HN Reader

Self-Hosting like it's 2025

221

229

I love the idea of self-hosting, especially since I keep a number of very tiny websites/projects going at any given time, so resources would not really be too much of an issue for me.

What stops me is security. I simply do not know enough about securing a self-hosted site on real hardware in my home and despite actively continuing to learn, it seems like the more I learn about it, the more questions I have. My identity is fairly public at this point, so if I say the wrong thing to the wrong person on HN or whatever, do I need to worry about someone much smarter than me setting up camp on my home network and ruining my life? That may sound really stupid to many of you, but this is the type of anxiety that stops the under-informed from trying stuff like this and turning to services like Akamai/Linode or DO that make things fairly painless in terms of setup, monitoring and protection.

That said, I'm 110% open to reading/watching any resources people have that help teach newbies how to protect their assets when self-hosting.

16 days agoby 0xEF

Last thing I need is Kubernetes at home

16 days agoby bauerd

I'm slowly configuring my new VPS. Here's approach I'm taking:

1. RHEL 9 with Developer Subscription. Installed dnf-automatic, set `reboot = when-changed`, so it's zero effort to reliably apply all updates with daily reboots. One or two minutes of downtime, not a big deal.

2. For services: podman with quadlets. It's RH-flavoured replacement for docker-compose. Not sure, if I like it, but I guess that's the "future", so I'm embracing it. Every service is a custom-built image with common parent to reduce space waste (by reusing base OS layer).

So far I want to run static http (nginx), vaultwarden, postfix and some webmail. May be more in the future.

This setup wastes a lot of disk space for image data, so expect to order few more gigabytes of disk to pay for modern tech.

16 days agoby vbezhenar

I am actually worried about the self-hosting pandemic. We self-hosters will stop flying under the radar. Wonder how long it will take until our matrix instances require to be backdoored, our immich are scanning our pictures with AI.

On an unrelated note, an article of how to rent a VPS in China would be interesting :)

16 days agoby TrayKnots

I am going to continue to stan for dokku for hosting web apps, docker images included

https://dokku.com/

16 days agoby terminalbraid

I've been through just about everything to get where I am and I've ended up with Hashicorp Nomad and Consul with Traefik, managed by OpenTofu (open-source Terraform).

Things that haven't worked for me:

- Standalone Docker: Doesn't work great on its own. Containers often need to be recreated to modify immutable properties, like the specific image the container is running. To recreate the container, you need to store some state about how it _should_ work elsewhere.

- Quadlet: Too hard to manage clusters of services. Podman has subtle differences to Docker that occasionally cause problems and really tempting features (e.g. rootless) that cause more problems if you try to use them.

- Kubernetes: Waaaay too heavy. Even the "lightweight" distributions like k3s, k0s etc. embed large components of the official distribution, which are still heavy. Part of the embedded metric server for example periodically enumerates every single open file handle in every container. This leads to huge CPU spikes for a feature I don't care about.

With my setup now, I can more or less copy-paste a template into a new file, tweak some strings and have a HTTPS-enabled service available at https://thing.mydomain.mine. This works pretty painlessly even for services that need several volumes to maintain state or need several containers that work together.

16 days agoby Youden

I tried portainer once, it looked nice and had a lot of features... for which I had no use. I always found `docker compose` much easier to use, it is often just an alias and a tab away, where for portainer I would have to open a browser tab and sometimes even touch my mouse!

Otherwise good article. If you want to go rootless (which you should!), Podman is the way to go; but Docker works rootless too, with some modifications [1]. I have found Docker rootless to be reliable and robust on both Debian and Ubuntu. It also solves permissions problems because your rootless user owns files inside and outside the container, whereas with rootful setups all files outside the container are owned by root, which can be a pain.

Also, you don't need Watchtower. Automatic `docker compose pull` can be setup using standard crontab, see [2].

[1]: https://du.nkel.dev/blog/2023-12-12_mastodon-docker-rootless...

