Hi guys,

I'm pretty new to selhosting. I have a basic stack with Jellyfin and the *arr tools.

I'm also using Radicale, Vaultwarden, Immich and Caddy.

Currently I'm connecting with Tailscale, and I feel like this is the safest thing to do. However I would like the stack to be very accessible for my friends and family, and make it so they don't have to turn Tailscale on each time they want to watch a movie or something.

So I was thinking of exposing on internet directly, but how safe is it? I think if Caddy is in front, it could be ok? Since I also have the passwords and everything. Is it worth the risk?

Is there any general recommendation, doc on that?

Thanks a lot for your help

My mom currently has all her movies on an external HDD plugged to her TV, but it's a pain to find the movie you want and it's a pain to get new movies for her. I told GPT I wanted something I could control remotely, even "acquiring" new media.

I have never setup any server before, does this all make sense? Are there any better options for what I want?

UGOS Pro forced update broke Docker permissions (Nextcloud “apps directory not found”, MariaDB crash loop) — root cause was UGOS’s opaque ACL management, not Docker itself

NAS: UGREEN DXP4800 Plus OS: UGOS Pro (forced update, previous version flagged as obsolete) Docker Engine: 26.1.0 → 29.4.3 (docker-compose-plugin 2.26.1 → 5.1.3)

Symptom

Right after a forced UGOS Pro system update (1.17.0.0095, ~July 4 2026, which bumps Docker Engine to 29.4.3 for a security fix — CVE-2026-31431), my self-hosted Nextcloud (LinuxServer.io image) became unreachable with:

apps directory not found! Please put the Nextcloud apps folder in the
Nextcloud folder.

Shortly after, MariaDB (also LinuxServer.io image) went into a continuous crash loop with:

/usr/bin/mariadbd-safe-helper: Can't create/write to file
'/config/databases/xxxx.err' (Errcode: 13 "Permission denied")

What did NOT change

Before assuming anything, I checked (and ruled out) all of the following:

• Docker bind mounts — correct and unchanged (/config, /data mapped exactly as before)
• File ownership — correct everywhere (docker_user:docker_group, UID/GID 1005:1001)
• Classic POSIX permissions (rwx) — looked correct at every level (0755/0770) when inspected with stat/getfacl, even as root
• config.php syntax — valid (php -l passed)
• Environment variables — unchanged, consistent with the compose file
• AppArmor — no DENIED entries in kernel logs, even after a full reboot
• SELinux — not active
• userns-remap — not configured in daemon.json
• The problematic symlink (/app/www/public/apps → /config/www/nextcloud/apps, used internally by the LinuxServer.io image) — verified intact; the exact same failure happened even accessing the real path directly, bypassing the symlink entirely
• OOM kill / container restarts — none (RestartCount: 0, OOMKilled: false) So: correct ownership, correct classic permissions, no MAC framework blocking anything — and yet, testing as the actual unprivileged user the containers run as (docker exec --user abc ... stat ... / touch ...), every operation failed with Permission denied.

Root cause

UGOS treats its Control Panel → Shared Folders → Permissions screen as the single source of truth for ACLs — not the raw Linux filesystem. The forced system update silently rewrote the real on-disk ACLs for the Docker shared folders involved, without the panel necessarily showing any obvious inconsistency.

Critically: manual ACL fixes from the CLI did not durably work. I tried both:

sudo setfacl -R -b /path/to/folder # strip ACLs sudo setfacl -Rm u:1005:rwX /path/to/folder # explicitly grant the UID rwX

Both commands completed with no errors, and getfacl confirmed the rule was written — but the actual access as the unprivileged UID kept failing afterward. UGOS appears to resync/enforce its own ACL state on top of (or instead of) whatever raw POSIX ACL you set manually, especially after events like a forced major update.

This matches a pattern independently reported by another user with the exact same NAS model (UGREEN DXP4800 Plus) hitting a nearly identical issue with Syncthing’s filesystem watcher — permission denied despite the panel showing Read/Write, resolved only by fixing the ACL, with the same conclusion: “UGREEN/UGOS handles ACLs in a non-standard or opaque way.”

