Heads up to anyone hosting applications based on PHP that a pair of vulnerabilities (CVE-2026-109618 and CVE-2026-109619) are receiving emergency patches on 2026-10-21 at 14:00 UTC. Both have CVSSv4 scores of 9.2 and are rumored to affect all versions of PHP.

More details are available here: https://cert.europa.eu/publications/security-advisories/2026-018/

CERT-EU strongly recommends identifying PHP-based applications and preparing to patch as soon as fixed versions become available. Where immediate remediation is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix can be applied.

I just wanted to let you know, both Immich and Paperless-ngx (two of my most favorite selfhosted apps) are now at version v3.3.3.

(I know, I have too much time on my hand)

Eight SSL Intermediate Certificates of eMudhra have been publicly leaked. All your servers https traffic can be broken right now. Browsers are fine as they have revoked the certificates but as you can see, curl and many other libraries still accept those.

Proof of concept and check if you are affected: ``` curl https://q3k.google.com --resolve 'q3k.google.com:443:135.181.235.221'

q3k.google.com

oh, this is bad

```

No download can be trusted right now. Remember to not only patch your main systems but every docker container you run.

Edit: The intermediate certificates where not really leaked, rather the CA used only 8 bit of randomness. One of the keys was literally "4". Check the comment here to learn more: https://www.reddit.com/r/linux/comments/1xau81w/comment/19re642t0zxa8/?utm_source=fucktracking Here is a list of the keys: https://mastodon.catgirl.cloud/@49016/117474217042191790

There have been a few reports of old Plex servers getting popped by Plex2Shell in the last few days (miner + proxy). Mine got hit too, but it dropped a DDoS bot instead.

Internet kept dropping Sunday night/Monday morning. Plex was being told to flood other people and maxed out our upload every time. Our upload is pretty poor, so it was obvious. With better upload you may not notice at all.

I was on 1.43.0. I run staged updates, get ntfy alerts for new images, and Plex was deliberately held. In May 1.43.1 broke direct play on our Samsung Frame, Plex acknowledged the bug, so I pinned VERSION= to the last good build with a weekly reminder to retest. The reminder only checked whether the Samsung bug was fixed. It never flagged that 1.43.3 was a security fix, so the hold kept me on a vulnerable version.

If you hold back any app for a bug, make sure security releases still get your attention.

FYI:
- in from 94.154.43.88 on 32400, then called back to it on 8952
- /tmp/.pxb (its own curl/wget), /tmp/.px_7c1e
- bot at /tmp/.spid (self-deletes, shows as "cron"), copy at /var/tmp/kworker + kworker.sh
- C2 176.65.149.82:48101, backup hand.genddos.st
- plain text orders like `!ATK 179 udpplain 80 53 len=1400`
- sha256 a654ffc9ea1d3af1cb07feeefe8ee078a0faaaf60b31aa20cfbe082d6c22696c

Look for a Plex child process called "cron", junk in /tmp or /var/tmp in the container, or TranscoderH264Options in Preferences.xml that's present but empty. The hunt script at github.com/code-zm/plex2shell is worth running.

Fixed with 1.43.4, a container rebuild and blocking the IPs. Change your Plex password too, it steals the owner token.

(Mods, could we get a "Security" flair?)

Doska is a kanban board web and desktop app that supports offline file storage (folders with .md files) or self-hosting a sync server. When there’s a sync server, collaboration features are also supported.

The self-hosted setup includes versioned Docker containers for the web server and the sync server.

It looks good on mobile (PWA), and I’ve put a lot of work into making it fast, responsive and pleasant to use.

There’s no login gate or any other kind of gate: it’s fully MIT open source.

GitHub: https://github.com/romenkova/doska
Live demo (no signup): https://app.doska.sh/d/welcome?skip_onboarding=true

Features

• Offline-first, local-first
• Markdown editor: syntax highlighting, tasks with a counter, slash menu
• Server to sync boards across devices
• Accounts: members, shared boards, public boards
• Local folder sync: boards and columns as folders, cards as Markdown files
• Attachments: files, images
• SSO: OIDC-compatible auth providers
• Deadlines, priorities and sorting for cards on the board
• MCP server
• Cross-board deadlines view
• Quick note window: always on top, opened with a keyboard shortcut
• Tags
• Assign users to cards
• Activity history view

Hey everyone!

Exactly one year ago, I posted my project here when it was still called AltSendme. It was a small, early-stage project with around 50 GitHub stars. The support and encouragement I received from this community genuinely motivated me to keep building it.

Since then, the project has grown to almost 10,000 GitHub stars, and I've renamed it DashBeam. It's been quite a journey, and I wanted to come back and share what's changed.

DashBeam is a free, open-source, peer-to-peer file transfer application built on Iroh. The idea is simple: transfer files between your devices without uploading them to a cloud storage service first.

A few things I've added since my original post:

• Android app: DashBeam is now available on the Google Play Store, so you can transfer files between your phone and other devices.
• Self-hosted relay infrastructure: You can run your own Iroh relay on a VPS using Docker Compose or flydotio, configure it in DashBeam, and even enable access controls. Self-hosting guide
• Nearby device discovery and pairing: Discover and pair devices on your local network for a more seamless transfer experience.
• Web app: Don't want to download or install anything? You can use DashBeam directly in your browser.
• Portable versions: Prefer not to install software? Portable builds are available for supported desktop platforms, too.

For some real-world numbers, we've tested transfers of up to 452 GB in a single transfer, with peak speeds reaching 125 MB/s under suitable network conditions.

The project is still fully open source under AGPL-3.0, and it doesn't require accounts or include usage tracking or ads.

GitHub: https://github.com/tonyantony300/dashbeam

I'm still actively developing it, and there's plenty left to improve. If you remember the original AltSendme post, thank you for being part of the journey. And if you're discovering it for the first time, I'd genuinely love to hear what you think, especially from people running their own infrastructure.

Thanks!

I feel like there’s a point where adding more services stops being fun and just becomes another thing to maintain.
