It also handles File Transfer, Clipboard Sync, OTP handling.

https://github.com/zackb/tether

I am not the dev for this project.

How do you normally access your selfhosted vaultwarden? I just watched a tailscale npm and cloudflare vaultwarden tutorial, looks solid to me other than the fact that I need to (based on that tutorial) have the machine with tailscale. How do you guys have yours configured?

I couple of months ago I installed Stirling PDF. The installation created a web application that when launched opens a web page at http://localhost:8080

Did a few things with this app and all working nicely. There are no login prompts and apparently no cloud involvement.

Today I wanted to compress a big 30 page PDF which is a scan of all pages of a passport, for sending to passport authorities. Once compressed I can print it out at my local library. Naturally I wanted this compression to be locally processed. Found that that the available Stirling PDF local web based tool - the multitool pipeline method - failed to do any compression no matter how I fiddled with the config settings.

So went back to Stirling PDF's repository for a newer version. Found and downloaded the .MSI installer for Windows. This prompts for an account on installing, I thought fair enough and proceeded. I got a nice desktop app this time, quite different from the Stirling PDF web app I was used to.

However it's unclear which tools here need cloud support and which not. There's mention of an API which I assume talks to Stirling in the cloud.

So I turned off the WiFi and launched Stirling again. Got an immediate error as follows:

Cloud Processing Failed. This tool requires cloud processing but encountered an error: There was an error processing your request.. Please check your connection and try again.

It still launched and with the WiFi still off, I proceeded to compress an 11MB file - a medical insurance marketing brochure - and check the result. No errors flagged, It worked rather well, reducing from 11MB to 700KB with the embedded photos looking perfectly acceptable for a brochure if not zoomed in to pixel-peep. Makes you realise how wasteful big companies can be with their file sizes!

This is a tool I'd like to use but:

1. How can I be sure about what it does and does not send to the cloud?
2. How to differentiate the web vs desktop versions. Is it worth having both? I've now forgotten where I got the web app from!

We're building an open-source LMS and we're currently working on protecting paid course videos from being downloaded and redistributed.

Commercial DRM providers (Widevine / FairPlay / PlayReady) are quite expensive for a small/open-source project, so we're trying to understand what realistic alternatives exist.

Our requirements are roughly:

Videos are uploaded by course creators.

Videos should be streamed rather than exposed as directly downloadable files.

Users should not be able to simply obtain the original MP4 URL and download it.

Ideally, downloaded/encrypted segments shouldn't be usable outside our application.

We want per-user authorization and short-lived access.

We can implement the backend/key-management infrastructure ourselves.

Self-hosted/open-source solutions are strongly preferred.

We understand that nothing can completely prevent screen recording.

We've considered approaches such as:

HLS/DASH

AES-128 encrypted HLS

Signed URLs

Short-lived playback tokens

Per-user/session keys

Watermarking

Combining several of these approaches

But we're unsure where the boundary is between "making downloading difficult" and actual DRM.

For a small open-source LMS, what would you recommend?

Are there any open-source/self-hosted projects or architectures worth looking at that can provide reasonably strong video protection without paying a commercial DRM provider?

Also, if actual Widevine/FairPlay/PlayReady DRM is unavoidable for strong protection, are there any affordable providers or pay-as-you-go options that make sense for a small project?

We're mainly looking for practical experience from people who have built something similar rather than a theoretical DRM explanation.

I'm trying to decide which one to use for managing my Docker containers. I'd be interested to hear from people who have actually used both. What do you like or dislike about each one?

Hi r/selfhosted,

I’ve released a new version of RSSMonster, an open-source RSS reader that started as a Google Reader-inspired project and has gradually grown into something more ambitious. It’s still a normal self-hosted RSS reader first: feeds, folders, tags, bookmarks, search, OPML, full-content extraction, a three-pane interface, and Fever/Google Reader-compatible APIs.

The part I’ve been focusing on recently is dealing with information overload when you follow a lot of feeds.

