Self-Hosted Main
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
For Example
- Service: Dropbox - Alternative: Nextcloud
- Service: Google Reader - Alternative: Tiny Tiny RSS
- Service: Blogger - Alternative: WordPress
We welcome posts that include suggestions for good self-hosted alternatives to popular online services, how they are better, or how they give back control of your data. Also include hints and tips for less technical readers.
Useful Lists
- Awesome-Selfhosted List of Software
- Awesome-Sysadmin List of Software
A password manager because if anything goes wrong, you'll be completely screwed.
What you SHOULD absolutely self host though is a password manager, so you can be in control of your most sensitive data.
Regarding email, I think everyone should absolutely self host it, but it's less and less viable in this google/Microsoft duopoly world. But ideally everyone would self host it. The reason why people advise against it really comes down to lack of real competition, and the two tech giants dictating how we violate every RFC possible.
A password manager because if anything goes wrong, you'll be completely screwed.
What you SHOULD absolutely self host though is a password manager, so you can be in control of your most sensitive data.
Wot?
Okay I understand that email hosting is bad for SENDING email , but what about only RECEIVING email , isnβt it a good idea to keep my stuff private ? I rarely send personal emails, and like to avoid my data being used for marketing purposes Is that bad to have smtp imap open on dynamic ip address ? Just asking your opinion
Passwords:
-> You want to have immediat access to them, even if your house burns down
Notes:
-> You want to be able to read the documentation how to fix your selfhosted service, even when your selfhosted services are down
Public Reverse proxy:
-> A reverse proxy is only as safe as the applications behind. And NO, most selfhosted-applications are not hardened or had security audits
(reverse proxy with a forward authentication proxy is something different)
In my opinion, cloud storage for (zero knowledge) backup. Your backup strategy should include a diversity of physical locations. I had a house fire a few years ago. Luckily, my data drives survived, but if they hadn't, my cloud backup would've been invaluable.
Don't host your own email server.
Just trust me.
Meh, been doing it for 5 years now with minimal issues. Had one issue come up where my domain was flagged as malicious, but was solved in a few days and some emails to security vendors.
I think it's important that those who can, and are educated enough to keep it running properly do host their own. Hosting your own email should be encouraged if capable because it helps reduce the monopoly, and keep a little bit of power for those who want to retain email privacy.
I agree with KN4MKB. I've been hosting my own mail server for decades. Not one issue. I use that in lieu of a mail service provider (Google immediately comes to mind), as their EULA service agreement will tell you that - since you're using their service, on their servers - anything goes. Read the fine print on Gmail, and you'll see. π
I did it anyway some time ago and I'm really happy with it. I'm using my own email addresses for absolutely anything by now.
I'd say backups. At least it shouldn't be only local. I follow the rule of threes: two local copies and one off site with backblaze. Yeah, it ties up a not insignificant amount of disk space I could use for other things, but dammit, I'm not loosing my wedding photos, important system configurations, etc.
Primary backups
People saying email, look into using external SMTP servers as relays. Your domain most likely comes with at least one email account with SMTP access. You can use that as a relay to send personal/business emails from your server using the provider's reputable IP addresses.
Internet-accessible authoritative DNS nameserver(s) (unless you have a completely static public IP).
Personally I don't think it's worth hosting recursive dns resolvers. Most of the options with ad blocking are single points of failure and when it breaks the household acceptance factor is just too low.
Just....set up two RPIs with Pihole instead of one? Chances are your router can have a fallback DNS. Sure, you have to update the rules in both places, but honestly it's not a big deal, and you now have redudancy.
I'm running 2 powerdns recursors and authoritative servers, and 2 piholes (long story why so many), and none of them have failed on me so far, and when I took one of them offline, I didn't notice anything because the other took over. And if anything REALLY fails, I'll just switch my router back to using cloudflare or Google or quad9 temporarily, and at least Internet access will be restored so people can at least browse the internet.