What actually fixed it

Only fixing the permissions from the UGOS Control Panel itself worked — and the propagation mode matters:

1. Open File Manager → navigate to the specific folder (not the shared folder root, to limit blast radius)
2. Right-click → Properties → Permissions tab
3. Find the individual row for the relevant user (e.g. docker_user — it may appear under multiple groupings, e.g. “General User” and its Unix group; check it in both, UGOS treats it as one identity)
4. Check Read/Write only on that individual user’s row (not the aggregated group/category row)
5. Before confirming, open the “Apply permission to” dropdown at the bottom and select “Overwrite: overwrite all permission settings of sub-levels” — NOT “Merge” (Merge leaves whatever broken state already exists in deep subfolders untouched, which is the actual problem)
6. Only then click Confirm

This forced a real recursive rewrite down to the deepest subfolders and immediately resolved access for the affected containers.

Side effect to watch for

The “Overwrite” ACL operation on the MariaDB folder reset custom.cnf to world-writable (777). MariaDB silently ignores world-writable config files for security reasons:

Warning: World-writable config file '/config/custom.cnf' is ignored

Fixed with a plain chmod 640 on that single file (confirmed only mariadbd reads it, so this is safe) + container restart. Worth checking this every time you have to re-apply ACLs on a MariaDB data folder on this platform.

Takeaway / operational rule going forward

On UGOS, treat the panel as the only durable way to manage ACLs on anything living inside a Shared Folder — including Docker volumes. setfacl/chmod/chown from SSH may look like they worked (no errors, getfacl confirms the rule) but can be silently overridden. If you hit Permission denied errors after a UGOS update despite ownership and classic rwx bits looking completely correct, this opaque ACL layer is the first thing to suspect — not AppArmor, not SELinux, not Docker itself.

Posting this in case it saves someone else the two days of diagnosis it took me.

Environment: UGREEN DXP4800 Plus, UGOS Pro, Docker Engine 29.4.3, Nextcloud + MariaDB + Redis + Nginx Proxy Manager (LinuxServer.io images), Portainer.

Hi everyone!

I'm the developer of ShelfDroid, an open-source Android client for Audiobookshelf.

One thing I wanted—but couldn't find in other clients—was the ability to manage my Audiobookshelf server directly from my phone without opening the web interface. I often wanted to check what's happening on my server or manage my library while away from my computer, so I started building those capabilities directly into ShelfDroid.

Library & Playback

• Audiobook and podcast playback
• Offline downloads

Server Management

• Manage libraries and media (books, podcasts, and episodes)
• Manage RSS feeds
• Manage users
• View backups, logs, and API keys
• View active and listening sessions

Screenshots

I've included three screenshots showing some of the server management functionality:

1. User management — Edit Audiobookshelf users and their settings directly from the app.
2. User listening statistics — View a user's listening activity and stats from your server.
3. Server logs — View Audiobookshelf server logs directly from your phone, which is useful for quickly checking what's happening without opening the web UI.

Planned Features

• Support for the remaining server management features
• Automatically download new podcast episodes to the app for offline playback

ShelfDroid is built natively for Android using Kotlin and Jetpack Compose, is fully open source under the AGPL, and is available on the Play Store, F-Droid, and GitHub.

Play Store: https://play.google.com/store/apps/details?id=dev.halim.shelfdroid
F-Droid: https://f-droid.org/packages/dev.halim.shelfdroid/
GitHub: https://github.com/100nandoo/shelfdroid

I'd love to hear your feedback, especially about which Audiobookshelf server management features you'd find most useful to have on mobile.

Saw this today and thought its worth sharing.

https://www.theregister.com/columnists/2026/07/20/airbus-takes-flight-from-aws-what-happens-next-is-critical/

everyone keeps talking about Airbus leaving aws. But i think the more interesting question is why.

For years it was just “put everything in the cloud”. Less infra, less problems, less people to manage it.

Now it feels like bigger companies are asking a different question. Do we really want all our critical systems under another countries rules?

This isnt even about AWS being bad. its is honestly great.

Its more about control. If your data, manufacturing, internal tooling, basically your whole company depends on one hyperscaler, maybe thats becoming a risk by itself.

We made a short video talking about it because i think this discussion is only gonna get bigger. just some thoughts. If anyone wants it:

https://youtube.com/shorts/GITpXztVglQ?feature=share

Maybe im completely wrong, but if Airbus is doing this i cant imagine they are the only one thinking about it.