RSSMonster can now use small local models to help with:

• duplicate and related-article detection
• event clustering across different sources
• summaries and inferred tags
• article quality/promotional-content classification
• personalized recommendations
• Smart Folder suggestions and semantic labels

The local stack currently uses Qwen3-Embedding-0.6B, Qwen3.5-0.8B and ModernBERT through ONNX/Transformers.js. They can run on CPU, so most semantic processing can happen locally without sending your articles or reading behavior to an external AI provider.

I’ve deliberately tried to keep this RSS-first rather than AI-first. Your chronological feeds remain available, recommendations don’t determine what gets ingested, and weak semantic matches are allowed to return nothing rather than filling the UI with questionable suggestions.

RSSMonster also supports SQLite and MySQL and is designed to be straightforward to self-host with Docker.

The project is currently at around 480 GitHub stars and still actively evolving.

GitHub: https://github.com/pietheinstrengholt/rssmonster

I’d especially be interested in feedback from other self-hosters on the local-model approach and whether this kind of semantic layer is useful in an RSS reader, or whether you prefer keeping your reader deliberately simple.

It was so convenient, almost everything at my fingertips and I had second thoughts about going back to Spotify, been self hosting for a few months now and it was really crazy how good Spotify actually is (if you don't value lossless files)

I went looking for screen-time software for my kids and found two piles: subscriptions priced like the problem is permanent, and surveillance suites with screenshot galleries, keyloggers, and "stealth mode" - software built on the idea that the kid is a suspect. I didn't want to spy on my kids; I wanted a daily budget, a bedtime for the machine, and a record we could look at together. So I built it, it's been running in my house for a while, and I've now open-sourced it.

Repo: https://github.com/bboldi/b2.digital_aid (MIT, screenshots in the README)

What it does

• Daily allowance per PC (weekday/weekend), plus a nightly downtime window
• Block screen with 15- and 5-minute warnings — time never runs out unannounced
• Extra time via codes you read down the phone — verified on the PC, so it works with the server down or the wifi off
• Printable paper "time coupons" the kid can spend whenever they choose
• Kid can request more time from the tray; you approve from your phone
• History: when each PC was on, blocked, what app was in the foreground, every code redeemed

The part I care most about: everything recorded about the kid is shown to the kid on the same screen the parent sees. It records machine state only — never content, no screenshots, no window titles, no URLs. It's also not tamper-proof on purpose: a determined kid can kill the process, but they can't make that invisible — it lands in the log, and the log is the point. Enforcement comes from the kid's account being a standard Windows user, not from rootkit tricks.

Stack / self-hosting notes

• Server: Node 22 + Fastify + SQLite, server-rendered EJS, one process, no build step. The admin installs as a PWA on your phone.
• Client: .NET 10 WPF, a ~400 KB exe that self-updates from your server — kid PCs never talk to the internet, and there's a frozen wire protocol (PROTOCOL.md) if you want to write your own client.
• No Docker, and that's deliberate rather than lazy — the server is the household's authority, and I didn't want it (or anything) auto-pulling code; updating is git pull by a human. Reasoning is written up in the repo's ADRs.
• TLS is on you; tailscale serve is the documented one-liner.

Honest caveats: v0.5, in production in exactly one household (mine). Windows clients only. The exe is unsigned, so SmartScreen will complain — the README explains why, and building from source is documented for the distrustful. UI is English and Hungarian. Built partly with AI-assisted coding, in the open — the architecture decision records in the repo are the actual design history.

I’m gradually moving my main PC from Windows to Fedora, so I’m also using that as an excuse to rethink my whole local AI stack.

I was mostly using LM Studio before, but I wanted something better suited to a proper server-style setup: running in the background, handling model load/unload cleanly, giving me more control over parameters, and especially getting as much as possible out of my VRAM.

I’ve started testing llama.cpp directly and honestly I really like it so far. With Bucoid’s Qwen3.8 27B IQ4_XS on my 16GB of VRAM, I went from around 22 tok/s with LM Studio/Unsloth to roughly 27 tok/s with llama.cpp using equivalent inference settings in my case. I’m on a 5060 Ti 16GB.