Lately I’ve been leaning toward keeping things simple. Fewer moving parts, less troubleshooting, and ideally stuff that just works without me checking on it every other day.
Anyone else gone through a phase of simplifying their setup after spending years adding more to it?

Overleaf subscriptions can be expensive, especially for research teams. For institutions and labs that need a privately hosted online LaTeX editor, Overleaf Community Edition is a useful starting point, but it leaves out many features those teams rely on.

That’s why we built Ayakaleaf Pro(https://github.com/ayaka-notes/ayakaleaf-pro). We’ve extended the Community Edition with nearly all Pro features and additional integrations, bringing a more complete collaborative writing environment to your own infrastructure—free and open source.

Features include:

- Two-way GitHub sync, including GitHub Enterprise.
- Two-way GitLab sync, including self-hosted GitLab, currently in early preview.
- Two-way Dropbox sync, currently in early preview.
- Git access to clone, pull, and push your projects.
- AI chat assistant for editing LaTeX and fixing problems.
- Compile-error assistant to explain errors and suggest fixes.
- A per-project MCP server that lets AI agents edit, compile, and comment.
- Python script runner within your projects.
- Zotero and Mendeley integration with OAuth.
- Advanced reference search.
- Track changes and full project history, with restore and download.
- Pandoc import/export for Word, Markdown, and LaTeX.
- Template gallery and math symbol palette.
- SSO through LDAP, SAML, and OAuth.
- Admin panel for managing users and projects.
- Sandboxed compilation with selectable TeX Live images.
- Configurable compilation time limits.
- Optional self-registration with email-domain restrictions.
- Support for both x86_64 and ARM.

The source code is available on GitHub, along with a Playground that lets you try Ayakaleaf through GitHub

Codespaces:

https://github.com/ayaka-notes/ayakaleaf-pro

We also maintain a dedicated documentation site with installation instructions, configuration guides, integration setup, and upgrade notes:

https://ayakaleaf-pro.ayaka.space

If you’re running Overleaf for your lab or institution, we’d love to hear about your setup and what you’d like to see next. Feedback, bug reports, and contributions are welcome!

Some of Ayakaleaf’s features build on work from Overleaf CEP, another community project worth checking out. Both projects extend Overleaf’s self-hosted capabilities, and we’re grateful to the CEP contributors for their work. We’re all helping make the Overleaf ecosystem better for the community.

Bitwarden is introducing a dual-licensing model. Starting with the next release, official app store builds will use a commercial license, while GPLv3 versions remain available on GitHub.

According to Bitwarden:

• Existing features remain available in both versions.
• Self-hosting and forking remain supported.
• Future features may be exclusive to commercially licensed builds.
• The free plan remains unchanged.

The main concern for me (and probably others in this community) is the potential divergence between the open-source and commercial versions over time.

Source: https://community.bitwarden.com/t/published-version-update-in-app-stores/102750/41

At work I was asked by a different team how we can deal with bots, because someone in my team remembered that I knew how to do it.

I reluctantly suggested Anubis because I got shit for it last time, This is the URL https://anubis.techaro.lol

This is the 2nd and last time I will ever recommend Anubis anywhere at work to deal with bots because of how unprofessional, un-serious and weird others perceive it.

The mascot being a ~10 year old "cutsie" anime cat girl is weird in a work setting.

https://preview.redd.it/cmnq08d0w6vh1.png?width=859&format=png&auto=webp&s=7ef07e064a955398f34b3e20eb32bb87e6d6fd51

I will never put myself in a situation again where I have to explain that it's not weird to anyone again, same for that URL.

What is a professional looking open-source alternative to Anubis?

Hey all, happy Wednesday.

Self-hoster, same as most of you. Pi-hole, mattermost, home automations, a Zeek sensor, a dozen Linux boxes and, like everyone (I expect), a /var/log I almost never open unless I'm actively troubleshooting something. But this year’s avalanche of CVEs has been sitting in the back of my head for a while: “if something got in here, would I even know?”

So I went looking for a tool and found a gap instead. There’s good ol' grep on one end and a full SIEM on the other, and not much in between for just a guy and his stuff. I ended up making my own. It’s called sigwood and is at 1.1 as of today.

What it does: point it at logs you already have (Zeek, Pi-hole/dnsmasq, syslog or journald, CloudTrail if you have any cloud stuff) and it runs a handful of statistical detectors over them. Outbound connections with a beacon rhythm, DNS names that look machine-generated, port scans, big transfers out, odd TLS setups, rare syslog lines and reboots, that kind of thing. There’s also a digest command that just profiles a log file so you know what’s in it before you do anything, and a graph command that animates your conn.log as a Sankey flows in a self-contained HTML file (second screenshot).

What it is not: not a SIEM, not an agent, nothing to deploy. No database, no daemon, no account, no network calls. pipx install sigwood, then sigwood /var/log/, and read the output. Your logs stay on your box.

A “finding” is something unusual for your network, not known-bad. There's no signatures or anything like that. On a home network it mostly finds your own stuff first. And that’s sort of the point, you get to see what your network actually talks to and then allowlist the normal stuff. When it finds nothing, the conclusion is that the network is behaving like itself during that window.

The AI part, up front: I wrote the original implementation of the detectors and have used AI to assemble it all into working tool. Claude and Codex both together in a propose/challenge harness I made for them, with me reviewing and steering. This wouldn't exist without AI, I’m not going to pretend otherwise. And some of you will bounce off that, which is entirely fair. But I'm a security professional and a privacy nerd, never been a SWE.

Anyway, the repo is here: https://github.com/helixmap/sigwood

I genuinely want feedback, good or bad. If you run it on your logs and it gets something wrong, I want to hear about it. If the output is confusing, tell me that too. If you think the whole idea is misguided, I’d still rather hear it than not.

First screenshot is an example HTML report (no real network data). Second is a still from the graph animation.

Sometimes I see the crazy homelabs people post here, with full racks, enterprise hardware, beautiful cable management... and then I look at my collection of old office PCs lol.