Do you think this is mostly politics? Or are we gonna see more companies slowly moving away from hyperscalers over next few years?

Hi,

tldr: Which needs ECC memory more Proxmox or TrueNAS media storage?

Help me choose which one gets 16GB of DDR4 ECC memory and which one gets 64GB of non-ECC DDR4 memory.

\
I have proxmox installed on a HP Z440 with a Intel Xeon E5-1630 with 4 cores, 8 threads, and 16GB of DDR4 ECC memory.

I have have quite a number of containers on it, which live on an SSD. There are also two 8 TB HDDs for media file storage for Jellyfin, Audiobookshelf, and such.

\
I recently borrowed an old computer from one of my brothers in law, that was just collecting dust in a basement.
I have been told I can buy it off him if it suits my needs.

It has a Intel Core i7-6700 with 4 cores, 8 threads, and 64GB of DDR4 memory (non ECC).

\
I have wanted to have my media file storage on a NAS for a long time, but I haven't been able to afford one.

So I was going to install TrueNAS on the Core i7, but then I thought: Isn't it better to have the file storage on ECC memory?

\
So the full question is: Should I move my storage on to the Core i7 with no ECC memory, or should I migrate proxmox on to it instead?

So, im looking to re-organise my dockers on my server. I am trying to come up with my own standards of where on the file system to put the docker compose/configs and persistant data.

I see the consensus points toward using either /opt/docker/service or /srv/docker/service.

But looking at the descriptions for the /opt/ and /srv/ directories on FHS:

/opt is reserved for the installation of add-on application software packages.

/srv contains site-specific data which is served by this system.

Would it not make sense to store the docker compose/software configs on /opt/docker/service and the persistent data in /srv/docker/service?

Im clearly overthinking this, but im interested on peoples thoughts on this method? Am I overlooking something fundamental that makes this organisational scheme over complicated and unnecessary?

Hi there!

I’ve been using Synology Drive for years to sync files between computers and my NAS, access them through the web, restore older versions, and occasionally share them.

Recently, I set up Nextcloud AIO on a separate VM, with data and backups stored on my NAS via NFS. After using it for a while, I’m not sure the extra complexity gives me much for my use case.

What I need is pretty simple:

• reliable file sync
• version history
• web and mobile access
• occasional file sharing
• straightforward backups

I don’t use Nextcloud Office, Talk, Mail, Deck, Tasks, Photos, or Memories. Immich already handles my photos.

Nextcloud offers more control, hardware independence, some E2EE (via folders), and some app ecosystem. But it also means maintaining a VM, containers, a database, Redis, a reverse proxy, updates, backups, and app compatibility.

Synology Drive is more limited, but it’s integrated with the NAS, requires almost no maintenance, and works with normal shared folders accessible over SMB.

For people who have used both: what practical advantages make Nextcloud worth the additional complexity? Is Nextcloud simply the wrong tool when you only need reliable file sync / personal cloud rather than a full collaboration platform?

Thanks!

I'm not looking for OneDrive, Dropbox, Google Drive, pCloud or Syncthing. I'm already familiar with concepts like Delta Sync, Incremental Sync, and Block-Level sync.

I'm looking for a native Windows tool that performs efficient local incremental synchronization between disks, similar to rsync's behavior.I'm specifically asking about local disk-to-disk synchronization on Windows, not cloud synchronization.

I know about:

Robocopy FreeFileSync rclone rsync via WSL/Cygwin/MSYS2

But is there a native Windows implementation that supports block-level or delta synchronization?

Or does everyone just use WSL nowadays?

EDIT: I just realized that Windows actually used to include Briefcase, a built-in local file synchronization feature. It supported two-way file synchronization and conflict reconciliation. It was eventually deprecated and removed as Microsoft's focus shifted toward cloud synchronization. I'm surprised there still hasn't been a modern native successor.

I'm totally fine with commercial software. Price matters more to me than whether it's open source.

Hi everyone!

SuggestArr v2.10.0 is now available.

This is one of the largest updates so far and introduces a complete approval workflow for recommendations, dedicated Trakt recommendation jobs, per-user request visibility, and much more flexible Seerr configuration.

