I already had Keycloak set up, but a few services don't support OIDC or SAML (Jellyfin, Reposilite), so I've deployed lldap and connected those services and Keycloak to it. Now I really have a single user across all services
this post was submitted on 07 Mar 2026
34 points (97.2% liked)
Selfhosted
57265 readers
468 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
-
No low-effort posts. This is subjective and will largely be determined by the community member reports.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 2 years ago
MODERATORS
My servers are up
I managed, without ever trying, to convert a friend to swap to Linux about a month ago.
Today I’m driving over to give him my old old server so he can start self hosting. He’s super keen on getting started.
So not my success, but ours? One more person joins the community today!
Decided to buy a raspberry pi, it arrived, I installed pihole on it and put it into my dad's house, all in a few days. Biggest win: I just took action and did it, instead of researching, brainstorming and writing down stuff for weeks and then never execute.
I've been running all my apps on my NAS as docker containers, but some get 'stuck' occasionally, requiring a reboot of the whole machine. Using the NAS was mostly out of convenience.
I also had an old laptop running k3s, hosting a few stateless services.
This week I picked up three Wyse 5070 devices and started setting up a more permanent Kubernetes cluster. I decided to use Talos Linux, which is a steep learning curve, but should hopefully reduce the amount of ongoing work for upgrades. I'll be deploying everything with FluxCD this time around too.
I've stumbled a bit with the synology-csi-driver. It didn't work with Talos out of the box, but turns out the latest commits have a fix. The only thing remaining before I can start porting the apps over is figuring out how to spin up a new CA and generate client certificates for mTLS. I currently do that in Vault but it seems like something cert-manager could handle going forward.
All of my apps are running without issue. First time in months
Still waiting for my success. Pihole randomly doesn't answer DNS requests in time, causing a lot of trouble between my services. It's happening since I switched to dnsmasq in opnsense (which is upstream for my local domain for Pihole), but also for external domains. Can't nail it down and am this short of reconsidering my whole network setup. It used to work fine for over a year though..
Opnsense dnsmasq is DHCP for my servers and also resolves them as local hosts. (e.g. server1.local.domain) and Pihole conditionally forwards there. Since the issue is also when resolving external domains, it shouldn't be related, but the timing is suspicious. I also switched the general upstream DNS.
Pihole does have some logs indicating too many concurrent requests, but those are not always correlating with the timeouts.
I know it's DNS, I just don't know where yet.
I finally got around to installing Jellyfin. Still trying to get hardware transcoding working. I think I have it set up, but it still wants to use the CPU. I'm thinking permissions but I ran out of time.
Fun project.
I think QSV is the new "easiest" way if you have an Intel CPU. Here are some docker compose values that might help:
group_add:
- "110"
- "44"
devices:
- /dev/dri/renderD128:/dev/dri/renderD128
110 is render
44 is video
You can grep render /etc/group to find your values.
I found CPU accelerated transcoding to be as effective as using GPU acceleration for my small media server setup. Nvidia wasn't worth it for me.
Oh thanks! I didn't have the group_add.
Hum. I've been smooth sailing for a while now. I've tried installing OwnTracks again and made some progress by figuring out cloud flare tunnels are a problem (at least the way I configured them). New to MQTT. So the app still doesn't work properly but now I have an idea why and I'm not just banging my head on the wall anymore.
The nextcloud AIO instance that hadn't been working since September suddenly started working after I updated it. This was all after their forums did fuck all to help except tell me to get gud. I knew the problem wasn't on me or my config and I feel so vindicated
Have you had a look at opencloud? Not many addons, but simple-ish cloud drive and docs and such. Does not use many resources.
I have an instance running, but haven't had a ton of time to dedicate on getting it the way I need it. I need a calendar that is accessible anonymously via the web for people to know my availability. File server, CalDAV, and CardDAV I was able to get separate solutions for.
I'll go first: I got XMPP (Prosody) setup for the family.
Also, less this week (cheating a little), but I've setup all my services with SSL (self-hosted root CA), domain names, and (finally) a dashboard (Heimdall.)
Edit: I can't sepll.
Nice, had my XMPP server now running for a couple of weeks, not many users on it so far though. But my highlight of the week was managing to get the slidge whatsapp bridge with Prosody running, so I at least don't have to use the official app anymore for all those people who resist to get off of it.
Nice, same! Was also really positively surprised by how great the Android app(s) for XMPP feel.
Only thing not working yet for me is group chat creation. Oh well. Maybe this weekend.
On the other hand though, voice and video calls have worked flawlessly.
Nice, same! Was also really positively surprised by how great the Android app(s) for XMPP feel.
We're on iOS and I wish I could say the same. Looking at the Android apps makes me very jealous.
Only thing not working yet for me is group chat creation. Oh well. Maybe this weekend.
What server software are you using? I went with Prosody and it felt pretty easy to setup the muc module for groups, but, on the other hand, I haven't gotten around to voice and video calls.
Ah, too bad. IMO better clients would make it drastically easier to convince people to switch.
Hm, I can create groups (also with muc), and the other members are added, but writing a message triggers "x left the group" for everyone. Dunno. Probably something trivial I overlooked. But honestly... Weather is too good today to be bothered 😄
Ah, I already had a TURN/STUN coturn server set up for matrix and jitsi, so it was just a matter of telling prosody about that. So I cheated a little I guess 😄 Here is my full config for that, in the unlikely event that you're using NixOS.