I thought I'd share how I got here because I feel like self-hosting can look a lot more expensive and complicated than it actually needs to be.

My first server was literally a crappy old computer my high school gave me for free.

I knew pretty much nothing about Linux, networking or servers. I just installed Ubuntu, discovered Docker and decided I wanted to get Jellyfin running.I had absolutely no idea what I was doing. I was asking AI to explain commands, Docker Compose, permissions, why things weren't working... basically learning by breaking stuff and trying again.

Eventually Jellyfin worked. Then I wanted my own cloud storage, then a music server, then something for my books, and somehow there's always another service you want to try. And that's how one old PC eventually turned into this mess of 52 services. 😂

The funny thing is, my hardware is still pretty basic.

My main NAS is a second-hand Dell Optiplex 7050 with an i7-7700 and 32GB RAM, running Ubuntu and Docker Compose. I've got another Optiplex with an i5-8500 and 16GB for Proxmox, and a little i3 machine dedicated to Home Assistant. My desktop handles the local AI stuff. Most of my services run on the NAS: Jellyfin, Immich, Navidrome, Kavita, Forgejo, Syncthing, Pi-hole, the *arr stack, and a bunch of others.

I also ended up getting into development and started making some of my own self-hosted apps. The screenshot is actually a dashboard I've been building to organize everything because managing that many services was becoming a bit ridiculous.

Honestly, the most expensive part of all this has been storage, not the computers. I've got a 16TB HDD now, and storage and backups are still the parts I'm trying to improve.

If there's one thing I'd recommend to anyone wanting to start, it's buying a used office mini PC. You can find some for under €100, and they're more than capable of running a surprising number of services. You really don't need a rack or expensive hardware. Even a terrible old computer is enough to start learning.

Anyway, I'm curious about how other people's setups evolved.

Are you still running everything on cheap second-hand hardware, or did you eventually move to proper server equipment ?

And what was your very first server ? I'm wondering how many of us started with some random old PC and ended up going completely overboard. 😅

What do you use it for, and what maintenance has it needed? I'm interested in services that earn their place over time.

First time I’ve seen a dev beg people to stop paying them. Anyone know what’s going on, lol?

For years my 365 family subscription was the most expensive subscription I held onto because of the 1Tb per family member storage in OneDrive.

First I had a €30 increase. Now M$ anounced the shittiest of enshitifications: a 1Tb limit shared across all 5 family accounts. In return I would get AI clippy in their shit products which I already avoided all together.

I only need to create a cranny on my trueNAS server to mitigate the slight inconvenience.

I switched to Linux because of the abysmal windows updates. I embraced my homelab and self hosted LLMs. Now I'm leaving M$ for good.

Good riddance.

GitHub: https://github.com/Termix-SSH/Termix
Docs: https://termix.site/
Discord: https://discord.gg/jVQGdvHDrf

Hello,

Yesterday was the official release of Termix official + community plugins. With the changes in this and last week’s update, all primary functions of Termix have been moved to plugins, and a small UI redesign came along with it.

If you’re not familiar, Termix is a free, open source, self-hosted server management tool that is now built on plugins. The core keeps your hosts, credentials, users, sharing, sessions, etc. Everything else, like the SSH terminal, remote desktop (VNC, RDP, Telnet), file manager, Docker, and metrics, is a plugin you can turn on, off, or remove and re-download. You can even develop your own and let others install them through a plugin browser. It runs on web, desktop, and mobile. You can think of it as a free (no bullshit) version of Termius. We are trusted by tens of thousands of homelabbers and many companies as well.

A full list of all plugins and what they do can be found here: https://docs.termix.site/plugins

As for why this decision was made, here are a few reasons:

• The community voted in favor of plugins
• Improved security
• Easier maintenance
• Cleaner UI (remove features you don’t need)
• Faster loading times
• Update only what you need + automatic updates, even with Docker
• Custom plugins

However, the most important change is the eventual reduction of AI usage in this project. Previously, many PRs would be opened on the main Termix repository adding massive features or changing huge components, and they were clearly AI generated. As a developer, it was difficult to just close those PRs knowing how much time it would save to just merge them. Not to mention the dopamine hit of having another user add such a huge feature to the app without me having to do it at all. With plugins, people can generate all the AI plugins they want without other users being impacted by AI generated code.

Of course, I’m also guilty of using AI in this project (especially recently). I highly suggest reading my comment below for more information. Many of you may remember a time when Termix was fully written by humans, but that hasn’t been the case in recent updates (I’d say around v2.3.0 with the UI redesign is where things changed). That’s mostly because the feature set of Termix has moved outside my areas of expertise. A lot of the terminal and file management code is still handwritten by me or my partner, because that’s what we’re most interested in, most skilled at, and have the most fun writing. However, features like the remote desktop integration or network topology tend to contain a lot of AI generated code, since they were requests from other people and not necessarily within our original interests for the project. That code is still reviewed by humans, but it does tend to reduce the overall quality of the project.

This has also started to affect my interest in working on the project. Even though you get a dopamine hit watching AI do something that would have taken you hours, it’s so temporary. I got super burnt out working on previous versions, became very uninterested in the project, and started working on other things. I also started to lie a lot about AI usage in the project because I was ashamed of it, knowing I could have done it all without AI (I’ll talk about this more in the comments too). My hope is that with this plugin system, we’ll be able to spend more time writing code with AI as just a useful assistant and working on the features we actually want to add, while letting the community build what they want without us having to intervene and spend time decluttering AI generated code. Anyway, rant over.

In case you’re curious about how community plugins are reviewed, it’s pretty simple. First, they’re reviewed by Qwen3.6 (a local AI model running on AWS servers, so the AI isn’t trained on whatever garbage gets sent in, and to reduce prompt injection). This is just to save reviewers time by filtering out obvious malware. It’s only the first step. Once a plugin is approved by the automated system, a human (most likely me, to be honest) will review it and do a quick test. Then it’s deployed and shows up in the in-app store within 20 or so minutes. If a developer pushes an update, it goes through the same process. As of now, no community plugins have been published yet since the system just launched.