✅ Review recommendations before downloading

Recommendations no longer need to be sent to Seerr immediately.

You can now enable an approval workflow globally or only for specific jobs, allowing you to:

• approve or reject recommendations;
• blacklist unwanted titles;
• retry failed or rejected suggestions;
• perform bulk actions;
• pause jobs while recommendations are waiting for review;
• automatically reject pending recommendations after a configurable number of days.

This makes it possible to keep recommendation generation automated while retaining full control over what is actually requested and downloaded.

🔄 Dedicated Trakt recommendation jobs

Trakt recommendations can now run as their own scheduled jobs, with:

• dedicated filters;
• media-user selection;
• approval settings;
• Seerr destination and identity configuration.

👥 Per-user request visibility

Requests can now be associated with individual Plex, Jellyfin, and Emby users.

The Requests page can display and filter requests by their originating media user, while preserving that association throughout the recommendation and request workflow.

Each job can also use a specific Seerr identity.

⚙️ Per-job Seerr configuration

Jobs can now independently select:

• server;
• quality profile;
• root folder;
• Seerr user identity.

This should make multi-user and multi-library installations significantly easier to manage.

🔍 New recommendation filters

This release also adds:

• genre inclusion filters;
• an option to suggest only the first movie from a collection;
• an option to pause jobs when previously suggested content remains unwatched.

🖼️ Reduced TMDb traffic

Background rotation has been reworked to avoid unnecessary TMDb requests.

SuggestArr now:

• caches TMDb responses;
• reuses the backdrop catalog for two hours;
• rotates backgrounds from locally cached results;
• stops requesting backgrounds when the browser tab is hidden.

A manual cache-clear endpoint and configurable cache settings have also been added.

🛠️ Fixes

Among the fixes included:

• Seerr login with URLs ending in /;
• standard cron weekday numbering;
• Jellyfin fallback from VirtualFolders to MediaFolders;
• improved Seerr profile validation;
• corrected media-user context for Trakt jobs.

Thanks to everyone who opened issues, tested nightly builds, and contributed feedback.

GitHub release:
https://github.com/giuseppe99barchetta/SuggestArr/releases/tag/v2.10.0

Full project:
https://github.com/giuseppe99barchetta/SuggestArr

First of all, moderators, I hope this falls under the "Wednesday exception", if not, feel free to remove the post and I will repost it on Friday ! (PMDA exists for approx. 2 years by the way...)

A while ago I wrote a small tool for one job: detect duplicate albums in my Plex music database. That's it. That's what PMDA was, and the name stuck from that first life.

But I'm a music hoarder with decades of rips, downloads and transfers, and once the dupes were found I kept hitting the next problem, then the next: albums with no usable tags showing as "Unknown Artist", incomplete rips hiding in the library, missing covers, no way to know what was worth upgrading. I've used and genuinely like Plex, Jellyfin, Navidrome, Roon, foobar2000, and the usual tools like beets, SongKong, Picard. Each one covers a slice, but none of them understands the collection. So the dupe script kept growing, and at some point I accepted it had become something else: a self-hosted server that takes care of the library itself, and plays it.

The librarian part (what makes it different):

• Identifies albums even without usable tags, using folder structure, track durations, cover OCR and acoustic fingerprints. When it isn't sure, it says "I don't know" instead of guessing.
• Cross-checks MusicBrainz, Discogs, Last.fm, Bandcamp, Deezer and iTunes. Fetches covers, artist images, bios, reviews and public ratings.
• Detects duplicate albums and editions, compares them (format, bitrate, completeness) and quarantines the losers. Everything is reviewable, nothing is deleted without you.
• Flags incomplete rips and broken albums instead of letting them pollute the library.
• Shows each artist's full discography, including the albums you don't have, so you can see what's missing at a glance.
• Sorts a messy intake folder into a clean Artist/Album tree, one folder per release, compilations correctly filed under Various Artists. It can export that cleaned copy to feed Plex, Jellyfin or Navidrome if you want to keep your player.
• Ships an MCP server: plug Claude (or any MCP client) into your own library and ask it things like "which albums did I add this month that have no cover" or "find the box sets". Your data stays home; you bring your own assistant if you want one. Nothing AI is baked into the server itself.