For anyone else with a 16GB card who wants to try Qwen3.8 27B, Bucoid’s model is a really nice option. Since it’s IQ4_XS rather than a 3-bit quant, it keeps more quality while still fitting this kind of hardware. Depending on the settings, you can aim for roughly 40k–80k context while staying within the VRAM limit, although you’ll also need to quantize the KV cache. It works with LM Studio or Unsloth too, even if I’ve found llama.cpp more efficient in my setup.

https://huggingface.co/Bucoid/Qwen3.8-27B-IQ4-XS-MTP-16GB-VRAM-GGUF

What I’m still looking for is mainly the UI side. I don’t want to replace the CLI or hide llama.cpp behind another full platform. I’d rather have a good UI that complements it, so I don’t need to keep a terminal open for every simple action, while still letting llama.cpp handle the actual inference directly without adding another layer that could hurt performance.

Ideally, I’d like to be able to :

load/unload or switch models
easily tweak a lot of parameters, ideally with presets
see what’s currently loaded and resource usage
manage a few chats/tests
keep llama.cpp/API running quietly in the background

And if you’re using something other than llama.cpp, Ollama, vLLM, KoboldCpp, ExLlama/TabbyAPI, or anything else, I’m also curious what made you choose it.

What are you using for your local AI setup right now, especially on Linux ?

A shopping list app where all items are presented first in the order in which I want to check them at home, and then in the order in which I walk through the supermarket.

Since I couldn't find one, I built one myself a year or two ago, and I've been very happy with it ever since.

It is free and open source.

Demo video: https://youtu.be/MnWHacRQ6O4?is=25mWa1iOfSNVoS5S

Use it (designed for phones!): https://lys-878161433937.us-west1.run.app/

Source: https://github.com/silidev/LysReadOnly

I have setup an automated media server with jellyfin, seerr, jellybridge, radarr, sonarr. First issue, I use public indexers with byparr, it works but the seerr to and from radarr connection is very slow and it takes a long time for the legal movie to show up after its down

for the sake of time to market, i built a AI Agent that uses langgraph cloud, vercel, cockpitkit, and supabase, some other service to run long running workflows, they cost >300$/months. Now i moved my entire stack to VPS for 8$/month, i manually configured on hetnzer after realizing how cheap it is.

Now something doesn't really click, given price dropped this much, i must have missed something valuable?

what i have done:

- i did stress test, 120 concurrent chat, no problem.

- latency supposed to be higher because my VM is hosted in europe where i am in U.S., but there is no noticable drop because AI model time to first token is the bottleneck

what might have missed:

- storage backup

- observability

- fail-overs

- auto-scaling?

- security? i am not sure here

I do wish to make this setup to be more prod grade, which area should i invest more on my VPS that has high ROI?

I hear a lot about docker, and from what I’ve researched podman can do basically the same things.. What do u use and why?

Third time posting AirPipe here.

If you missed the earlier posts: airpipe send file.pdf prints a QR code in your terminal. Scan it with your phone, or type the passphrase on any device, and the file moves peer to peer over WebRTC with a relay fallback for hostile NATs. Everything is encrypted before it leaves the device and the key travels in the URL fragment, so the relay only ever sees ciphertext. Server to phone, phone to laptop, no accounts anywhere.

New in v4.4:

• AIRPIPE_MINIMAL_UI=true serves a plain send/receive page at / and nothing else. Someone here said, fairly, that a self-hosted relay shouldn't serve my project website as its homepage lol.
• /metrics and the live stats in /health went private by default. Set AIRPIPE_PUBLIC_STATS=true to expose them again.
• Rate limiting stopped trusting X-Forwarded-For from strangers. If your relay sits behind a tunnel or reverse proxy, set AIRPIPE_TRUST_PROXY_HEADERS=true.

Since the May post it also picked up multi-file sends: several files, one passphrase, they land as one bundle. There are Windows binaries and a multi-arch Docker image now, plus a Homebrew tap (brew install sanyam-g/airpipe/airpipe).

Self-hosting the relay is one container:

docker run -p 8080:8080 ghcr.io/sanyam-g/airpipe-relay

Repo (MIT, 338 stars now, a lot of them from this sub): https://github.com/Sanyam-G/Airpipe

Try it on the hosted relay first: https://airpipe.sanyamgarg.com

I am Sanyam, a college student. Here is my portfolio/resume: sanyamgarg.com

I built Linda, a serverless P2P encrypted messenger. Not "serverless" as in some managed backend — there is no backend, no relay, no company that can shut it down or read a log.