Official and community plugins can be updated with a single button press in the UI. If you are concerned about security, you can read more here: https://docs.termix.site/configure/security (essentially all downloaded plugins are crypto-graphically signed using a central private key which is then verified by the server + the file signature is checked)

What’s next:

• Creating a professional set of videos for all 34 official plugins
• Removing the external guacd requirement
• Allowing plugins to create custom UI themes and layouts
• Multiple new plugins (database editor, simple backup system, proxy manager, and some networking tools I built for my homelab that I find useful)
• Offline version of the mobile app

It’s taken about 3 months, or hundreds of hours, to get to this point with the plugin system, and I’m very satisfied with how it came out. I’ll probably take a bit of a break to focus on some other things, but I’ll be back shortly, hopefully re-motivated. Growth has also been super slow recently (which is my main motivation, getting people to switch from paid services), so hopefully something comes out of this post. If your a content creator, feel free to reach out to me before developing a video or article, like many others have done in the past. Feel free to post this to other subreddits as well.

If you have any issues or feature requests, please please please don’t post them here unless it’s just a question. It’s super hard to keep track of them in a Reddit post, so I highly encourage you to open a GitHub issue on the main repo, and AI will triage it for you.

I really hope you enjoy this update. A lot of work went into designing the UI to be user friendly while also looking good and professional! I posted this super early for me, so I’m going back to bed, but I’ll respond to comments later.

Thanks everyone,
Luke

I've been using Plex for years, and I'm getting increasingly frustrated with the direction this company is heading.

Tonight, I went to use Watch Together, a feature my girlfriend and I use almost daily to watch shows when we're apart. It was working just minutes earlier, and suddenly it was gone from my Google TV.

Apparently, Plex decided not to carry Watch Together over to its redesigned app. A perfectly functional feature that people actually use was simply discarded.

This is textbook enshittification and arguably a form of shrinkflation. Plex continues raising prices while removing functionality. We're paying more and getting less.

I run my own Plex server. I pay for the hardware, storage, electricity, bandwidth, and maintenance. Plex provides the software, yet somehow they keep finding ways to make that software less useful.

And before anyone suggests downgrading the app, using a browser, or finding some third-party workaround, why should I have to? The feature already existed and worked perfectly fine.

I'm tired of companies like Plex treating software updates as opportunities to redesign interfaces and remove functionality nobody asked them to remove.

Watch Together genuinely matters to me because it's how my girlfriend and I spend time together when we're apart. Plex just eliminated a feature we relied on almost every day.

At what point does Plex realize that continually removing features while increasing prices is driving away the very people who supported it in the first place?

Jellyfin is now up and running.

P.S. apparently posting anything remotely critical of Plex in a Plex subreddit gets downvoted until you are silenced. Some real shills in those subreddits.

I got this e-mail from my self-hosted Nextcloud server. This happened because I had a local device that was sending an expired App password repeatedly, which made Nextcloud suspect the localhost itself. Just sharing it for giggles!

I set this service up probably 9 months ago touched it once since due to a update that changed YouTube id's. It's the type of service that you never appreciate until it stops working.

I think everyone who regularly watches YouTube as their TV entertainment platform it's a must have program and can run on anything.

Edit:

Alternative YouTube clients are so amazing! They offer similar or more features than what iSponserBlockTV does and I have provided a list of some options.

IPhone: uYouEnhanced

Android: NewPipe

Android TV: SmartTube

Roku:Playlet

Other TV OS typically have a available alternative you must just do a little research.

NOT A MAINTAINER OR AFFLIATE OF PROJECT JUST REALLY LOVE IT

Hey Pocket-ID Dev-Team, Hey stonith404,

I just wanted to say thank you for your work.

After a couple of months of intensive use, I have to say: Pocket ID is the service that makes using my self-hosted apps so much easier and more comfortable.

I came across Pocket ID while searching for an encrypted file transfer service, and I've been following its development ever since. In the beginning, I didn't have much trust that a young developer could build secure and reliable software. Back then, I didn't know that you do this for a living in an enterprise environment. (And that was before the rise of AI agents.)

So I started with Authentik, which is overkill for a homelab, and only used it for Immich. After I messed up an update, I dropped the whole SSO plan.

But I kept an eye on the GitHub project, and the great project work and the OpenID certification changed my mind!

Now I have to say: I wasted too much time on logins and should have chosen your project from the start.

Thank you for the great work! I think you and the team have changed the self-hosted community and pushed devs to build their projects with SSO almost by default.

One idea: a community-driven, open-source SaaS version of Pocket ID as an OIDC provider, so that even people without enterprise IT experience, or without trust in their own infrastructure, could use it.

Cheers and huge props,
Hans

EDIT: Same with the website.

EDIT 2: New commits added on clarifying what you can and can't do.

https://github.com/Finsys/dockhand/commit/66ac29ff8aa0053369f058403300de6dd0927860

https://github.com/Finsys/dockhand/commit/6f14f74a60390f84d5074403d92014dc1ba22ac8

"Apache 2.0 in 2029" -> "Apache 2.0" now changed on the website.

Also, u/jotkaPL (creator of Dockhand) wrote something along the lines of: "No worries, it will convert to Apache 2.0 in 2029" but later deleted the comment here.

---

Original post:

https://github.com/Finsys/dockhand/commit/95a79d41e8076e51385d651a66946ea0c5062855

The most important lines have been changed:

Previously	New
Change Date: January 1, 2029. Change License: Apache License, Version 2.0	Change Date: Four years from the date on which a given version of the Licensed Work is first publicly distributed by Licensor. Change License: Apache License, Version 2.0
For clarity, the following uses are explicitly permitted without any restriction: [...] Internal business use within your organization, regardless of the number of Docker environments managed [...] Use by managed service providers (MSPs) to manage Docker infrastructure on behalf of their clients, provided the MSP does not offer Dockhand itself as the service	Any other production use — including production use by or on behalf of a company, sole trader or self-employed individual, public body or any other organization — requires a Commercial License from Licensor.