How the intake works: you point PMDA at two folders, a messy intake and a clean library. Everything you drop in the intake gets identified and moves out on its own merit: verified matches are filed into the clean Artist/Album tree, albums whose tags you chose to trust follow the same path, and duplicates or incomplete rips land in a review quarantine instead of polluting the library. The intake empties itself over time, the library only ever receives clean albums, and nothing is deleted without your say.

The player part:

• Full web player: queue, volume leveling (EBU R128), 10-band EQ, synced lyrics, smart playlists, internet radio, and personal radios built from your own listening history.
• iOS app: offline downloads, background playback with lock-screen controls, AirPlay 2 and Chromecast, translated into 17 languages.
• OpenSubsonic API, so your favorite Subsonic client (DSub, Symfonium, play:Sub...) works out of the box.
• ListenBrainz scrobbling per user.

The multi-user part:

• Invite family and friends by email; they get a small onboarding wizard and their own history, likes and recommendations.
• Users can recommend albums to each other inside the app.
• Optional weekly email digest per user: "what landed in the library this week", with covers and reviews.
• 2FA, per-user permissions, and a request system so guests can ask for what's missing.

Everything is self-hosted: no cloud, no telemetry, no account with anyone. It runs as a single Docker container (PostgreSQL and Redis inside; sqlite-based tools tend to struggle once you get past 1M tracks).

Native Linux and macOS installs are what I'm working on next.

More info, the full feature tour and the documentation are on the website: https://pmda.muteq.eu (docs: https://pmda.muteq.eu/docs).

The iOS app is on the App Store as of today: https://apps.apple.com/app/pmda/id6788288960

Android: the Play Store listing is still on my todo list, but the APK is ready. Say the word in the comments and I'll share it.

Full transparency: I built this with Claude as a coding assistant. I've been building software and products for 15+ years, I know exactly what I'm doing, and I use the best tool available for the job. The spec, the architecture, the reviews and the testing are all mine. Judge the product, not the workflow.

It's free: https://pmda.muteq.eu (Docker Hub: meaning/pmda).

It's a passion project by one person, so be gentle, and I'd genuinely love feedback from people with big messy libraries.

P.S. if you actually made it all the way down here (congratulations): there's a small Discord for PMDA users, discord.com/invite/2jkwnNhHHR

Screenshots (web UI):

Screenshots (iOS app):

hi all! I am new to self hosting and I'm wondering if my server is set up securely. I currently run the following docker containers:

- Jellyfin

- NGINX Proxy Manager

- authelia

- lldap

- homarr

- Dropped Needle (formerly musicseerr)

the only exposed ports I have are 80 and 443, and I forward everything to a cloud flare managed domain through npm. I use an SSL certificate on cloud flare for https and require authelia (with lldap) login to access any page.

am I being safe? what further steps can I take to secure my IP?

EDIT: I do not use cloud flare tunnels, just DNS hosting. From my understanding, cloud flare does not allow use of their tunnels for media. If I should seek out a different domain host, let me know.

EDIT 2: I was actually using cloudflare tunnels, they are turned off now.

The title is maybe a bit vague but let me try to explain. I am using Raindrop (for weblinks), iCloud Photo Library (for screenshots, 9Gag or Tiktok saves), Safari bookmarks (for frequent visits), Apple Notes / Reminders (for quick things) and a Download folder for everything else.

Then everything gets done, or distributed to Paperless, Obsidian, tasks and archives.

The thing is: I have so many places I loose track. I'd like to have one big bin to collect everything! From there I can distribute. It would be awesome if (local) AI can tag or name everything to help categorize.

Is there such a tool?

I have a selfhosted server which works quite well. A while ago we had an internet outage and realized a lot of the services didn't work due to DNS.

There's two DNS records we have, *.example.tld and *.home.example.tld

The "home" subdomain is local only. If we host our own DNS, it would likely work in case of an outage, though I'm unsure about certificates (currently they're done using Cloudflare ACME) but from what I remember they persist a while.

The problem is public services exposed to the WAN (yes I know, I have done as much as I can for security, and I know the risks). When outside of the local network, I'd want it to point to the public IP (through a proxy), but on the local network, have it point to the server hosting the proxy.

