Self-hosting questions and answers

Running software yourself, on hardware or a server you control, instead of renting it as a service. In practice that means a Linux box, a container runtime and a directory of data you can copy: Jellyfin instead of Netflix, Immich instead of Google Photos, Vaultwarden instead of LastPass. The defining property is not privacy or price, it is that the upgrade schedule and the failure modes are yours. Nobody deprecates your instance, and nobody restores it for you either. Of the 105 tools profiled here, 61 run as a single container, so the mechanics are usually one compose file and one data directory.

It is worth it if you are replacing several subscriptions at once, storing hundreds of gigabytes, or if control matters more to you than convenience. It is not worth it to replace one 5 USD a month service. Year one runs 250 to 350 USD with new hardware, plus four to six hours of setup and one to two hours a month after that. The strongest honest case is data you intend to keep for twenty years: photos, documents, notes, financial records. The weakest is anything whose outage while you are away ruins someone else's evening.

Electricity is the recurring number, and idle draw sets it. A 10 W mini PC uses 87.6 kWh a year, about 16 USD at the US average of 18.34 cents per kWh, or roughly 26 EUR at 0.30 EUR per kWh. Hang a spinning disk off it and you are near 40 a year. Used enterprise gear at 60 to 90 W costs 100 to 145 USD a year, often more than the machine cost to buy. Add 10 to 15 USD for a domain and 12 to 60 USD for off-site backup storage: 40 to 100 USD a year on a machine you already own.

Add up the idle footprints of what you will run, then double it so the page cache has somewhere to live. Most self-hosted software is small: the median idle figure across 105 profiled tools is 150 MB, so ten typical containers fit in 8 GB. A short list wrecks the budget. Immich idles near 900 MB and its docs ask for 8 GB, authentik wants about 1 GB for itself, GitLab CE documents an 8 GB minimum. 16 GB is a fair light-stack target, 32 GB if photos, cameras or an identity provider are on the list.

For a light stack, yes: 95.2% of profiled tools publish official arm64 builds. What fails is rarely the CPU, it is the SD card. Containers writing logs, SQLite databases and metrics wear flash out, and the symptom is a filesystem that silently goes read-only. Boot a Pi 5 from a USB or NVMe SSD, cap Docker log size on day one, and keep constantly-writing databases off the card. The remaining gaps are accelerators: no Intel Quick Sync, Jellyfin dropped 32-bit armhf builds at 10.11, and Immich only accelerates machine learning on Mali or Rockchip NPUs.

No, and two alternatives are better. Dynamic DNS updates an A record whenever your address changes, costs nothing if your registrar has an API, and home addresses usually change rarely. Or avoid inbound addressing entirely with a WireGuard mesh such as Tailscale or Headscale, where both ends dial out and nothing is forwarded. A static IP is genuinely required only for hosting authoritative DNS or outbound mail, where a matching PTR record matters. ISPs typically charge 5 to 15 USD a month for one, usually attached to a business plan.

Carrier-grade NAT is your ISP sharing one public IPv4 address across many customers, so inbound ports are not yours to forward. Check it in two minutes: compare the WAN address on your router's status page with what an external "what is my IP" page reports. If they differ, or the router's WAN address sits inside 100.64.0.0/10, the shared address space reserved by RFC 6598, you are behind CGNAT. Mobile broadband and most satellite links are. Do not fight it: use an outbound tunnel or a mesh VPN. Native IPv6, where your ISP offers it, also routes around the problem.

You need one as soon as you want certificates that browsers trust, which is roughly immediately. A domain with DNS at a provider that exposes an API costs 10 to 15 USD a year and unlocks the DNS-01 ACME challenge, which issues valid certificates for names that are never reachable from the internet. Without one your choices are plain HTTP on the LAN or a private certificate authority you install on every device: Caddy's tls internal does exactly that, and it is fine for two devices and tedious for six.