Interestingly, the README.md still lists the following. Likely forgotten to change.

License

Dockhand is licensed under the Business Source License 1.1 (BSL 1.1).
What this means:

* Free for: Personal use, internal business use, non-profits, education, evaluation
* Not allowed: Offering Dockhand as a commercial SaaS/hosted service
* Converts to Apache 2.0: On January 1, 2029

Helllooo everyone!

I just want to introduce myself and tell you all about my homelab. It's all pretty high-level, feel free to ask me about anything here.

About me

I’m just someone that absolutely loves technology. Software and systems are mostly where my heart lies, I’ve been working in IT for about 19 years. I have been homelabbing and self-hosting since about 2005. It started with game servers then learning how to become a sys admin, then wanting control over my data, and now I just want to explore different technology stacks and new software.

My homelab is a bit of a mix of running services for my family and a testing ground for learning new technology.

Quick and dirty

My entire homelab is Proxmox as the hypervisor, debian VMs to run Docker and Komodo. Forgejo deploys my containers on Komodo. Docker labels control Traefik and exposure.

6 hosts (3 “production” and 3 test lab) and ~147 containers.

Hostname	CPU	RAM	Storage	Used For
Jupiter	i7-9800X	128GB	122TB	App + Storage
Saturn	i9-13900K	64GB	3TB	Home Assistant + Dev + DNS (Secondary)
Mars	N150	16GB	500GB	Router + DNS (Primary)
Neptune	2x Xeon Silver 4214R	1.5TB	24TB	Testing + DR
Uranus	2x Xeon Silver 4214R	1.5TB	24TB	Testing
Pluto	2x Xeon Silver 4214R	1.5TB	24TB	Testing

Jupiter

My main server, pretty much what I would consider "production" in my house. I pretty much throw everything on this whether it's just for shits and giggles or actually useful. I try out every remotely interesting self-hostable application there is, so this list changes constantly,

It was running Unraid until a few weeks ago, but it has finally fallen inline with the rest of my environment with Proxmox and a debian VM.

I see people ask "Do you actually use any of this?" when people run a bunch of software, so I've split it into what I actually use and what just kind of exists.

What actually gets used

Most of these are actually used on a daily or weekly basis.

• Authentik - SSO/identity
• Excalidraw - Whiteboard
• FamFeed - Private Social Media
• Forgejo - Git hosting
• Glance - Dashboard
• Guacamole - Remote access
• Immich - Photo library
• Karakeep - Bookmarks
• Mealie - Recipes
• ntfy - Push notifications
• NZBGet - Usenet downloader
• Open WebUI - AI chat
• OpenHands - AI agents
• Outline - Wiki
• Penpot - Design tool
• Plex - Media server
• PrivateBin - Encrypted pastebin
• Seerr - Media requests
• Windmill - Workflow automation

Used, just not directly

• Grafana - Dashboards
• Jellyfin - Media server
• NetBox - IPAM/DCIM
• Paperless-ngx - Document management
• Prowlarr - Indexer manager
• Radarr - Movie management
• ReadMeABook - Audiobook requests
• SABnzbd - Usenet downloader
• Sonarr - TV management
• Tautulli - Plex stats
• Tunarr - Live TV channels

For that rare moment

• Audiobookshelf - Audiobook server
• BentoPDF - PDF tools
• ByteStash - Code snippets
• IT-Tools - Dev utilities

Infrastructure Apps

If I'm logging into one of these directly, something is broken. lol

• Backrest - Backups
• Beszel - Monitoring
• CrowdSec - Intrusion prevention
• Dozzle - Log viewer
• Komodo - Container management
• Node Exporter - Host metrics
• Traefik - Reverse proxy
• Umami - Web analytics
• UniFi Network Application - Network controller
• VersityGW - S3 gateway
• VictoriaMetrics - Metrics database
• Wazuh - SIEM

I should probably tear them down.

• Actual Budget - Budgeting
• Aurral - Music discovery
• LazyLibrarian - Book management
• Lidarr - Music management
• Navidrome - Music streaming

Saturn

This box was originally just to spin up VMs and test different applications, VMs, or build an environment to teach something to some of my junior. It was the first Proxmox box in the environment and after using it for a while I ended up switching all computers over to Proxmox.

Now it runs Home Assistant, secondary DNS, and some VMs that I use for Dev and AI agent work.

• Home Assistant - Home automation
• Music Assistant - Multi-room audio
• Technitium DNS - DNS (secondary)
• Z-Wave JS UI - Z-Wave controller
• Eclipse Mosquitto - MQTT broker
• Faster Whisper - Speech-to-text
• Piper - Text-to-speech
• Nanit - Baby monitor
• Node Exporter - Host metrics
• Backrest - Backups
• Beszel Agent - Monitoring agent

Mars

This is a little Beelink EQ14 that has dual 2.5 Gbps NICs and I purchased it specifically to be a dedicated router/firewall.

• OPNsense - Router/firewall
• Technitium DNS - DNS (primary)
• Cloudflare DDNS - Dynamic DNS
• Tailscale - VPN exit-node
• Node Exporter - Host metrics
• Backrest - Backups
• Beszel Agent - Monitoring agent

Uranus, Neptune, and Pluto

Relatively new hosts that are taking the simulation workloads I was running alongside production. They run Proxmox as well. I have OpenTofu and Ansible playbooks that spin up "scenarios" or my DR bubble. I am currently focused on OpenStack, Kubernetes, and other business simulation environments.

Current Goals

DR / Rebuild

Currently I am working on being able to rebuild and/or restore my entire homelab from a single script. The idea is if Jupiter, Saturn, or Mars have a catastrophic failure I can point the script to my new host and it will build it out, let me select which services to restore and hopefully be back up and running in a few hours.