Self-hosting a DNS seems like the solution for this as well, but I feel like having a domain pointing to two different addresses depending on where you are would cause issues with cache. I've been told this is also a "Split DNS" but also to avoid it when possible

I could perhaps have it on both the regular DNS record, as well as the self hosted "home" DNS, but then I have the issue of the same service being served on two different addresses. It would maybe work for a TV, but dealing with it on a phone or a laptop you'd have to swap it every time there's an outage, which isn't very often so it's likely it would just be unused.

Everything is behind two reverse proxies, one for local-only and one for public

Guys anyone have any idea about selfhosting a DNS server on an old android phone? Android 4.4.2 with root access, idk if it possible or can be done, or even how, all rests I got was just "how to change the phone's DNS" but I want to use the phone AS A LOCAL DNS?

Everything in my homelab runs on Docker Compose, but it wasn't up to the security standards I wanted. I wanted something small and compose-only that just runs, so in April I started building one.

It checks for the important stuff against OWASP and the CIS Docker Benchmark: privileged containers, the Docker socket mounted into a container, host network mode, containers running as root, etc. There's a fix command that handles the safe edits as a dry-run diff.

pip install compose-lint, or Docker Hub. github.com/tmatens/compose-lint

This is my first open source project. I built it because I needed it. Wondering if it's useful to anyone else, and where you'd disagree with the severity calls.

Hey all!

I posted Parker here in December last year. Since then I’ve kept building it, so I wanted to share an update here rather than just link to my old post. Definately had some rough edges at launch and I definitely made some mistakes but I'm still plugging away and committed to making this a viable alternative self hosted comic server.

Parker is an open-source, self-hosted comic server for personal CBZ/CBR libraries. It does not provide, download, scrape, or link to comic files; it’s for organizing and reading a collection you already have.

Since my original post, Parker now has:

- More complete OPDS support

- Smart lists, reading lists, collections, story arcs, and stacks

- Insight pages for seeing relationships in your collection: Writer <-> Penciller, Writer -> Character, Penciller -> Character and Chracter Chemistry

-  Library Timeline pages for character and team tags, making it easier to explore a character or team’s reading history across your library.

- User ratings on comics

- A faster reader with manga mode, double-page spreads, long view (web comics), bookmarks, and resume behavior with many settings overridable on a per book basis.

- Reports for missing issues, duplicates, metadata health, storage analysis, and corrupt/low-page-count files

- Added a volume-level Following workflow so users can track future issues of a specific run without implicitly subscribing to every historical volume in a series like you would in a real comic shop.

- Optional parallel thumbnail generation and metadata parsing for much faster scans

- Multi-user library access and age-rating-aware permissions

- Better home/discovery rails like Continue Reading, Trending, and New from Following

- Improved layout for settings page in Admin

- A new admin diagnostic page to aid in troubleshooting as well as a bootup health check to alert the user of any major issues.

My philosophy is still “filesystem is truth”: Parker reads metadata from ComicInfo.xml inside your archives instead of trying to own or rewrite your library. This was the impetus of me starting to create Parker. The better the metadata is the better Parker will show insights and enhance discoverability.

GitHub:

https://github.com/parker-server/parker

Docs / Getting Started:

https://github.com/parker-server/parker/wiki/Getting-Started

I’d especially love feedback from anyone with a larger library, OPDS clients, manga/RTL collections, web comics or a Docker/NAS setup. The main things I’m trying to improve next are documentation, OPDS compatibility, migration tooling, and multi-folder library support.

Original launch post for context:

https://www.reddit.com/r/selfhosted/comments/1pk78gl/comment/oij4q61/

Thanks again to everyone who gave feedback the first time around. It was very helpful!

PS: There are screenshots in the original post to look at. I attached some new ones here of some of the newer functionality (bookmarks, insights, etc).

New version of Will Be Done is released! Will Be Done is offline-first, self-hosted task planner with visual weekly timeline.

The main idea is pretty simple: collect tasks, put them on week timeline. It works local-first, so tasks are stored locally in browser/desktop app. You can open app and use it even when your server or homelab is down. When server is back, sync will catch up between devices.

