I discovered Incus and IncusOS recently, and they seem like a very cool foundation for a self-hosted setup.

I'm thinking of using them with incus-compose to declare my setup.

Does anybody use them? I'd love to get some feedback. Are they stable and polished yet, or are there still a lot of sharp edges?

They mention "designed for modern systems" on their website. Are there any issues running it on a roughly 10-year-old laptop?

I came across the link via https://mastodon.social/@CuratedHackerNews/117481600704689796

Last time I touched php it was ~20 years ago and maybe for a month. Could someone with actual php understanding weigh in?

Somehow, somewhere between the lines, my understanding was that there have been observances of the vuln being used in the wild before the 14 UTC. And that wasn't from reading news sites

Ive checked all my self hosted services and was happy to find out the only one was written in PHP, addy, formerly anonaddy.

You can use the awesome self hosted GitHub repo or this one already filtered for PHP

https://awesome-selfhosted.net/platforms/php.html

While you should probably take some services offline altogether, FreshRSS has an update out.

Just one of many updates that we're going to be seeing over the next few hours / days.

For those who haven't seen it yet

https://therecord.media/php-script-vulnerabilities-warnings

Hundreds of websites taken offline as concern grows over two PHP vulnerabilities

https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities

I'm currently running a bunch of services behind a reverse proxy and that proxy is configured to use let's encrypt for ssl certs using DNS-01 challenges for renewals. All of the services are configured to only work using Tailscale IPs, so, as far as I'm aware, none of the services are open to the internet, except for port 80.

I noticed if I don't leave port 80 open, when it's time for renewal, everything fails. This leads to a bunch of logs on my Unifi setup saying intrusion attempts have been blocked on port 80. I thought I could go to Let's Encrypt's website and find a list of IPs I could put on an allow list but they don't post those. So my questions are:

1. If I understand the process correctly, Let's Encrypt checks the DNS TXT record to verify I own a domain, then sends a new cert to my server over port 80; meaning, I have to have port 80 open during the renewal process, correct? Nope

2. If that's correct, what do you all do about port 80? Do you just have a script to open the port during the renewal process and close it afterwards or do you just leave it open all the time? Is there maybe a tool that already has this functionality? not if using DNS-01 challenges

3. I think I have port 443 open as well but I don't remember if that's needed or if I just did that when I opened port 80 trying to get all my services working again. Does 443 need to be open too? not if using DNS-01 challenges

4. If there is a better way to do all this or if I fucked up somewhere, please share. This was just the first setup I got working. I fucked up, see below

Thanks

EDIT: After deleting the current certificate and going through the process of generating a new one, everything is working without port 80 open. I'm using NGINX Proxy Manager and I must have clicked on "Lets Encrypt via HTTP" and not "Lets Encrypt via DNS" when originally setting this up. Not sure how else this could have happened 😅

Update your stuff, folks. I've had a fun day at work.

Hi everyone,

I am new to self-hosting and this is also my first post on Lemmy. I have a navidrome instance for my music (installed via docker compose) and a jellyfin instance for movies and shows (also installed via docker compose) running on a Raspberry Pi 4 8GB. I know I could also use music over jellyfin but I prefer to have it in navidrome.

The next thing that I want to achieve on my journey through the world of self-hosting is to run my own matrix server. The ideal eventual goal would be to have my own server on that same Raspberry Pi which I can then use to bridge Whatsapp to so I finally can get rid of that App from my primary phone. Receiving Whatsapp messages is unfortunately necessary for me to keep contact with certain people, although I would prefer to get rid of it completely as well, but who am I telling that, there are plenty of people out there facing the same issue.

As Whatsapp needs to run somewhere, which is required to have the bridge properly working, it would ideally run in an Android Virtual Device although that is no requirement as I know physical phones are recommended and emulated devices get blocked more often.

Ideally, the matrix server would also be installed using docker compose. It is intended to have one user only which is me but should of course be able to communicate with other servers to enable me to talk to others. The main limitation is that all three services should be running on that Raspberry Pi at the same time.