Security Monitoring

I spent a chunk of the past year learning SIEM and how to tune alerts in Wazuh. Thankfully I work very closely with my InfoSec team at work so I had a helping hand, plus Claude being able to fill in some of the gaps. I am trying to get a Claude-based agent to do a lot of the triage and so far it is janky but works pretty well. My next step is to allow this agent to gather telemetry around whether or not the alert coming in is related to me. The idea is that between my remote sessions, where my phone is, and a few other details the agent will build a confidence score for how likely it is me accidentally generating the alert. It will then ping me to get confirmation, if I respond with "Not me" then it will go through some steps to either kill access.

I am also working on various apps and automations around my families needs, mostly our private social media.

Ask me anything!

Hey Internet friends,

I’ve been actively reviewing self-hosted software for almost 8 years now on my blog and while it’s amazing to see how much the scene has grown, we seem to be running in circles with project ideas.

Every week there’s a new photo manager, media/music player, dashboard, chat client, or download manager. Please Don't get me wrong tools like Immich, Navidrome, Dockhand, or Nginx Proxy Manager are fantastic and essential. But at this point, these categories are completely saturated imho.

I wish more developers would turn their talent toward building magic appssoftware designed for exploration, scientific discovery, and specialized human fields.

What do I mean by "magic"?

For example Astronomy I like to see Self-hosted tools for astrophotography processing, star mapping, planets, satellite tracking, or radio astronomy logs.

Also Biology & Botany for local flora/fauna identification via local AI, plant telemetry loggers, DNA sequence analysis, or biodiversity tracking.

Also Chemistry & Physics Molecular structure visualizers, lab notebooks, orbital mechanics simulators, or environmental data collection tools.

Science and research are fundamental, yet self-hosted offerings in these areas remain extremely sparse or outdated. Many of us have powerful home servers idling on basic tasks when they could be processing, analyzing, or visualizing real-world scientific data.

So I'm very passionate about things like that and if you’re a developer looking for a unique side project: please consider stepping outside the media, photo, and productivity bubble. Build something that makes people say WOW, I can run that at home?

degoog just released its first stable release. I'm not affiliated with the project, just a happy user who wants to share this amazing project

https://degoog-org.github.io/docs/

https://github.com/degoog-org/degoog/releases/tag/1.0.0

If the price of memory doesn't get you, these surely will (the conversion is roughly $3 a pop). Believe it or not, nobody with me understood my excitement, so I'm sharing here. (Not offering to buy or sell)

Api first and now also rss.

It’s only getting worse.

Reddit recommends “Discord Relay”.

Maybe we can use it to at least mirror the posts away from reddit?

I'm very big into local control and being able to host things myself. I've been one of the co-maintainers of python-roborock for a few years and I have had this goal for years to get my robot vacuums off of the cloud and running completely locally as I am not a fan of a device with a camera, microphone, and detailed map of my house storing data on a company's cloud.

I won't bore everyone with the details of how I got it working (if you want to see you can read the full technical write up), but essentially I use a few exploits during onboardings to route the vacuum to a custom URL. Then I recreated Roborock's backend stack (MQTT and REST) so that the vacuum could communicate completely with the server. I've since blocked my vacuum from accessing the internet and everything has been working great for me.

The server runs in docker or as a Home Assistant addon or can be built from source.

AI Disclosure: AI was used to assist me in the reverse engineering. AI was also used in writing the backend stack but I have been very involved in the process.

It's happening on September 12 - 14, 2027 in St. Louis, MO.

HomelabFest is a celebration of self-hosting and homelabs of all sizes! If you’re interested in home networking, tinkering with hardware, digital privacy, or building your own mini (or full-size) rack, this event is for you.

More details here and here.

See ya there!

Hi all,

Developer of Apprise here.

After quite a bit of work, Apprise v2.0 and Apprise API v2.0 are finally out.

For anyone unfamiliar with Apprise, it acts as a notification hub. Or a glorified switchboard. Your applications, scripts, containers, cron jobs, monitoring tools, Home Assistant instance, etc. send a notification to Apprise, and it handles delivering it to Discord, Telegram, Slack, Matrix, Gotify, email, SMS providers and more. The graphic i created in this post can illustrate the flow better.

There are now 160 supported notification services, all using the same general configuration approach.

You can use Apprise directly from the CLI, embed the Python library into an application, or run Apprise API and centralize your notification configuration on a self-hosted server. Over the years, I got to watch a lot of systems adapt this and it's been cool to see!

The API approach is particularly useful if you have a bunch of applications sending notifications. Instead of spreading your Discord webhooks, SMTP passwords, Telegram tokens and other credentials across everything you run, they can live in one place (protected from prying eyes; centralized too).

What's New in v2?

• Authentication in Apprise API. Authentication is optional, but you can now protect the server with an administrator account and also assign separate credentials and access controls to individual configurations.
• Configuration IDs no longer need to appear in URLs. Supported clients can send them through an HTTP header instead, keeping them out of normal web server access logs.
• Template variables. Secrets can be supplied separately instead of being stored directly in your configuration.
• Priority and escalation. You can try one notification route first and only move to the next one if delivery fails.
• Smarter retries. If you notify five destinations and one fails, only the failed destination is retried.
• Timeout controls. A slow or broken service doesn't need to hold up an entire notification run.
• Better results and live logs. You can see what succeeded, what failed and why. Apprise API can stream delivery logs live through the web interface or API.
• Multiple message formats. Services can accept Markdown, HTML or text where supported instead of Apprise always converting everything to one format.

The Apprise API web interface has also been updated, works much better on mobile devices, and is now available in 20 languages.

For developers embedding the Python library, v2 does contain breaking changes, so have a look through the release notes before upgrading. The v1 branch is still available if you need more time to migrate.

Trying the API

It's not changed much... this example has the user/password element on it which would be worth sharing:

docker run --name apprise \
    -p 8000:8000 \
    -v ./config:/config \
    -v ./attach:/attach \
    -e APPRISE_STATEFUL_MODE=simple \
    -e APPRISE_AUTH_REQUIRED=yes \
    -e APPRISE_USER=user \
    -e APPRISE_PASSWORD=changeme \
    -e APPRISE_WEB_AUTH_SECRET="$(openssl rand -hex 32)" \
    -e APPRISE_WORKER_COUNT=1 \
    -d caronc/apprise:2

Then open:

1. http://localhost:8000
2. Login with user / changeme.

Obviously, change the password before putting it anywhere beyond a local test. If you're exposing Apprise API outside of a trusted network, it might be wise to put it behind HTTPS as well.