Exposing a reverse proxy is reasonable. Exposing an application's own login page is not. Application login forms rarely rate limit, and a single pre-auth bug in any one of them is a foothold on your LAN. If something must be public, terminate TLS at Caddy or Traefik, put Authelia or an equivalent gate in front, and keep the app on an internal network. Know also that publishing a container port bypasses ufw entirely, because Docker writes its own iptables chains: bind to 127.0.0.1 and proxy. For everything else, a mesh VPN removes the question.

For remote access, a WireGuard mesh is the default answer, and it replaces port forwarding rather than supplementing it: both ends dial outward, nothing inbound is open, and it works behind CGNAT. Tailscale is the least effort, Headscale runs the control server yourself at 40 MB idle, and wg-easy is plain WireGuard with a web UI at 90 MB. This is a completely different thing from a commercial privacy VPN, which routes your traffic out through someone else's network and does nothing to help you reach your own server.

It is one process listening on 443 that terminates TLS and routes by hostname to services on internal ports. Yes, from the second service onward. It is what turns http://192.168.1.20:8096 into https://media.example.com, and it is the only clean answer to port collisions: in this index 19 tools default to 8080 and 11 default to 3000. Caddy is the recommendation at 25 MB idle, with automatic certificate renewal and a five line config file. Caddy vs Traefik covers when Docker label routing is worth the extra moving parts.

Use containers. Installing directly means you inherit every dependency conflict, and two applications wanting different PHP or Python versions on one host is an ordinary Tuesday with no clean uninstall. Docker Engine costs about 120 MB of idle RAM for dockerd plus containerd and scores 2 out of 5 on operational load, which makes it the cheapest insurance available. Two tradeoffs to accept knowingly: anyone in the docker group is effectively root on the host, and you are trusting whoever publishes the image. Pin tags rather than tracking latest on anything with a database schema.

Start with Docker, because every guide you will read assumes it and docker compose is a real implementation. Podman is the better engine once you are comfortable: no resident daemon, rootless by default, about 40 MB idle, and Quadlet turns a container into a proper systemd unit with dependency ordering and journald logging. Two things to know before switching. podman compose is a wrapper that shells out to docker-compose or podman-compose, so files leaning on profiles or depends_on conditions behave differently. And since Podman 5.0 the default rootless network is pasta, which changes how containers reach the host. Docker vs Podman.

No. Every problem Kubernetes solves arrives with several machines, several operators and a requirement for automated failover. On one box it inserts a control plane, an overlay network and a storage abstraction between you and a directory of files, and it turns a five line compose file into three YAML objects. Even k3s on a single node is a scheduler you now administer and upgrade, at about 2 GB idle. Revisit the question at three or more nodes with a second person on call. Until then, Compose plus a systemd timer covers everything you actually need.

In two halves. Quiesce anything with a database first, using pg_dump, mysqldump, sqlite3 .backup or the app's own export command, then snapshot the tree with restic or BorgBackup to storage you do not control. A working nightly job is restic backup /srv --tag srv followed by restic forget --tag srv --keep-daily 7 --keep-weekly 4 --keep-monthly 12 --prune. Then restore something, because that is the only step that proves the rest worked. Add a dead man's switch ping so a job that quietly stops running raises an alert.

No, and treating it as one is the most common structural mistake in home storage. RAID protects against exactly one failure: a drive dying while the array is otherwise healthy. It faithfully replicates rm -rf, ransomware, a corrupt write, a failing controller, a power supply that kills several disks at once, and a house fire, to every member instantly. ZFS or btrfs snapshots are considerably better because they hold history and catch mistakes, but they still live on the pool they protect. A backup is a copy in another place that an error on this machine cannot reach.

OS security patches automatically: Debian's unattended-upgrades restricted to the security channel is a fair default, because security-only updates are not meant to change behavior. Containers on a schedule you choose, where monthly is fine, after reading release notes for anything holding a database. Do not automate container updates for stateful applications, whatever the updater's marketing says. The exception that overrides the schedule is a CVE in something you expose to the internet, which should be a short list if you put a proxy and a VPN in the right places.