As my experience regarding such a project is virtually zero, my questions are:

Is such a setup is feasible and generally a good or bad idea (considering running jellyfin, navidrome and matrix on one Raspberry Pi)?

What issues should I consider before starting such a project?

If there's someone having a similar setup, what are your experiences?

Also important to note: The matrix server should be able to handle video and voice calls as well, not in large rooms of course, but rather in a context of 2 to 4 people max.

Any advice, information or personal experience is well appreciated! I want to properly inform myself before starting out and thought here might be a good starting point. If I forgot to mention any specific information that is needed please let me know.

Thanks a lot!

EDIT: Adjusted post title to better reflect the advise-seeking character of this post and adjusted question phrasing

Hey everyone! I'm completely new to self-hosting, but I've become convinced of its benefits and would like to get started in the near future. I'm still trying to figure out which hardware and software would be the best fit for my needs, so I'd really appreciate some advice.

What I'm looking for:

• I live in the EU and want to move away from US-based and other non-EU cloud providers, which is one of the main reasons I'm interested in self-hosting.
• I want to de-Google my digital life and replace services like Google Photos, Google Drive, and Google's contact and calendar syncing with self-hosted alternatives.
• I'd like to automatically back up photos from my phone, sync files, contacts, and calendars, and access everything remotely.
• I want to avoid proprietary operating systems and vendor-specific apps as much as reasonably possible, ideally relying on open-source software.
• (Eventually, I'd also like to consider hosting my own email server, although I've heard that this comes with quite a few challenges. This isn't a priority for now.)
• I don't want to become a Linux or server administration expert just to keep everything running.

A little more context:

• Users: Just two people.
• Workload: Mainly file storage and syncing, photo backups and management, contacts, and calendars. No video editing, media transcoding, or other particularly demanding tasks.
• Budget: Around €500–800 for the NAS itself, excluding storage drives.
• Hardware preference: I'd prefer a compact, reasonably power-efficient, ready-made NAS rather than building a full PC, mostly due to limited space.
• Technical experience: I've been building my own PCs for almost 30 years and consider myself an advanced Windows user. However, my last real Linux experience was with Ubuntu about 20 years ago.
• Internet connection: 250/40 Mbps DSL with a public (dynamic) IPv4 address and a FRITZ!Box 7590 router, which supports WireGuard VPN.

Here are my main questions:

1. Which operating system would you recommend? I've been looking into TrueNAS Community Edition and OpenMediaVault, but I'm open to other suggestions. Ease of use, stability, and low maintenance are important to me.
2. Would a prebuilt NAS be a good choice? I've been considering devices like the UGREEN DXP4800 Plus and TerraMaster F4-424 Pro. Can their proprietary operating systems be replaced with something open-source without losing important functionality, such as fan control, power management, or hardware monitoring? Are there particular models known to work especially well with TrueNAS or OpenMediaVault?
3. How much hardware performance do I actually need? Given my relatively modest requirements, would something like an Intel N100 already be sufficient, or would it make sense to invest in a more powerful CPU and additional RAM for future flexibility?
4. Which software stack would you recommend? I'm currently considering Nextcloud for files, contacts, and calendars, and possibly Immich for photos. I'd prefer solutions with reliable automatic syncing and open-source Android apps.
5. What should I consider regarding backups and remote access? I'm planning to use WireGuard for remote access, but I'd be interested in recommendations for a simple, reliable backup strategy as well.

I'm happy to learn new things and follow technical guides, but I'd prefer a system that doesn't require constant tinkering once it's set up.

Thanks for reading, and I appreciate any suggestions or experiences you're willing to share!

The set of vulnerabilities is dubbed PHP2Shell and disclosure is scheduled for 14:00 UTC with attacks expected to follow soon after.

It is adviced to take offline every non-vital services until the patch has been installed (or the Docker image has been updated with a patched version of PHP)

Update: fix is out https://www.php.net/archive/2026.php#2026-10-21-5

Is duck DNS really down or is it just for me? Downdetector shows its up. I can't access from firefox, can't ping it or curl it.

My vailtwarden server uses duck DNS to issue a certificate and use https but recently I've been having trouble using since duckdns is almost always down.