Are you using sturn/turn server? Almost always needed for calls and video, you should join prosody support channel that are really helpful xmpp:prosody@conference.prosody.im?join
The table (dm) might finally make the switch from roll20 to foundry for a campaign!
I plugged in an NVIDIA gpu in my server and enabled ollama to use it, diligently updated my public wiki about it and now enjoying real time gpt: OSS model responses!
I was amazed, time cut from 3-8 minutes down to seconds. I have a Intel Core7 with 48gb ram, but even an oldish gpu beats the crap out of it.
In that same vein I got an AMD Pro V620 32GB off ebay and have been struggling to get it to POST on my x570 motherboard, but I finally tried it on my old ASUS b450-i with a Ryzen 5 2400GE and with a few BIOS setting changes it fired right up.
Now I need to figure out what I'm doing wrong on the x570 board so I can run the V620 combined with my 9060XT for bigger models
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:
| Fewer Letters | More Letters |
|---|---|
| AP | WiFi Access Point |
| CA | (SSL) Certificate Authority |
| DHCP | Dynamic Host Configuration Protocol, automates assignment of IPs when connecting to a network |
| DNS | Domain Name Service/System |
| Git | Popular version control system, primarily for code |
| HTTP | Hypertext Transfer Protocol, the Web |
| IMAP | Internet Message Access Protocol for email |
| IP | Internet Protocol |
| MQTT | Message Queue Telemetry Transport point-to-point networking |
| NAS | Network-Attached Storage |
| SMTP | Simple Mail Transfer Protocol |
| SSL | Secure Sockets Layer, for transparent encryption |
| TLS | Transport Layer Security, supersedes SSL |
| VPN | Virtual Private Network |
| VPS | Virtual Private Server (opposed to shared hosting) |
| XMPP | Extensible Messaging and Presence Protocol ('Jabber') for open instant messaging |
| k8s | Kubernetes container management package |
| nginx | Popular HTTP server |
[Thread #142 for this comm, first seen 7th Mar 2026, 06:40] [FAQ] [Full list] [Contact] [Source code]
good bot
This week I saw my 3 machine cluster flailing trying to stay online, digging around identified it as an issue with communication with my NAS. It was running NFS3 and so I swapped that to NFS4.1 and did some tuning and now my services have never been faster!
I got Terminus for the TRMNL set up using Podman on my server running NixOS.
Although I'm actually planning on replacing Terminus with my own simple server app that way it can be even more declarative (no Postgres database of devices/users/screens) and easier for me to customize. The API I'll have to implement is extremely straightforward, so I don't anticipate it taking too long.
I got gitea running on my VPs cluster that I use to host keyboard vagabond services. I moved my repository from my home PC into it, and set up an action runner to automate a build and deploy of piefed, so it runs my build script, pushes to harbor registry (internal), and then deletes and recreates a job to run db migrations and restarts the web and worker pods.
I'm going to migrate the other build services to it as well, and after that I should be able to finally get all of my services behind cloud flare tunnels and tail scale, and finally remove the last bits of ingress-nginx. The registry was the only thing still on ingress-nginx because I needed to push larger image files than are permitted by cloud flare. since all of that is internal now, I get to finally seal those bits off.
The build is also faster since I don't have to rely on wifi
I had enough time to install sort of pihole.
I'm curious what alternative to Pi-hole you set up. (I'm planning on installing Pi-hole soon but wanna hear all my options)
I have tried out Openclaw in a container, and it wasn't hard at all.
All the warnings of danger are right, though. But if anything goes wild, I still know how to delete a container :-)
I got a test box set up with nixos and a config that runs all of my services. I wanted to test the declarative rebuild promise of it, so I:
- Filled the services with my some of my backed up data (a copy of the data, not the actual backup)
- Ran it for a few days using some of the services
- Backed up the data of the nixos test server, as well as the nixos config
- Reinstalled nixos on the test box, brought in the config, and rebuilt it.
And it worked!!! All serviced came back with the data, all configuration was correct.
I'm going to keep testing, and depending on how that goes I may switch my prod server and nas to nixos.
Very cool!
Re: the backup / restore of state in NixOS: I found myself writing the same things over and over again for each VM/service, so finally wrote this wrapper module (in action e.g. here for Jellyfin), which confgures both the backup services and timers, as well as adding a simple rsync-restore-jellyfin command to the system packages. In case you find this useful and don't already have your own abstractions, or a sufficiently different use case 😄
I'm redoing everything I have from scratch. This week I have FreeIPA set up from OpenTofu + Ansible configs, and enrolls most of my other servers against FreeIPA. I am still migrating TrueNAS to use FreeIPA's Kerberos Realm for auth, and I need to chown a lot of files for the new UIDs and GIDs homed in FreeIPA. After that, I'm setting up FreeRadius for auth to switches, APs, and Wifi. And then after that, I'm back to overhauling my k8s stack. I have Talos VMs running but didn't finish patching in Cilium. And after the real fun begins.
Finally took the time to setup Woodpecker CI to replace Drone. Also finally linked it not only to my self hosted gitea, but also to github, so I can automate a few builds there as well.
In the process I also learned, that I can set up a whole bunch of pods in a single kube definition for podman/quadlets, which allows me to have a much cleaner setup. Previously I was only aware that you can define a single pod with multiple containers. It makes sense, but it never occurred to me before.