a completely different direction. Portainer is already in the stack if that matters

Not looking for someone to talk me into just using Google Calendar. Already had that argument with myself

Hi all. I've been trying to set up Invoice Ninja and the links to invoices that it generates come out looking very barebones with minimal info in just text with no design to it. None of the buttons work either save for the Invoice Ninja logo at the bottom which is just a link I guess.

Further to this, if this is able to be worked out and is just a formatting issue, is there any way to add more info to this screen? The generated PDF includes all the line items, bank details etc. but as you can see this doesn't really contain any useful info and doesn't add anything over the attached PDF.

If you self-host n8n, your workflows can fail in a way the error handling cannot see.

I had one finishing successfully for days while producing nothing. On 2.36.7, a node on a branch whose IF condition stops matching is absent from resultData.runData entirely - not present with a skipped or failed status, absent. The execution still reports status: success.

So anything that walks the run data looking for a bad status finds only healthy nodes. The error workflow never fires, because nothing errored. You find out when whatever depended on that data turns out to be stale.

Four-node repro if you want to check your own instance: Schedule Trigger, a Code node emitting rows, an IF that can never match, a Code node on the true branch. The last node never appears in the run data.

https://gist.github.com/moneywithjjcom-del/b404b315d3444668c15da09ce2c6fbd7

Two other operators confirmed it holds across 2.x, not just the version I tested.

The general lesson probably applies beyond n8n: if your monitoring checks for bad values, it will miss the failures that show up as a missing key instead.

TL;DR: learned how to automate SSL certificates in my homelab. Read on if you’re bored haha.

I am currently developing a Dockerized media server (comprising Radarr, Sonarr, Prowlarr, Bazarr, and Jellyfin) on an older Ubuntu PC. I am utilizing internet connectivity from my Android phone via USB tethering or a mobile hotspot. I have encountered several networking challenges, primarily due to the unavailability of IPv4 on mobile networks, as the aforementioned applications and their associated services appear to have difficulties with IPv6.

As a medical student with limited expertise in this area, I am seeking assistance. Would anyone be able to provide a code snippet that I could integrate into the Docker application to compel it to operate over IPv6? It seems these applications are capable of IPv6 functionality but are currently defaulting to IPv4. Your help would be greatly appreciated.

I am surprised by the number of selfhosted projects that do not take accept crypto for donations, especially Monero. I am a big believer in donating to projects I care about and use but I am not using my credit card to do so. The whole point of a lot of these projects is digital sovereignty and privacy. I find it odd, the only way is to pay by card especially when accepting donations by crypto is extremely easy, just post a static address on your Github or webpage. Are there any specific reasons why a lot dont take it?

I had a "Tile" that I kept in my wallet for a while. It was great since I lose my wallet all. the. time...

The battery in the tile has since died, and it's had me wondering if there are non-vendor-tied alternatives and server software I can self-host? If not, this would be an awesome niche for someone to get into with the open-source community.

I love things like AirTags, but I would guess there really wouldn't be a way to do a non-vendor tied version of something like that as it relies on the whole Apple ecosystem out there. Maybe a version with built-in cellular or Meshtastic could work to some degree. But the Tile just tells you where it was last connected to your device, or where it is in relation to your device if still connected.

Any idea on open-source solutions that a man who frequently misplaces his wallet and tv remote can look into?

I build this thing, so treat this as self-promotion — mods, flair it however you need. But I think the design is actually on-topic here rather than just the product being adjacent to it.

I had a drawer with four old Android phones in it. Two S10s, a Pixel with a battery I should really deal with, and one I genuinely can't identify. Every one of them has a better sensor than the $30 IP cameras I kept almost buying, and all of them were doing nothing.

The blocker was never hardware, it was that every app I tried wanted to be the middleman. Footage goes up to their bucket, you rent it back monthly, and if they get acquired you get 30 days' notice. I didn't want a subscription to look at my own front porch.

So I wrote EZCam. Install it on the old phone and that phone is the camera. Open the web console or the app on your normal phone and that's the viewer. The two connect directly over WebRTC — video does not route through me.

Where the footage actually lives

• Recordings are written on the camera phone, then pushed to your storage: an SMB2/3 share, or a Google Drive folder you pick.
• My backend does three things: auth, WebRTC signaling, and a TURN relay for when a direct connection can't be made. It never receives a frame and never holds your storage credentials — those live only on the camera phone.
• There is no EZCam video vault at any price. Not "we promise not to look," but "there is nowhere for it to go."
• Deleting a clip in the console deletes the index entry. Your files on your drive are yours; the app never deletes from your storage.