Edit: turns out my pihole was blocking it. I have no idea why but some of my adlists added duckdns in the blocklist.

Hey all, recently I was doing some work on the machine where I host my plex and audiobookshelf servers and I noticed that there were 3 new devices listed in the disk manager.

All 3 of the new devices have a description along the lines of "78MB Loop Device" and lists a backing file at location /var/lib/snapd/snaps/snapd_22291.snap (not exactly but they're all similar to this). They show as unmounted and I'm not really sure what this is.

Additionally when I try to use libation to pull my latest audible books down it says it can't read my local file location folder.

I recently saw the post about the plex vulnerability (which is part of why i was doing work on it, to make sure that my auto update was working) when I noticed this and it got me worried.

Are these new devices that showed up indicative that a malicious user has accessed my system through the internet and has setup a crypto miner to run in the background on my server or is it more likely that a disk is failing and this is the first sign?

Also before anyone feels the need to say it, I know that plex is not ideal and jellyfin is better, but I have remote users that I cannot talk through troubleshooting to get jellyfin when I can tell them to just install plex on their end.

Any help would be greatly appreciated

Edit: Solved! Thanks a ton non_burglar.

Good day selfhost gang!

I'm redoing my media stack and I've come across a conundrum that I can't solve on my own. I've got Docker containers on the same Debian machine for qbittorrent, sonarr, and radarr for automatic media downloading. The problem is, as you may have guessed from the title, I need to implement remote path mapping in sonarr/radarr because qbittorrent downloads to a different location than where my media files are hosted. My media is hosted on a network share, mounted at /home/marighost/gilashare/media (which is further broken into subfolders for media types). On this machine, however, I've got my qbittorrent downloading to a 2Tb SSD at /srv/data/torrents. Here are the volumes as presented in my compose.yml files:

qbittorrent:  
    volumes:  
      - /home/marighost/docker/seedbox/gluetunconfig:/gluetun  
      - /home/marighost/docker/seedbox/qbittorrentconfig:/config  
      - /srv/data/torrents:/data/torrents  

sonarr:  
    volumes:  
      - /home/marighost/docker/arrstack/sonarrconfig:/config  
      - /home/marighost/gilashare/media:/tv  
      - /srv/data/torrents:/data  

radarr:  
    volumes:  
      - /home/marighost/docker/arrstack/sonarrconfig:/config  
      - /home/marighost/gilashare/media/movies:/movies  
      - /srv/data/torrents:/data  

All three applications work mostly as expected (radarr can grab a release from an indexer, throws it into qbittorrent to download), but it does not move media into the /gilashare subfolder.

Obviously, I get the error in both sonarr and radarr that tells me: You are using docker; download client qBittorrent places downloads in /data/torrents but this directory does not appear to exist inside the container. Review your remote path mappings and container volume settings.

Here is how my remote path mapping looks in the settings of sonarr/radarr:

Host: qbittorrent  
Remote Path: /srv/data/torrents/  
Local Path: /data/  

I was messing around with radarr initially, and also tried appending /movies to the ends of the Remote and Local paths to see if it needed the full path, but that didn't seem to work either. I've also read through Trash Guides, but the information there seems outdated (all references to images are just... not there). I've also read radarr's docs, but I feel like I'm missing something, and they just link to Trash Guides anyway.

Thanks for reading, happy to dig into my configs or setup more if necessary.

Hoping the brain trust can help.

Single reverse proxy? No issues at all. If I add multiple per some instructions on the caddy forums, nothing works - the docker container just continually reboots with no errors in the log.

Caddyfile:

fmd.domain.ca {
    reverse_proxy 10.179.200.199:8080
}

llama.domain.ca {
    reverse_proxy 192.168.3.199:3000
)

With only the fmd entry, works fine.

Does anyone have a solution for a cheap remote KVM? All the solutions I've found are around $100 and I don't want to spend that much.

I might even settle for a portable KVM if it's really cheap.

I have a laptop and an Android tablet that I could repurpose, if that helps at all.

This looks interesting - would you use a virtual video store to browse your self hosted media?

The update got released over 2 months ago. So sensible admins should not be getting hit by this.