Main features right now:

• Offline-first task management
• Fast sync between devices
• Self-hosted server with SQLite
• Visual weekly planner
• Stash for tasks you want to keep in focus
• Projects with categories/columns
• Drag and drop
• Recurring tasks
• Task descriptions and checklists
• Vim-style keyboard navigation
• Desktop app for macOS, Windows and Linux
• Global quick add in desktop app
• Mobile PWA
• Todoist and TickTick import

And here is what changed since my last post:

• Added Stash feature. You can store tasks that don’t have exact date yet, but you still want to keep them in focus.
• Replaced floating task window with right sidebar. I think this is much less annoying and task details are easier to manage now.
• Added task checklists, including in card details.
• Added mobile card details page.
• Improved task action menu, with scrollbar support and Vim-style navigation.
• Added some timeline/project polish, including indicators for tasks that are already scheduled.
• Added PWA update notifications with better update toast.
• Added IndexedDB support for faster and more reliable local persistence. New installs use IndexedDB by default. Existing users can turn it on in settings page.

Links:

Demo: https://demo.will-be-done.app/

GitHub: https://github.com/will-be-done/will-be-done

Download desktop app: https://github.com/will-be-done/will-be-done/releases

Self-host with Docker:

docker run -d \
  -p 3000:3000 \
  -v will_be_done_storage:/var/lib/will-be-done \
  --restart unless-stopped \
  ghcr.io/will-be-done/will-be-done:latest

Then open http://localhost:3000/.

Would love to hear feedback, especially from people who care about self-hosting, offline-first apps, local-first sync, or replacing Todoist/TickTick with something open source.

I need to host approximately 150 websites.

From an architecture perspective, would you choose a manually managed LEMP/LAMP stack on headless Ubuntu, Proxmox with isolated workloads, or a server management panel?

I'm primarily interested in the long term tradeoffs around reliability, maintainability, scalability, and operational overhead.

Thanks.

Something I got wrong early and see repeated constantly: routing your DNS resolver through your VPN tunnel because it feels more private. On Mullvad (and most WireGuard VPNs) port 53 gets hijacked in-tunnel, so recursion inside it silently breaks and resolution quietly falls back to the VPN's own resolver. You think you're self-hosting DNS. You're not. The fix that finally made sense to me was Pi-hole -> self-hosted Unbound -> DoT to an encrypted upstream with direct egress, never through the tunnel. Encrypted either way, but the trust boundary stays mine.

That one lesson reshaped how I think about the whole stack. The rest of mine for context:

• VPN egress -> Mullvad (cash) on a self-hosted WireGuard gateway; roaming devices chain in via a self-hosted Tailscale exit node
• Segmentation -> 5 VLANs, only the core routes through the gateway, the rest egress direct
• Browser -> hardened Zen + Mullvad Browser
• Mail / Passwords / 2FA -> Tuta on a custom domain, Bitwarden, YubiKeys + Ente Auth
• Backups -> local NAS primary, encrypted offsite, offline cold copy
• OS -> Arch

Here's what I actually want to talk about: where's the line where self-hosting for privacy stops being worth the complexity? Every service I run is another thing that can break at 2am and another attack surface. I've talked myself into all of it, but I'm curious where others drew the boundary, and what you host yourself vs what you decided to just trust a provider for.

Hi folks, we have a tp-link router at our local community sports club. I have inserted a memory stick into the usb port. I store a slideshow on the drive and show this on one of the tvs. I would like to update the slideshow remotely, ie. outside the club’s network.

I’ve enabled “sftp(via internet)” with the standard port 22. and then tried to access it and get timed out. I’ve delved a bit deeper and the ole interweb suggests I create a port forwarding setting to redirect traffic to my internal sftp address. But this concerns me from a security point of view.

Does anyone have any experience/suggestions please?
Do I make the port forwarding setting?
Do I make another setting to make the sftp work?
Do I try something completely different?

Thanks in advance for your attention and advice.

Edit: Dockheck is a CLI tool to automate docker image updates. Interactively or unattended with notifications, image backups, exclude/include, labels, autoprune and more. Can be run as is, without configuration or with extensive options.

https://github.com/mag37/dockcheck

This year my AFK-life have been intense, so development have been slow and mainly squashing bugs. But others have kept contributed with suggestions on improvements, ideas on new features and some ready to merge patches.
So these last couple of weeks I've tried to squeeze in some time to bring it together in v0.8.0 and now v0.8.1.
New stuff in short:

Docker Compose -ready: - Now possible to run dockcheck within its own docker compose container (or docker run). - Easily set up your notifications and options, either in conf-file or env-vars, then let it run as any other container. - Optionally run it once interactively with docker run, no need for configs. - Run interactively between your scheduled compose setup with docker exec -it as usual.