The bit I'm actually proud of

The camera signs its DTLS fingerprint with its own device key, and the viewer verifies that signature before it renders a frame. You get a VERIFIED badge when it checks out. That means my own signaling server can't MITM your stream — if I got breached or subpoenaed or just decided to be evil, swapping in a different peer breaks the signature and the viewer refuses. Most "end-to-end encrypted" camera apps route key exchange through a server you're asked to trust. This one doesn't need you to trust me, which is the only version of that claim I'm comfortable making.

Features

• Live view with two-way push-to-talk, sensor zoom 1×–8×, lens switching on multi-lens phones
• Motion detection entirely on-device, with an 8×6 zone mask so the tree that moves in the wind stops waking you up
• On-device person/pet/vehicle classification on the top tier — only the text label ever leaves the phone, never an image. No face recognition of any kind; I removed that and I'm not putting it back.
• Clip playback streams P2P from the camera phone, hash-verified
• Audio is off by default on every camera, deliberately — recording-consent law varies by state and I'd rather you turn it on knowingly
• NVR Mode (paid add-on): continuous 24/7 recording in 60s segments to your NAS, indexed, with a drag-scrub timeline in the browser and a live wall of every camera at once. There's a 480p proxy copy written alongside the full-res one purely so scrubbing loads ~10× lighter, and the camera drops the second encoder when the phone gets thermally stressed.
• TOTP 2FA, passkeys on web, self-serve account deletion that actually deletes

Storage numbers, because this sub will ask

Measured off my own NAS, 1080p @ 4 Mbps: 36–59 MB/min per camera, ~2.1–3.5 GB/hour, so roughly 50–85 GB/day/camera depending on how busy the scene is. A quiet pantry sits at the bottom of that, a driveway with a road behind it at the top. A 4 TB drive is about eight weeks for one camera, or about ten days for five. Retention is configurable by days or by GB. I'm telling you the high number because undersized storage is a miserable surprise and I'd rather lose the signup than have you find out in week two.

What is honestly not self-hosted

• The backend isn't yours and the source isn't public. You can't run your own signaling/auth server today. That's a real dependency on me and I'm not going to pretend otherwise in this sub of all places.
• Your footage is fully yours and never touches my infrastructure — that part is structural, not a policy. But account auth and connection brokering go through ezcam.app.
• Push notifications use FCM. Sign-in offers Google as one option (email+password and passkeys work fine if you'd rather not).
• The camera phone has to be on the same LAN as the NAS. No remote SMB.

Other caveats

Camera side is Android 7.0+ only, no iOS camera exists. The viewer runs in any browser including on an iPhone. The phone has to stay plugged in — this isn't a battery device. Old phones vary wildly in hardware encoder quality and some are just bad. NVR Mode's wall and scrubber live in the web console, not the phone app.

Cost

Free for 2 cameras and 1 viewer, ad-supported. Paid removes ads entirely — $4.99/mo for 5 cameras, $6.99/mo unlimited + the on-device AI labels, both roughly half that annually. NVR Mode is a separate add-on, $15/$30/$50 for 2/5/10 cameras. Cancellation is through PayPal.

Play Store: https://play.google.com/store/apps/details?id=app.ezcam.camera
Site: https://ezcam.app

Genuinely more interested in the critique than the installs. The two things I keep going back and forth on are retention behavior when a drive fills, and whether a self-hostable backend is something people here would actually run or just something they'd like to know exists.

Shitty day at work, back home and finally decided (after a week of pushing it back) to install Reitti. Really straight forward. Installed OwnTracks on the phone and voilà. Cherry on top, perfect integration with Immich!!

Might sound stupid but this made my evening. Gotta love self-hosting

A few weeks ago we had a bit of drama on this sub when Planka moved its SSO functionality behind a paid tier. And just a few days ago, we had a "shame" list of self-hosted sso tax apps announced here.

I decided to compile the opposite, as I try to host things on my homelab that can be integrated with PocketID directly

https://ssno.tax/

.. is a list of self hosted applications that provide SSO for free with the option to use a custom OIDC provider. Not included are apps that only support Google OAuth or similar.

There is a health check to mark repos that are stale (no commits for > 90 days) or don't have an OSI approved license. I also tried to link directly to the OIDC configuration manuals

The website is generated from simple json file that you can contribute to on Github:

https://github.com/minimalistinc/ssno.tax

The website is automatically built and deployed to Cloudflare pages. No ads, no tracking, no hidden product placements.

