If the access is only over VPN then http is fine, that’s how I access my arr setup. You can create certificates and manually upload them to radarr and other sites but it’s not necessary.

Hetzner is great as a provider, highly recommend.

I use authentik with fail2ban, crowdsec and ufw. I use netbird to act as a VPN between different servers - most services need users to login through there but have a couple on the internet. I also restrict countries to ones my clients are on and update when im going on holiday.

I use caddy as my reverse proxy with rate limits and crowdsec. I moved from NPM just to try it and liked it.

SSH is on a different port and restricted to keys only. I also setup ntfy to notify my phone if there are logins (to check it’s just me).

I use unattended upgrades for security but try to upgrade frequently the servers and docker services.

+1 for authentik

I think Debian Server + Docker compose. Its the easiest way to get started and has the most documentation for. To me, the OS itself is the least concern - just get something maintainable. Then choose services you want from https://selfh.st/apps/ and have a go with them. Most services give you docker compose scripts so that is by far the easiest way.

If there are two of you with accounts, then I would suggest these:

• Reverse proxy (caddy, nginx, etc)
• SSO authentication (authentik, authelia etc)
• VPN for access (wireguard, netbird, tailscale etc)
• Security (fail2ban, crowdsec, etc)

On top of Home assistant and the Jellyfin / arr stack you mention, I would recommend Immich (google photos), Paperless NGX (letter scanning / management), Vaultwarden (password manager), FMD (find my device server for android phones), and SearNGX (private search engine).

Potential alternatives would be NixOS (fully scripted) and Proxmox (better containerisation but still got to decide what you install on each container, such as Debian + docker). You could also use podman instead of docker compose, which is more secure but a bit more effort to adapt to. However, if access is only through the VPN and you have two users, Debian + docker would be fine.

Adding to this - first thing I self hosted was vaultwarden so keeping track of the admin accounts is so easy. Make an admin account at the start to set it up, then only use that in a private window for any settings changes needed. My personal account is then like a normal user which helps me test it and keep it separate. I try and use SSO for everything so it also tests if that works correctly - I.e. after setting it up I’ll login to my personal account on the SSO to see if it registers correctly and that my username is given regular access.

Yep! Whoops

deleted by creator

I have self hosted for years using Authentik and have 50 + services. Postiz has been one of the most challenging to spin up and maintain. The documentation is not up to date, the software is constantly changing and I had to tweak lots to get it to work. Even now, it seems to crash after a few days and haven’t had the chance to investigate. All these posts I set up didn’t go through and now if I turn it back on, it’ll release them all in one go before I can get in to stop it, or have to revert to a fresh install…

The vast majority of services and not like this so don’t get disheartened! Try some other ones first them come back to this when more experienced. I recommend Bento PDF, ConvertX, outline wiki, vikunja and immich (if you have the storage space).

At first, try to stick to software on Authentik’s guides (https://integrations.goauthentik.io/). Once you do a few OIDC and forward proxy services you’ll get the hang of it.

When I get a chance I’ll share my docker compose SSO settings and authentik redirect uri that worked for me with the caveat that the software crashes for some reason.

We’re all fine with piracy because of enshittification and the spread of shows/films across too many services. Happily paid for Netflix when it was good but it slowly got worse and worse. If there was one fairly priced single (maybe max across 3) source(s), I’d switch back.

In terms of stream vs arr’s. Quality of video and sound matters to us but not for everything we watch. I actually use Stremio with Debrid for most items, especially my family choosing what to watch. When I want top quality I will use my arr stack. When stremio fails I’ll use my arr stack. For TV shows we watch regularly we use the arr stack, partly to remind us when they’re released. For TV shows we regularly re-watch I use the arr stack.

GDS is one area the government has done really well.

I can’t seem to login to the root user on two different mariadb databases to make those changes so must be doing something wrong

Awesome idea then, I’ll have to kook into it.

Just to clarify for my simple brain - vps1 has just 80/443 open, vps2 just has a wireguard port open (51825 or whichever). Vps2 has no domain pointing to it’s public IP, vps has your domain pointing to it. Vps1 and home server have wireguard configs pointing to the vps2 public IP, so punch through automatically. Is that all correct?

I think I have the same setup but with vps1 + 2 combined but that means it’s public IP is easily found by the domain (one includes a public business website) and has WG ports open (although my understanding is this in itself is not an issue as WG gives no reply)

Have you opened an SSH port on both vps1 and vps2 for backup or happy to rely on wireguard? Thinking about it, you could open up the port on the vps but use the providers firewall to block the port - if needed can login to their site, open the port and then SSH in - would this work? They have KVMs for emergencies but just trying to think of worst case scenarios.

Good point, Romm can integrate well with MuOS, Playnite and other client side software you and others can install onto their actual devices. I’ve used Playnite on my devices to manage the emulator side and download the ROMs from the ROMs server.

In theory, you could also try a sunshine server and moonshine client to steam the games from you’re server but guessing it would only work well over a local network, not over the internet to friends

It’s great to have options! Never heard of this one so will check it out too. That’s part of the fun isn’t it haha

Check out Romm. Not every romm can be streamed but think it meets your needs.

I have a mix of Debian and Ubuntu servers. I’ll update manually anyway but for future cases, would unattended-upgrades set to security upgrades run daily be enough to stop this type of issue?

Did some one ask for dust cos I got plenty! Also have one desktop with 30TB of memory, separate small form for HA and Pihole, networking equipment, cooling fans and a UPS all packed into one (un)tidy cupboard. The door doesn’t quite close but enough to hide it from my partner!

Others have explained it well. Just want to add a recommendation to use the trash guides (https://trash-guides.info/) to configure these apps. You can use Notifiarr to sync these changes automatically too

What difficulties are you finding with it and are you switching from Google? The results are as custom as Google given they haven’t scraped your life history so wondering if that’s it? I’ve been using DDG without any issues. About once every 6 months I struggle to find something so try the Google bang but have never found better results. In fact, I was shocked last time how crap the Google results were, just full of AI generated crap and SEO based crap.

To be honest, DDG is also struggling with that now as it’s based on Bing. I have been trying a public searxg but not found it very good so far.