[2]: https://du.nkel.dev/blog/2023-12-12_mastodon-docker-rootless...

16 days agoby Helmut10001

If you self host, do not use containers and all those things.

Just use a static site generator like zola or hugo and rsync to a small VPS running caddy or nginx. If you need dynamic thing, there are many frameworks you can just rsync too with little dependencies. Or use PHP, it's not that bad. Just restrict all locations except public ones to your ip in nginx config if you use something like wordpress and you should be fine.

If you have any critical stuff, create a zfs dataset and use that to backup to another VPS using zfs send, there are tools to make it easy, much easier than DB replication.

16 days agoby kuon

My peace of mind comes from my self hosting in 2025 looking the same as my self-hosting in 2005 (except a move to systemd). I haven't even re-installed my workstation OS since 2006 or so.

16 days agoby megous

This article motivated me to upgrade my hosting approach.

I've been running a DigitalOcean VPS for years hosting my personal projects. These include a static website, n8n workflows, and Umami analytics. I used manual Docker container management, Nginx, and manual Let's Encrypt certificate renewals. I was too lazy even to set up certbot.

I've migrated to a Portainer + Caddy setup. Now I have a UI for container management and automatic SSL certificate handling. It took about two hours.

Thanks for bringing me to 2025!

16 days agoby crivlaldo

Still running everything from my basement using FreeBSD jails and shell scripts.

Sacrificing some convenience? Probably. But POSIX shell and coreutils is the last truly stable interface. After ~12 years of doing this I got sick of tool churn.

16 days agoby cullumsmith

As a non-developer, I find it difficult to step into the self-hosting world. What I recommend for people like me is the service PikaPods [1], which takes care of the hard part of self-hosting.

I have now switched from some SaaS products to self-hosted alternatives:

- Feed reader: Feedly to FreshRSS.

- Photo management/repository: Google Photos to Imich or Imgich (don't remember).

- Bookmarks: Mozilla's Pocket to Hoarder.

And so far, my experience has been simple and awesome!

[1] https://www.pikapods.com

16 days agoby pentagrama

This is a great introduction to self-hosting, good job OP. As some of the other comments mentioned, discussion about self-hosted security and the importance of back-ups would be good to include. Also, you link to some great resources for discovering self-hosted applications, but it would be interesting to hear some of the software you enjoy self-hosting outside of core infrastructure. As I'm sure you're aware, self-hosters are always looking for new ideas. :)

16 days agoby smjburton

Self-Hosting like it's 2025...uhhgg...

Don't get me wrong I love some of the software suggested. However yet a another post that does not take backups as seriously as the rest of the self-hosting stack.

Backups are stuck in 2013. We need plug and play backups for containers! No more roll your own with zfs datasets, back up data on the filesystem level (using sanoid/syncoid to manage snapshots or any other alternatives.

16 days agoby FloatArtifact

The only thing that holds me back for self hosting is Postgres. Has anyone managed to get a rock solid Postgres setup self managed? Backups + tuning?

16 days agoby hankchinaski

I’ve been self hosting small web apps using an SSH service https://tuns.sh and it helped me replace my DO droplet pretty successfully. What’s nice is it also has built-in usage analytics, alert notifications when a tunnel goes down, and fully manageable with a remote TUI which means I don’t have to install anything to use it.

16 days agoby qudat

I feel like I’ve been plugging it way too many times... but if you’re looking for a more humane alternative to Portainer, check out my project, Lunni: https://lunni.dev/

(Docker Swarm only for now, though I’m thinking about adding k8s later this year)

16 days agoby notpushkin

I can self host many applications, but their security must be outsourced to a company. I don’t have time to keep on top of vulnerabilities.

Cloudflare Tunnels is a step in the right direction, but it’s not end to end encrypted.

The question is then, how to secure self hosted apps with minimal configuration, in a way that is almost bulletproof?