Full documentation is here and more on the API documentation and deployment examples are here.

As a small side project, there is also an Apprise Android app for people already running Apprise API. It's basically a mobile companion for connecting to and working with your own API server, not a standalone notification service.

Apprise itself has been around since 2017, is written in Python, BSD 2-Clause licensed, maintains 100% test coverage, has passed 17,000 stars on GitHub and sees roughly 9 million PyPI downloads a month.

It's still entirely something you can host and control yourself, for free.

Feedback is always welcome. A surprising amount of what made it into v2 came from issues and suggestions people have opened over the years.

TL;DR Apprise v2.0 and Apprise API v2.0 are out. Major changes; try it out and let me know what you think!

Worth having a read if you were keen/excited for the OIDC Pull Request that looked completed and was filed somewhat recently, or if you're keen for a status update in general.

Looks like they don't want to maintain the extra code at this stage, and would prefer to redesign/rework the auth system first.

Note: I am not associated with this PR nor Jellyfin in any way.

Edit: I've realised what a shit title I gave this post, it was not meant to clickbait, farm karma or criticize. Just simply to share where OIDC is at. I hope my intention was clearer in the post body and via my comments. I completely own making the mistake.
Edit: I made an error replying to the AI Automod post - Codex was used during its development (I didn't notice when reading)

A few years ago I started building my homelab with a Raspberry Pi 4 and an HP G3 Mini I picked up on Vinted. Since then I kept adding pieces whenever I found a good deal on second-hand sites, and today, after more than 2 years, I think I've officially reached the end (maybe). This is my current setup. Everything is second-hand except the switch and the router.

RACK

- Fully 3D printed in PETG on a Bambu Lab X2D (Design by Ilan Kushnir)

NODE PC: 3-node Proxmox VE

- pve-01: Ryzen 7 5700U (8C/16T), 62 GB RAM, 512 GB NVMe (ZFS) + 2 TB HDD (ZFS) + 256 GB SATA SSD

- pve-02: Core i7-6700T (4C/8T), 32 GB RAM, 256 GB NVMe (ZFS) + 2 TB HDD (ZFS)

- pve-03: Core i5-7500T (4C/4T), 32 GB RAM, 256 GB NVMe (ZFS) + 2 TB HDD (ZFS)

NETWORK

- UniFi Dream Router 7: gateway, firewall, inter-VLAN routing

- UniFi USW-Flex-2.5G-8-PoE, with an SFP+ DAC uplink to the UDR7

- VLANs: management, homelab infra, and a dedicated one for Kubernetes. Proxmox uses a single VLAN-aware bridge, so each VM just gets tagged.

STORAGE

- QNAP TS-431 with 16Tb

OTHER

- Raspberry Pi 4 driving 2 displays:

- 7.84" front display showing Grafana dashboards

- 0.91" OLED status display running a small Python script that shows IP, temperatures and CPU usage

SOFTWARE

I'm currently rebuilding everything from scratch, starting with pve-01, which now runs the Kubernetes cluster:

- Kubernetes: Talos Linux (1 control plane + 4 workers as VMs), provisioned end-to-end with Terraform: VMs, Talos config, bootstrap and base components

- Networking: Cilium with kube-proxy replacement and L2 LoadBalancer

- Storage: OpenEBS LocalPV, with VM boot disks on NVMe and data volumes on HDD

- GitOps: ArgoCD app-of-apps. Everything in the cluster lives in git

- Secrets: OpenBao in an LXC (outside the cluster, so it survives rebuilds) + External Secrets Operator

- Ingress: Nginx Proxy Manager (Let's Encrypt wildcard) -> Traefik

- Monitoring & logs: kube-prometheus-stack (Prometheus, Grafana, Alertmanager), including the Talos control plane and etcd, plus Loki + Alloy for pod and node logs

- Other stuff: Glance dashboard, Headlamp, VS Code server.

pve-02 and pve-03 will be dedicated to other projects.

Happy to answer questions, and any tips or suggestions for improvements are welcome!

After years of solid service, it’s time for a change. I’ve moved to Dockhand in my home setup (mariushosting) and damn, it just feels right. Cleaner interface, smoother workflow, and that fresh energy the selfhosted world always needs. No hard feelings, guys, just evolution.

Thanks for everything, Portainer. Welcome home, Dockhand.

Anyone else already made the switch?

From their discord

Finally some news 👀

@everyone It's been pretty quiet since we posted the 2025 Year in Review, but now there is some news about our arr alternative!

I'm happy to announce librrary! One app for movies and TV, from the team behind autobrr and qui.

It is NOT ready yet, but we are getting close to user testing!

Why? What's wrong with Sonarr and Radarr?

Sonarr and Radarr work well if your needs are simple. As soon as you want both HD and 4K libraries, you need multiple instances. Then you need to keep those in sync with everything that comes with it.

It's not uncommon for users to run 4-6 arrs to fill their needs. This means more to manage, more resources, more hits on indexers and so on.

With so much duplicated between them, it makes a lot of sense to combine movies and TV into one application.

A big thanks to everyone who posted in the feedback thread! It was super helpful! Keep it coming: Ideas discussion

What we are building

• Multiple libraries by content type (similar to Plex), where each title can have several variants (1080p, 2160p, remux, DV)
• Arr-like Quality Profiles and Release Scoring Rules (think to Custom Formats)
• Torrent and Usenet support via Torznab/Newznab (will need Prowlarr/Jackett etc)
• Users with roles, plus OIDC login
• SQLite or Postgres
• Notifications with your favorite services (Notifiarr, Discord, Telegram etc.)