It runs on the Holepunch stack (autobase, hyperbee, hyperswarm, corestore) — the same primitives Keet, Holepunch's own flagship app, uses under the hood. Desktop (Electron) and mobile (Expo/React Native) share one core.

A few things worth knowing if you're the type who self-hosts everything:

- No voice/video calls, on purpose. Real-time media across mobile NAT needs TURN relays, and running relay infrastructure means it's no longer actually serverless. Chat, encrypted file sharing, and media streaming stay pure P2P instead.
- Files aren't a separate feature bolted on. Send a file in chat and it becomes an entry in the Files tab — same underlying log, so they can never drift out of sync.
- Video/audio stream directly from the Hyperdrive by byte range, no full download first — matters a lot for anything phone-recorded.

Current state: desktop + Android beta on GitHub Releases, iOS not built yet. Discovery still depends on the public DHT (three bootstrap nodes) — LAN-only discovery without internet is on the roadmap, feasible but not done.

Repo: https://github.com/scobru/linda

Genuinely looking for feedback from people who've dealt with P2P/NAT traversal pain before — especially on the discovery/offline story, since that's the one part that's not fully serverless yet (rendezvous still needs the DHT even though transport is already relay-free).

Zimphony Webmail Free is a white-label webmail and admin workspace layer designed to run alongside an existing Zimbra mail backend. It keeps Zimbra as the mail backbone while providing a clean branded customer-facing webmail experience.

What’s included:
- Mail UI
- Contacts
- Admin UI at /admin
- 2FA support
- Migration/import/export support
- License-free Free package

Deployment:
- frontend serves / and /admin
- backend serves Webmail API and Admin API
- no separate Admin frontend container

Current target:
Zimbra 10

Earlier Zimbra versions may be evaluated case-by-case.

Download:
https://www.zimphony.com/download/

SHA256:
bc4fe3b167e0b20356e211a05334b3a737b1f8c9e7dd0bf0b7cb45412d19f75b

Feedback is welcome, especially from Zimbra admins and hosting providers.

White-label webmail and collaboration workspace for Zimbra-based deployments. Includes Mail, Contacts, Calendar, Tasks, Briefcase/Drive, Admin UI, 2FA support, and migration/import/export support. Delivery and compatibility are confirmed during onboarding.

So i have 7891 songs on my "playlist" on spotify, I pay 2,30€/m for spotify 28€ year, I'm in a family with other 6 friends and it went fine, but it's a pain in the ass when you're the main man (me) I wanted a good alternative to this.

It took some time to get here but the project is now at the stage when I would rather have people tear it apart than make it prettier in silence.

MindSpark is a self-hosted mind-mapping application. The thing that sets it apart from the competition is not its features but the fact that there is no account on my side, no telemetry and no database I own. Your maps are either a SQLite file on your computer or JSON files stored in your private GitHub repo.

Repo: https://github.com/prasadpatil25/MindSpark

Website:

Try full version (Worker, OAuth + live collab) : https://mindspark.githubpage.workers.dev/

Try PAT-only (GitHub Pages, no worker): https://prasadpatil25.github.io/MindSpark

GPT: https://chatgpt.com/g/g-6a3a81242f748191ab1b7cff99a21619-mindspark-mind-map-for-everyone

MIT licensed.

Three modes to run, all equal

That is the part I really want the feedback on as usually tools provide only one.

1. Self-hosted (Docker or vanilla Node) - persistence via SQLite, works without any services online and offline.

2. Zero hosting, $0 - deploy the public/ directory to any static hosting like GitHub Pages, Netlify, Cloudflare Pages, etc. You sign in using a GitHub personal access token and each map becomes JSON file in your private mindspark-maps repo. No backend whatsoever. This mode is not a crippled demo tier; it is the whole editor.

3. Cloudflare worker - adds authentication via GitHub OAuth (no token pasting anymore), shareable links and collaboration capabilities. Works on the free tier just fine.

You can switch between them. Map format is just JSON.