16 days agoby aborsy

I recently discovered Beszel (https://github.com/henrygd/beszel) for monitoring all my homelab servers. It's quick, easy, and has a very clean and intuitive interface. Works especially well running inside of containers on hosts. I also wrote a very quick guide on getting it running inside of Kubernetes at https://github.com/henrygd/beszel/discussions/431.

While it's not nearly as powerful as say DataDog, it provides the core essentials of CPU, memory, disk, network, temperature and even GPU monitoring (via agent only).

16 days agoby nodesocket

I host tons of web-facing apps behind a reverse proxy. I used to have it all running in a swarm cluster with several underlying vms but decided to move everything to Unraid a while back for simplicity.

Would highly recommend.

https://unraid.net

16 days agoby zephyreon

Lol that's hilarious, the url resolves to https://localhost:1313/posts/self-hosting-like-its-2025/, how ironic!!

16 days agoby drKarl

It sure is self hosted! https://localhost:1313/posts/self-hosting-like-its-2025/

16 days agoby captaincrunch

Does anyone have any experience with coolify? https://coolify.io/ I am considering switching the hosting of my online games to it.

16 days agoby oliwary

What about Kamal? https://kamal-deploy.org/ Did anybody here use it for anything that is not a Ruby on Rails app?

16 days agoby rullopat

For our startup, I decided we’d self-host as much as possible. We have one server in our office with Traefik for “firewall” and SSL termination, and our backend services are handled by Incus. Our only paid services are Tailscale and Postmark. We run things like forgejo and mattermost for our internal development work, as well as things like elasticsearch and kibana for observability into our products (100ish embedded devices distributed globally). So far so good.

16 days agoby tvaughan

If any self hosters are burnt out by the state of config management tools and YAML, consider giving Etcha a shot (https://etcha.dev).

It's stateful (cleans up things when they're no longer in your config), procedural (you control the flow and can trigger things as needed), and supports flexible deployment models (push or pull). Full disclosure, I created it and use it across my business and personal devices.

16 days agoby candiddevmike

Proxmox on a NUC. Separate RPI running HaProxy to route requests. Public 443 forwards to haproxy. All on separate vlan from home network. Router allows ssh across vlan for specific IPs. Ssh only available from the specific IPs. Some of the VPS on proxmox run Nebula protocol (like tailscale but self hosted) and there is a lighthouse on a $2 VPS. This allows me to access specific resources only from mesh network when away from home.

16 days agoby dismalpedigree

Still "rsync"ing the result of "hugo build" to a subfolder on a shared webhost. Works like a charm, hope it will do so forever. :-D

16 days agoby martin_a

I think the reasons not to self-host are the difficulty of implementing any type of dynamic scaling. For instance when clicking on this article I get a result that their site is down. Instead of benefiting from the traffic their engagement got them, they are crashing.

16 days agoby TimPC

Nah, that doesn't look fun. Self-hosting in 2025 should look like Yunohost or Sandstorm.

16 days agoby ValdikSS

Cockpit-podman can be an interesting Podman-centered alternative to Portainer et al.

16 days agoby q2dg

I recently came across another new one that looks really nice - Canine [0].

I haven't tried it myself yet. Has anybody else given it a spin?

[0]: https://canine.sh/

16 days agoby johnmw

just want to say that, to self host feels like the 2000's, and that's a refreshing good thing, you feel in control, away for all the enshittification we are experiencing right know. I'm having a blast with a group of friends with netbird/tailscale, creating little projects in our forgejo instance with full CI/CD for the infra, and day by day we are adding more and more stuff, our own little internet. we learn things and talk about technical stuff while setting up and implementing them, its my favorite social network now. also f big tech.

16 days agoby ltr_

I found this which is kind of hosted self-hosting: https://www.pikapods.com/

16 days agoby drKarl

This site redirects to localhost:1313. Is this some sort of April fool's joke that I'm not getting?