Also I use Jellyfin btw.

Hey selfhosters!

I’m Priveetee, the creator of TypeType.

TypeType is an open-source, self-hostable video app for YouTube, NicoNico and BiliBili. No ads, no trackers, no sponsors, no recommendation feed. You run it on your server, and your watch data stays there.

Why it exists

I wanted to watch YouTube without ads and sponsors, so I tried Piped in 2024. It worked well for a while, then the bugs added up and the experience no longer fit what I wanted. I considered contributing upstream, but my vision for the app was too different. So I started TypeType instead.

That was a lot of testing, failed attempts and late nights. Today it is a small community project with more than 450+ stars on GitHub, a web app, an Android app and regular releases.

What it does

You get search, trending, channels, comments, playlists and subscriptions across the three services. Your history, subscriptions, playlists, favorites, watch progress and settings live in your own PostgreSQL. Change device, log in, and pick up where you left off.

There is also allow-list filtering. You can choose which channels and playlists are available for the whole instance or for specific users, which helps with family use.

TypeType is an ecosystem, not a YouTube frontend. The stack includes a Kotlin/Ktor server, PostgreSQL, Dragonfly, a media proxy, a token service and a downloader with Garage storage.

Self-hosting

The stack uses Docker and prebuilt images, so there is nothing to compile. The recommended install is one interactive command:

curl -fsSL https://raw.githubusercontent.com/TypeType-Video/TypeType/main/scripts/install-stack.sh | bash

The installer prepares the Compose files, generates the secrets, picks free ports when needed and sets up Garage so downloads work. It asks before pulling images and starting services. If you prefer to review everything first, there is a --download-only option and a manual Compose guide that explains each step.

One detail worth knowing: HOST_PORT_SERVER changes the port on your host, not inside the container. The server and its health check stay on 8080 internally.

Around 2 GB of RAM is comfortable for a small instance, and the first account you create becomes the admin. The app and frontend are MIT, while the server is GPL-3.0 because it uses PipePipeExtractor.

Why NicoNico and BiliBili

YouTube alone would have been simpler, but TypeType is built around PipePipeExtractor, and I spend a lot of time learning how PipePipe and its extractor work. NicoNico and BiliBili are part of what makes PipePipe different from NewPipe. Supporting them is my way of respecting that work and where the project comes from.

The community

TypeType stopped being just my project a while ago. People open issues, send PRs, test beta builds, translate the app and the docs, and share ideas. Some of the best parts of TypeType started that way. Huge thx to everyone involved, this thing is ours :)

Translations are always welcome. I could run them through AI, but I have no way to review the language-specific details, and I’d rather not ship a translation I can’t stand behind. So if you speak a language and want to help, it’s yours. Feedback is welcome too, good or bad.

Links

Quick Start: https://typetype-video.github.io/Docs-TypeType/self-hosting/quick-start
Manual Compose setup: https://typetype-video.github.io/Docs-TypeType/self-hosting/docker-compose
Configuration and ports: https://typetype-video.github.io/Docs-TypeType/self-hosting/configuration
Troubleshooting: https://typetype-video.github.io/Docs-TypeType/self-hosting/troubleshooting
Translations: https://translate.typetype.video/engage/typetype/
Source code: https://github.com/TypeType-Video/TypeType
PipePipeExtractor: https://github.com/TypeType-Video/PipePipeExtractor
Experiment instance: https://experiment.typetype.video/

AI use disclosure

• Implementation: 70% Generated
• Testing: 60% Pair
• Documentation: 60% Pair, the rest by me and the community
• Review: 70% Pair
• Design: 0%
• Deployment: 0%

I've got a modest homelab setup: a couple computers and a server with the pfsense router pointing all DNS queries to my pi hole on a Pi Zero W. The server exposes a few services via cloudflare tunnel. It's been working pretty well.

Then I started setting up a server for a friend. It's a big repurposed server board running proxmox and will eventually have a handful of VMs and LXCs, all on a network. It's for his business, so I'm setting up Netbird on it for his half-dozen employees to be able to access it for fileshares and stuff. I'm connecting my Linux desktop, too, so I can do sysadmin for him.