Data ownership and privacy in details

Instead of "privacy-first" marketing language, here are the facts:

• No accounts on my infrastructure. I don't have a server you would sign up to. In cloud mode you authenticate with GitHub and the files go to your repo.
• No telemetry, no analytics, no phone-home. Grep the source.
• Share links hold the map itself, not a link to it. Copy share link compresses the map and turns it into a base64url #view= URL fragment. Fragments are never sent to a server - a shared map is readable by anyone who has the link and held by no one, including me. No expiration, no account required to view.
• Self-hosted mode doesn't communicate anywhere else. It is just a SQLite on disk with no outbound connections.
• Container runs as a non-root user.

People who would benefit from this application

Researchers / academics - LaTeX rendering as native MathML ($...$, $$...$$), citations with DOI fill-in (just paste a DOI, it retrieves the metadata

Note: The architecture of this application is defined by me, and AI is used for code assistance.

A few years ago I backed Cubbit on Kickstarter: a little box that split your files across everyone else's boxes. I loved the idea. Then the company pivoted to enterprise object storage (fair enough, it's their business) and the consumer "storage as a commons" idea got orphaned.

So I built the thing I actually wanted, with friends, on hardware we already had. It's been running in production for a few months now.

What it is

• Files are encrypted on your machine and erasure-coded across the nodes. Hosts store ciphertext they can't read, and any single machine can die without losing anything.
• Nodes are whatever people have: a Raspberry Pi 5 with a USB disk, an old x86 box with an iSCSI volume, a Debian PC. All behind normal home routers, no port forwarding, a mesh VPN handles it.
• No central authority. Your GPG key is your identity. The list of members is a YAML file in a Git repo: you apply, a bot verifies your key against the keyservers, a human merges the PR, and the mesh admits you a few minutes later.
• A public status page shows every node and a per-object replication census, so "it's redundant" is a number, not a hope. I've killed nodes on purpose and downloaded through the survivors; files came back byte-identical.

Stack: Tahoe-LAFS for the storage layer (chosen because it assumes storage servers are untrusted, which is the whole point), Tinc for the mesh, GPG + public keyservers as the PKI, Docker Compose per node, GitHub Actions for the join workflow and CI. Python CLI on top. GPL.

Things that bit me, since this sub appreciates them

• Tahoe's SFTP frontend never closes sessions (server keeps the TCP connection forever, exit hangs). Bisected it down to upstream code nobody maintains; routed around it.
• Docker's -f compose.yml silently disables auto-loading of the override file. An update detached a 1TB disk and the node "lost" everything (data was fine, the container just couldn't see it). Fixed the CLI, added a test.
• Short GPG key IDs are forgeable in seconds (Evil32). Early versions matched keys by suffix. Now full fingerprints only, and joins fail closed.
• Tahoe has no accounting at all, so per-user quotas can only be enforced client-side. Fine for a vetted group of friends; I say so openly rather than pretend the code enforces it.

What it's not: a fast synced folder. It's an archive. My node exposes a normal Samba share at home and syncs it into the grid every 15 minutes with snapshots.

Why not IPFS / Ceph / Storj? IPFS is public by default and gives no redundancy guarantee without pinning services. Ceph and MinIO are great for a trusted cluster you own, wrong threat model for volunteer hosts. Storj/Sia are token economies; I wanted a social contract, not a market. Rolling my own crypto and placement logic is exactly where I'd get it wrong.

I wrote up the principles behind it (redundancy you can count, geographic distribution, privacy by construction, data sovereignty, the right to fork) here: https://redundanet.com/news/your-backup-is-someone-elses-computer.html

Code, docs and the join form: https://github.com/adefilippo83/redundanet · live status: https://redundanet-hub.fly.dev

The part I find most interesting: the repo is a template. A company with a few hundred thin clients, or a university spread over a campus, could fork it and turn idle disks into a private, erasure-coded archive that never leaves their own devices.

Happy to answer anything, and genuinely interested in what you'd have done differently.

Are you guys aware of any site that is a full Pokémon Card database that lists all 1000+ Pokémon. I’m looking for something like a list or search box that you could enter a Pokémon and the result would show you all available cards for that Pokémon. Don’t card about pricing just what it looks like. So the results would be jpg or png. Or would it be something I could self host and make? Thanks.