• Lists support
• Go backend, React frontend, Docker images and binaries for Linux, macOS and Windows

On the roadmap

• Built-in requests (don't worry, there is a strong user role access system)
• Import from Sonarr and Radarr
• Optional manual upgrade approvals
• Trump handling: watch the torrent client for trumped/nuked tracker messages and take webhooks from external tools like qui
• Potential Plex, Jellyfin and other media server integrations, including deleting titles after they're watched (request, dl, import, watch, delete)
• Various features from the feedback thread

Other media type support

It's built to be modular, so dedicated anime handling, books and music are possible later, but movies and TV come first.

When?

No release date yet. Sign up for news here: https://librrary.app/ Updates will also be posted in this channel.

Support the development <:peepolove:1035253194969845890>

If you want to chip in:

https://github.com/sponsors/zze0s https://buymeacoffee.com/ze0s https://ko-fi.com/theze0s https://autobrr.com/support#cryptocurrency

Hello,

I just finished setting up a portal for my family to use, and wanted to show it off.

I Just finished setting up the gaming server using moonlight-web and Wolf so everything I host is now in a container, I thought putting it all in once place makes it easy for my family. Next im going to learn some networking!

For the people that are unaware or haven't seen the news yet.

Ten tabs over your network, all one keypress apart:

- Every socket with the process behind it, PID, TCP state, GeoIP, RTT and retransmits. Attribution comes from platform socket polling, PKTAP on macOS, and an optional eBPF kprobe on Linux.

- Live packet decode with display filters, stream tracking, JA4 fingerprinting and PCAP export.

- TLS 1.3 and 1.2 decryption for sessions you hold the keys to. Point a client's SSLKEYLOGFILE at NetWatch and the plaintext decodes in the Packets tab, same mechanism as Wireshark.

- A diagnostic engine that learns per-metric baselines, opens an issue when one breaks, ranks the causes by the checks that separated them, and closes the issue only once the fix has held. No model involved.

- Egress drift. It learns which hosts, autonomous systems and ports each process reaches, you promote that to a rule, and the next new destination shows up flagged. Observes only, never blocks.

- Background detection for C2 beaconing, port scans and DNS tunnelling. A critical alert freezes the flight recorder so the bundle exists before you go looking.

- Throughput, interfaces, protocol breakdown, traceroute topology, per-process bandwidth, and a timeline of connections by TCP state.

- Three layouts off one capture. V cycles them live: full ten tabs, --lite for 80x24, --view dense for four borderless boxes with braille throughput graphs.

macOS, Linux and Windows. One binary, no config. The Linux build is static with libpcap bundled in.

brew install netwatch

cargo install netwatch-tui

https://github.com/matthart1983/netwatch

They've got good performance and run well, and I've got all my stuff running on them. The DAS is a bit old, but it still works fine.
Minipc: acemagic k1 (r7 7730u, 16gb ram, 1tb ssd)
External storage: samsung t7
Das: mediasonic probox

A heads-up for anyone doing hardware mods or custom upgrades on the Raspberry Pi 5:

As of the pieeprom-2024-09-23.bin update, the Raspberry Pi 5 now performs a hard RAM capacity check during boot:

2.41 Expected configuration 8 Gbit (0x07)
2.44 Actual configuration 32 Gbit (0x05)
2.48 USB-OTG disconnect
2.51 BOOT ERROR: code 9 - 'SDRAM mismatch'

If the EEPROM detects a RAM capacity that differs from the original factory configuration (written in OTP memory on the SoC), it throws Error Code 9 and refuses to boot.

Instead of letting skilled users repurpose loose RAM chips or upgrade their existing hardware to mitigate these insane market prices, they went out of their way to implement an artificial software wall.

It takes serious hardware skills and specialized equipment to desolder and upgrade BGA-packaged, soldered RAM on a board like this. Preventing power users who manage to do this from actually using their modified hardware. What technical or security justification is there for artificial bootloader locks on custom RAM, other than forcing customers to buy higher-margin, overpriced models? Imagine buying a desktop PC and not being able to swap the RAM or the SSD in it...

To make matters worse, any attempts on my side to bring this up or post about it on the official Raspberry Pi forums are getting deleted almost instantly.

At this rate, what’s next - serialized power supply checks on boot to block 3rd-party power bricks?

What are your thoughts on this move? Is there any legitimate stability or technical reason for hard-coding RAM limits in the EEPROM, or is this strictly anti-Right to Repair driven by corporate greed?

I'v been thinking recently with the AI safety incidents (hugging face, frontier labs whistleblowers etc.) how self-hosting is more important now than ever. Basically there there are three ways self-hosting impedes an oncoming cyber apocalypse - which leaving everyday services to centralized providers would accelerate. I'v boiled this down to:

1. Data accessibility - our data on our infra means no 3rd party has unauthorised acccess like an employer/service provider/state would have access if we gave up the infra to someone else.
2. Operational flexibility - we can choose when to stop/start/discontinue at the flip of a switch - physically/remotely/whatever we choose.
3. Information sparsity - because its only Joe Blogs data it doesn't represent as big a target as say Gmail does on a global scale, individuals holding their own data adds difficulty (because different setup), less worth and more time and effort targeting numerous individuals. And don't give me that the big providers are more protected - I was around when heart bleed was a thing - anyone with knowledge of that vulnerability could pull raw memory from the biggest providers until it was patched.

With AI advancing at such an incredible pace, big data repositories which are information rich (because higher numbers of individuals data, as opposed to a singular data source, say) represent a higher priority target for malicious/nefarious actors (human or non-human)...

So self-hosting our critical data, our personal data our every-day seemingly benign data - the original promise of the distributed Internet before centralized providers sucked everyone in - is a service not only unto yourself, but everyone!

Photo of 10 year old 16GB i7 1TB SSD box running undisclosed operating system that would cost me ~$100USD /month from cloud provider only costing me ~20W avg or $3USD /month.

Yes I KNOW i need to take care of backups/power loss/internet connectivity/ security updates - its really not that hard and have had 1 power loss incident in 5 years, 99.9999% uptime baby