The trouble is that domain name resolution is getting hairy between my pihole and his netbird. Since it's not my network, I can't add my pihole as a DNS resource, but I do need to keep a connection to his network.

Anyone have any wisdom to share as to how to handle this properly and still be able to use my pihole for DNS filtering in my house?

Been looking for a nice ZFS UI for my NAS after ditching TrueNAS for PBS. This is developed by a former TrueNAS/iXsystems employee and looking pretty good. Set it up and it's pretty intuitive and helpful.

AI has been used for the UI but not the backend if I got it right (there's a rant about that in the README).

Small thing but it got me last week. I relay my stream to twitch through nginx-rtmp on a cheap VPS, and one morning unattended-upgrades pulled a new systemd, needrestart restarted nginx (and postgres, and everything else) and the stream dropped. OBS reconnected fast but twitch counted it as two streams.

default timer is 06:00 UTC + up to 1h random, which is exactly when I stream lol. moved it with a drop-in:

# systemctl edit apt-daily-upgrade.timer
[Timer]
OnCalendar=
OnCalendar=*-*-* 13:45:00 UTC
RandomizedDelaySec=15m

the empty OnCalendar= matters, without it you just add a second time and keep the old one.

anyone else got bitten by this?

I want to try out some things with a secondary domain. I’d prefer ethical and non-shady providers. I have a fixed IP and a VPS to go with it, so it’s really only about the domain. A subdomain of my current domain is not enough. A subdomain of the provider would be OK but not ideal.
Even paying very little is not an option right now - maybe later.

Doing some preliminary research, the keyword seems to be Dynamic DNS even if I have a static IP. There are providers but those that pop up easily do not instil much confidence.

I want to hear the Fediverse's opinions! I haven't found any recent posts about this.

TIA

So I've been running a home media server with the arr suite on it, but it only has about 2 tb storage. The storage has been full for a couple months now which has rendered my server useless. Now I've bought a used nas with 32 tb on 7 disks. I've been advised to set it up in RAID. I've learned how to do that in OMV and it's setting that up now.

It takes a while though, so that leaves me some room to think. Why do we do this? I understand that it gives me more unified storage, but I also want to run other things on this machine. Like k8s to deploy my own applications and play around with devops stuff. Or even just regular file storage and photobackup next to the films and series. I thonk I would like to keep those things seperate though, is that still possible with RAID? Or is it better to put 5 disks in RAID and keep the other two for other stuff? I think my question is, how do you use RAID "practically"? How do you store different things on there? Do you compartmentalize the disks again, or do you just make different folders?

tinyfeed is a CLI tool that generates a webpage from a collection of feeds. It's dead simple: no database, no config file, just a CLI and some HTML.

This release focuses on making tinyfeed a more stable and deterministic program. A stable experience is always better for users, and it also allowed us to design a new snapshot-based test suite, so regressions are much less likely to slip through.

It also included a bunch of fixes related to the --order-by option that was added in the previous release and was, sadly, quite full of bugs 😬.

Main items on the menu today:

• Stable ordering: Feeds and items now come out in the same order on every run.
• Discoverable sorting: --help now lists the values --order-by accepts: publication-date, update-date, feed-name and author.
• Lighter dependencies footprint: upgrad to gofeed v1.5, which removes 6 indirect dependencies.
• Lots of refactoring and a brand new test suite.

And the cherry on top: tinyfeed now publishes an Atom feed, so you can follow its releases! WHY DIDN'T I THINK OF THIS EARLIER? A FEED FOR TINYFEED!

AI Disclosure:

• Implementation - Pair: I like directing IA when I have a refectoring in mind. On new feature I prefere avoiding it. I find that using IA for feature mean I spends less time time using the software myself during dev and then I miss the bugs.
• Testing - Hint: the new integration tests suit is 100% me, but the new unit tests are often generated by IA then reviewed / refactor by me.
• Review - Pair: for contributions it's 100% myself, I don't have much MR but I take a lot of time to review them. For my own code, as im a solo maintenr, the IA is the only one giving me reivew.