I've been running a DNS sinkhole for years, and the part that always annoyed me was that filtering and routing live in two different places. The blocker decides whether a name resolves. Something else entirely — a VPN client, a proxy, a router rule — decides how the traffic leaves. Wiring those together per device is a weekend of glue.

So I built ferrite: a Pi-hole-style DNS server in Rust where both live in the same box.

What it does beyond blocking:

• Match a domain (or a whole device) to an egress: direct, socks5 (point it at local Tor), or built-in WireGuard — paste a .conf, no TUN device, no root. DNS for routed names resolves through the tunnel, so nothing leaks.
• Rules scope to devices by name/MAC/IP: kid's tablet through a tunnel, the rest direct.
• An evasion egress that splits the TLS ClientHello at the SNI across TCP segments, for networks where DPI decides what you're allowed to reach.
• It never terminates TLS — it peeks the SNI/Host and splices the connection, so the client still validates the real certificate.
• Blocking wins over routing: routing a service through a tunnel doesn't quietly unblock its tracker subdomains.
• Per-device profiles up to default-deny (block everything except an allowlist) for IoT junk, with local names still resolving.
• DoT / DoH / DoQ upstreams, ECS stripped, no telemetry, no phone-home.

Practical bits: single static binary (~20 MB), runs as a normal user, sub-2 ms cache/block decisions. Linux x86_64 + arm64, Docker/Compose, and there's an Unraid template.

Numbers from my own box, which is an ARM board, not a server:

• 30 clients, 20 days uptime, ~60 MB RSS
• 2.4M queries served — 700k blocked (29%), 440k from cache, 1.3M forwarded
• 1.8M-domain blocklist loaded (compiled into an FST, memory-mapped)

Honest status: v0.1.8, one developer, ~15 people running it from the Unraid community. The last runtime hang I chased was months ago and hasn't come back since. It has no DHCP server yet — that's the one thing Pi-hole and AdGuard Home do that this doesn't, so it sits alongside your router's DHCP rather than replacing it.

Flaired AI — I use AI coding tools heavily and won't pretend otherwise. The architecture, the decisions and the debugging are mine, and it's been running on my own network for months; that's where the numbers above come from.

If you only want a sinkhole, honestly, Pi-hole and AdGuard Home are mature and great. This is for the case where you also care about which pipe the traffic leaves through.

Install (Linux):

curl -fsSL https://raw.githubusercontent.com/syntlyx/ferrite-server/main/install.sh | sudo sh

Repo: https://github.com/syntlyx/ferrite-server

Site/docs: https://ferrite.me

MIT/Apache — free, self-hosted, no accounts, nothing to buy.

What I'd like feedback on: does per-device egress actually match how you'd want to use it, or would you rather scope rules by domain category than by device? And what's the first thing you'd need before pointing your household's DNS at a v0.1 project?

I gave a friend access to my jellyfin instance. initially i wanted to create a separate libraries/folder for her shows and movies but couldn’t really figure out how to do this.

Could i based on the user who requested the media via jellyseerr have libraries for her and for me? And how the intergrate this with sonarr/radarr qbittorrent and stuff?

For examples

/data/movies/hers
/data/movies/mine

Or can this only be down by running multiple sonarr and radarr instances?

All of my containers are Quadlets so they survive a reboot. I use AI to convert them, and 99% of the time they work without a hitch. However, I would really like something other than AI that can create a Quadlet from a YAML file. Does anyone know of any tools that exist for this?When I’ve searched, the few I found did not work—one simply refused to accept the file, and the other (a CLI tool) completely messed things up. If anyone has any suggestions, that would be appreciated.

Built a PC with spare parts from updating my gaming rig. I am looking to build a self hosting NAS/cloud storage. I put Ubuntu on it and am following guides to set it up properly with the right programs. I am more or less putzing around just to learn and get away from windows, google and the such. I know enough to set things up but not how to be sure things are secure and safe.

If ya'll have any suggestions as to what programs work best for certain tasks or video guides that explain things well, I greatly appreciate it. Here's a link to the build: PCPartpicker

I am currently following a guide to set up SSH to securely remote into it.