Sometimes, and the breakage clusters in predictable places. Nextcloud cannot skip a major version. Headscale cannot skip minor versions. Uptime Kuma's v1 to v2 heartbeat migration is one way and took about 7 minutes for 20 monitors with 90 days of history, longer on slow hardware. wg-easy shipped no v14 to v15 upgrade path at all. Immich does not support downgrades. Pi-hole v6 renamed every Docker environment variable. Read release notes for anything with a schema, snapshot before major versions, and pin image tags.

Nothing, for a while, and then it becomes a security problem. Archived software keeps running and stops getting fixes: File Browser was archived on 2026-09-01, and MinIO's repository is archived with the community console gone. Your protections are structural. Prefer tools whose data you can read without them (SQLite files, plain Markdown, ordinary photo directories), prefer projects with more than one maintainer, and treat an archive notice as a 6 to 12 month migration deadline rather than a change of status. Forks happen (Forgejo from Gitea, Seerr from Jellyseerr), but a fork is a new project, not an upgrade.

Rarely by enforcement, often by engineering. Most consumer terms of service prohibit running servers, and what actually bites is technical: outbound port 25 is blocked almost everywhere, some ISPs block inbound 80 and 443, and CGNAT removes port forwarding as an option entirely. None of that touches outbound-initiated access, which is the practical reason a mesh VPN or a tunnel is the robust design rather than a workaround. A business line with a static IP, usually 5 to 15 USD a month more, lifts the restrictions if you genuinely need them lifted.

Running open source software on hardware you own is legal essentially everywhere, and so is serving it to your own household. Three edges matter. Copyright applies to what you store and share, and an automated media pipeline does not change that. If you process other people's personal data outside a purely household context, data protection law such as GDPR applies to you as the controller. And copyleft licences cover 44.8% of this index; the AGPL ones oblige you to offer source to users over a network, which for a family instance is satisfied by linking to the upstream project.

Named accounts, never a shared login, and lower your expectations of single sign-on. Only 50.0% of the 90 profiled tools with user accounts have native OIDC, and 31.1% offer no external identity integration at all. The workable pattern is Pocket ID or Authelia for the apps that speak OIDC, local accounts elsewhere, and one password manager entry per person. Then do the unglamorous parts: a status page so people check before messaging you, an agreement about which services are load-bearing, and a written note on reaching the data if you are unavailable.

One container, a data directory you can read with ls, and something you use often enough to notice within a day when it breaks. linkding (90 MB idle, port 9090, one SQLite file), Navidrome (70 MB, port 4533, read-only against your music) and Vikunja (70 MB, tasks with CalDAV) all qualify. The purpose of a first service is to run the whole loop once: deploy, proxy, back up, restore. Not photos, not passwords, not household DNS, because those punish a learning mistake permanently rather than annoyingly.

Email first and hardest. Deliverability is a reputation system you cannot join quickly: Google requires valid forward and reverse DNS on the sending IP and a spam rate under 0.3%, and outbound port 25 is blocked on most consumer connections. mailcow: dockerized and Stalwart are good software and a bad primary mailbox. Beyond that: do not make yourself the single point of failure for other people's critical systems (household DNS on day one, the only family calendar, the door lock), and never put the credentials or one-time codes you need to fix the server behind a service running on that server.

Four to six hours to build the first server properly, then one to two hours a month in steady state: applying updates, reading release notes, confirming backups ran. Add one genuinely bad evening a year, and a half-day migration whenever you change hardware. What dominates the number is what you picked. A stack of ops-load 1 and 2 tools is close to unattended, while Nextcloud, Home Assistant and Proxmox VE each want real attention. 13.3% of this index scores 4 or 5 out of 5 for operational load.

Not disk failure. In rough order: a backup that was never restore-tested and turns out empty, incomplete or locked behind a lost passphrase; copying a live database file, which 81.9% of the 105 profiled tools cannot tolerate; docker compose down -v or docker volume prune deleting a named volume nobody realized held the data; a sync tool propagating a deletion exactly as Syncthing's own FAQ warns it will; and emptying an application's trash, which in Immich deletes your originals. One habit prevents all five: restore something, monthly.