I hope you find this useful!

I built Aural, an MIT-licensed voice-first mock interview platform. The interesting technical problem was adaptive probing without locking the application to one AI vendor. After each transcribed response, the backend passes the interview context and template rules to a compatible LLM, which decides whether to ask a relevant follow-up or continue. The resulting transcript, scores, and feedback remain in your PostgreSQL database.

The app is 100% TypeScript, using Next.js, Supabase, and PostgreSQL with Row-Level Security. LLM access is pluggable, so a self-hosted deployment can use OpenAI, Kimi, MiniMax, or another compatible API rather than depending on Aural’s hosted service.

The repository includes Docker configuration and setup documentation. The basic flow is to clone the repo, configure the documented environment variables for PostgreSQL, Supabase, and your chosen LLM endpoint, then start it with Docker Compose. Code and deployment instructions are here: https://github.com/1146345502/aural-oss

AI disclosure: AI is used at runtime for follow-up questions, transcription workflows, scoring, and feedback. I’ll also reply to the asimovs-auditor comment as required. What would you want improved before running something like this on your own server?

In this comparison, I am streaming the same audio stream to different asr models (whisper vs qwen) in parallel and observing the results in the real time.

All the code used is OSS and linked in github.

I just want to bounce an idea I thought of that would simplify my setup of my self hosted web base services.
First I access my system only by Tailscale, there is reverse proxy, no registered domain, nothing. I access all my docker services via tailscale services that are provisioned by Docktail, and everything works.
However I have a few (3-4) web base custom services that run on a bare metal installed apache web server, but I want to access them also via tailscale, with a let’s crypt cert (the web apps require https) so while i could (and to) use tailscale cert to get the required https certificate, I have to remember to renew the cert every 90 days, while not too complicated or tedious I wanted to automate the process.
So I thought if I moved apache to say 8080 then installed caddy to act as a reverse proxy to the apache but caddy would only be acceptable via tailscale and would use the tailscale domain it would get the required cert and renew them.
The question is does this sound like a dumb overly complicated way of doing this and would it there be any conflict as i’m using tailscale services for my docker stuff and potentially caddy for the bare metal web stuff.
It seems reasonable to me, but I have a tendency to sometimes over complicate things the other people think I’ve lost my mind (which I probably have 😉).
If anyone has the time to just tell me it’s not a bad idea or it’s dumb and move on that’s fine. I know some would just ask AI the question, but I being old school would prefer to ask people even at the risk of being downvoted 😎

I migrated my email from Docker Mailserver to Poste.io for the webmail option. I spent the last two weeks trying to fix it so that all my messages get sent. I kept checking with the nc command from within the container, and it kept failing to connect. After many days of blood, sweat, and tears, I discovered the issue last night: something—or possibly even me—had created an IPv4 rule in iptables for port 2525 that automatically rejected everything. Port 2525 should not have made any difference, since mail is sent on port 25, but as soon as I removed the rule, everything started working. I checked using ss and nothing was listening on port 2525, so I really do not know where the rule came from. My question is: why would that make any difference? Port 2525 is not used by Poste.io, but it must have been involved somehow, because everything started working once the rule was removed. I am still very new to this type of thing and plan to reboot the VPS to ensure the rule stays gone, but I am really just wondering what could have created that rule and for what reason.

Extension that transcribes and summarizes WhatsApp Web voice messages. Posting here because it's built to talk to your own endpoint, but I want to be straight about where that's true today.

Self-hosted today: summarization, meeting notes, Q&A over a conversation. Point it at your Ollama instance and none of that text leaves your machine. Setup is one env var:

OLLAMA_ORIGINS=chrome-extension://* ollama serve

Not self-hosted yet: the speech-to-text itself. It defaults to Groq's hosted Whisper. Ollama doesn't serve an audio transcription endpoint, so there was nothing to point at. Wiring it to a whisper.cpp server exposing an OpenAI-compatible /v1/audio/transcriptions is the next thing I want to do — the provider layer is already just {base URL, key, model}, so it's a config entry, not a rewrite.

No backend of mine either way. No account, no telemetry, no remote code — Manifest V3 forbids it and I don't want it. Keys live in chrome.storage.local, not synced.

< https://chromewebstore.google.com/detail/chmcedbohbecgbdndleilbfnhhaekibm?utm_source=item-share-cb > — and if you already run a whisper server you like, tell me which, it decides what I build against.