Pihole also has an API and a home Assistant integration, so you can create an AdBlock toggle switch for others, in case it blocks something and they need immediate access. Not ideal, but it's a doable workaround.
This is really something that's super easy to self host, and mitigate if something goes wrong. Especially since that commercial router is already a single point of failure for most households.
The login page to your NAS.
Not really an option when I'm providing file hosting services to a bunch of my friends.
If your NAS is properly updated, and SSL is used, then the login screen it just as safe as any other web app with regular updates. I would ask why someone would want that.
I think there's a hangup on the term "self-host" where some people are assuming it's going to be exposed to the Internet.
I self-host a ton of stuff that is only available inside my home network or through my VPN, which is not publicly discoverable. I would never open a TCP port to the world from my home network. That's how you end up on shodan.
So yeah, if it has to accept inbound connections from arbitrary other systems on the dirty internet (email, mastodon, etc), it's not happening on my network, and probably not at all because it's a pain in the ass to stay patched.
Aside from other stuff mentioned here about email. I always assumed I'd become a target for spam that I'd have a harder time filtering out to the point it stops being worth it to have a custom email address.
That and I can almost guarantee I would end up screwing up the backup of my inbox and losing everything rending the whole endeavour pointless.
I don't self host anything where it would impact me unduly if it went down while I was on holiday to the point where I'd have to break state and go fix stuff.
I don't want to have to leave my beer or beach and head off to fix things like an email server, restore a password manager db etc. so anything like that which is critical to the point where an outage would prob have me do so means I pay someone else.
Mail server or anything using RDP.
6 u6
Push notifications.
It is fine hosting a service that gets requests then talks to FCM or the iOS version. But a service that one's phone stays connected to 24/7 is really hard, and not kill one's battery.
email service
I'm doing it on a bm I rent for 10 years now without issues with spf, dmarc, dkim and everything from scratch (no docker bloat)
Docker is the antithesis of βbloatβ.
Docker is horrid for duplication. Unless you use a filesystem with good deduplication, docker can hurt a lot on your storage. and even then it still can just not work often due to due to already deduplicated extent stuff
Email. I always recommend AWS SES. Use it at as an SMTP relay and any internal services gets restricted access through IAM.
If self hosting from home.. email servers
At home, your IP is likely blacklisted and/or your provider has blocked the necessary ports. Not to mention the layers of potential headaches dealing with potential spam block dbs, especially if you don't own your IP.
You can of course do custom setups allowing you to skirt these restrictions, but can sometimes be a bit complicated and typically involve non-traditional customizations.
E-Mail.
And maybe unpopular opinion:
-
Any service that you use with port-forwarding, besides WireGuard.
I would never access any self-hosted application without VPN. -
Password manager. I want to minimize complexity with my most important data (that's why I'm using KeePass instead of Self-Hosted Bitwarden).
Plex. Despite everything be supposedly self hosted, they are spying on what you're watching and sharing that info with 3rd parties, your friends and your family.
Use Kodi instead or if you're old school like me, an old fashioned smb share running on a pi.
I agree with the sentiment but Kodi isn't really a direct replacement for a plex server, it's a client replacement. You want Jellyfin or at least a mysql backend for Kodi to get the shared watched status and such.
Child porn, obviously
Clearly opening RDP port on internet. NEVER.
What do you mean by "clearly". Open RDP without password protection?
I often use RDP to access my desktop Windows 10.
The password isn't enough. It's not a hardened protocol and vulnerabilities are found in it with some regularity. There have been unauthenticated RCEs before, ie nightmare scenario.
I have a load balancer on my network that has opened one port on my home network. The load balancer is connected over the cloud flare and is encrypted on both sides. Is that okay?
Why you chose to open a port, if you use cloudflare? Couldn't you use cloudflare tunnel in that case?
Mail is a waste of time, and it's take the risk to don't receive important mail in time.
Password manager. While some may cache on your client devices, by and large if your server goes down, no passwords.
Vaultwarden with SyncThing is a robust combo from what I hear. Everything is local.