New options: - -N No updates or checks; simulating updates to test notifications unconditionally. - -E Exclude containers from applying updates but check available, separated by comma. - -C Temporarily use default configs - override dockcheck.config file. - -o Hides the "No updates available" message and only shows updateable images.

New notification templates: - Home Assistant Event Integration - XMPP - Bark

I'm very happy this project still got traction considering all the large alternatives around. Wonderful community!

Disclaimer: No AI tools used what so ever from my end and encouraging contributors to refrain and/or explain.

Running local LLMs on more than one machine here, an old laptop plus my current laptop witth a couple of agentic workflows going. Right now it's mostly me manually keeping track of which box runs what model, with the ip and port written on my desk

For people further along than me: what are you actually using to manage this? Some dashboard service ? custom SSH scripts ? config files? And what's the part that's still annoying even with whatever you've settled on?

Good morning/afternoon/evening/night y'all, I am just making sure I have everything I could possibly have for now, I am a bit experienced in homelabbing and I am working on another project.

My hardware consists of:
- Optiplex 7040 for all of my server and self hosted needs; i5-6500 CPU with 24gb DDR4 and runs the following:

• NGINX Proxy Manager
• No-IP domain
• Home Assistant
• Homepage
• Authelia (authenticates for every service excluding Minecraft and Jellyfin)
• Dozzle
• Jellyfin
• Cloudreve
• Planning to setup Minecraft server dashboard

- Another Optiplex 7040 for my AI project; i5-6500 CPU with 24gb DDR4
- Acer laptop running a modded Minecraft server with i5-1135G7 CPU and 16gb DDR4 SODIMM RAM

I want to know if I can run multiple Minecraft servers on the Acer, preferably my modded server for myself and a very small group of friends (max player cap is already 4) and also have some lightly modded servers to rent out to others that they can access via my domain. Some of the mods I would be thinking of would just be DH/Voxy, server-side mods, Vivecraft and performance.

I also want to know if there is anything else I can possibly add or is this enough?

I've been running Immich on my home server for a while, and it's great — but I realized I almost never actually saw my photos unless I opened the app on purpose. Thousands of memories just sitting on a drive in the closet. Felt like a waste.

So I built ImmiChange — an Android app that pulls photos from your Immich albums and rotates them as your wallpaper automatically. Your own Immich server is the backend; the app is just the thing that puts those photos in front of you every time you pick up your phone.

I wanted it to be something I could set up once and forget. The annoying part turned out to be Android itself — battery optimizations love to kill background jobs — so a lot of the work went into making rotation actually reliable without draining your battery or eating mobile data.

How it works:

1. Create a dedicated album in your Immich instance
2. Select it in ImmiChange (Pro: multiple albums)
3. App downloads photos only over Wi-Fi, respects a storage cap you set (default 20MB)
4. Wallpaper rotates through cached photos; refreshes the pool when the cache runs out and Wi-Fi is available

Because it runs off that local cache, wallpaper changes keep working even when the server is down or you're away from home.

Features worth knowing about:

• SSID restriction — only syncs on your home Wi-Fi, so it never touches mobile data
• Home-screen widget — pause rotation or lock the current view without opening the app
• TopShot — when a wallpaper looks just right, freeze it and upload it back into an Immich album as a real asset
• Live wallpaper with smooth parallax as you move the phone (tilt/gyro, adjustable sensitivity)
• Smart date overlay — stamps the shooting date from EXIF, and the text color auto-adjusts to the photo's brightness so it stays readable
• Shared albums from other Immich users show up in the picker too, not just your own
• Everything stays local. API keys are stored encrypted on-device and never leave it.

Free to use, with a few extras behind Pro. Android only for now.

More info and setup: https://zero-webcreate.com/lp/ImmiChange.html

Would love feedback, especially from anyone running a big library — curious how it holds up.