    $ curl https://kiranet.org/self-hosting-like-its-2025/
    <!DOCTYPE html>
    <html lang="en">
      <head>
        <title>//localhost:1313/posts/self-hosting-like-its-2025/</title>
        <link rel="canonical" href="//localhost:1313/posts/self-hosting-like-its-2025/">
        <meta name="robots" content="noindex">
        <meta charset="utf-8">
        <meta http-equiv="refresh" content="0; url=//localhost:1313/posts/self-hosting-like-its-2025/">
      </head>
    </html>

16 days agoby mr_mitm

Sandstorm.org has picked back up the pace of development recently, and is an excellent platform wrt sharing securely between multiple users

16 days agoby spencerflem

I tell you the real problem with self hosting: people using monospace fonts for body text.

16 days agoby James_K

i really like this software-centric approach, but I am a bit stuck when it comes to the hardware. Are there some sources around servers that don't suck up too much energy and are fairly quiet? What CPU is a good all-round solution?

16 days agoby jagermo

Funny how the author doesn't give a single link in the post. The reader has to go searching, spend time to find the things the author writes about. Well, a simple example: Awesome-Selfhosted. Is it that hard to give a link? Is it some kind of phobia or religion that doesn't allow direct links on the internet? Really? Come on, it's hypertext! Where are the hyperlinks?

16 days agoby espdev

some notes: - uptime kuma scales very bad, even with just 20 entries - Docker/Kubernetes is a trap, use something more suitable for a home lab like NixOS

16 days agoby SuperSandro2000

This seems overkill. You only need a Pi. I have a Pi4 fanless running:

1. lighttpd exposing a website, using letsencrypt and a cron job to run certbot and restart lighttpd.

2. mox (https://www.xmox.nl) to run a mail server, with PTR records set up by my ISP. I am not with a CG-NAT ISP else none of this would be possible. mox makes it easy enough to set up DMARC and SPF etc. with appropriate output given that you can add to your DNS records.

3. I grab the list of IPs from https://github.com/herrbischoff/country-ip-blocks and add them to an iptables list (using ipset) every week so that I can block certain countries that have no legitimate reason to be connecting, with iptables just dropping the connection. I think I also use https://github.com/jhassine/server-ip-addresses to drop certain ranges from cloud servers to make annoying script kiddies go away.

4. peer-calls (https://github.com/peer-calls/peer-calls/) to be able to video call with my family and friends (with a small STUN server running locally for NAT traversal as I recall).

5. linx (https://github.com/andreimarcu/linx-server) to share single links to files (you can get an Android app to upload from your phone)

6. filebrowser for sharing blocks of files for users (https://github.com/filebrowser/filebrowser).

7. pihole runs on it so blocks adverts.

8. Wireguard runs on the Pi and I open the VPN ports on my router. I use the VPN on my phone so adverts are blocked when I am out and about (traffic gets routed through the Pi).

9. navidrome runs on it and I use subtracks on Android to stream (or just download albums for when I have spotty connection).

10. mpd runs on the Pi and it plays music to some speakers in the house, so I can control it with M.A.L.P on Android.

11. I use goaccess (https://goaccess.io) to look at my server logs and see what is hitting me.

12. I use maxmind geoip data so I know which countries are hitting me.

13. minidlna runs on the Pi so I can stream films to my TV.

14. I run CUPs on it too so that my rubbish wireless Samsung printer can be printed to from Android and my wife's Apple devices without having to buy an AirPlay-compatible printer.

15. xrdp running so I can log into a visual desktop on the Pi if required.

My router doesn't expose SSH ports, just appropriate ports for these web services and the VPN. SSH keys are useful. SSH is not open to the world anyway and you have to VPN into the network first.

This all sits happily and quietly in a cupboard and uses a feeble amount of power.

16 days agoby 72deluxe

Nice blog! following.

16 days agoby gaeb69

Muh kube

16 days agoby lambdadelirium