Own Your Services
Every month you pay for cloud storage, photo backup, a password manager, streaming, and more — and every one of those companies holds your data. Self-hosting means running those services yourself, on a small Linux server at home. It's private, it's cheaper over time, and it's the best hands-on Linux, networking, and security training there is.
Each guide below is a complete, copy-and-paste walkthrough. They all follow the same pattern — one folder and one
compose.yaml per app — so once you've done two or three, the rest feel familiar.
New here? Do the Foundations in order first (at least 1, 3, 4 and 5). Every app guide assumes them.
Suggested Build Order
- Week 1 — The server: Foundations → Portainer
- Week 2 — Access & safety: Reverse proxy + HTTPS → Tailscale → Backups
- Week 3 — Quick wins: Pi-hole → Vaultwarden → Homepage
- Week 4 — The big ones: Immich → Jellyfin → Nextcloud
- Then: monitoring, and whatever apps you'll actually use.
Foundations (Do These First)
The server, remote access, HTTPS, backups, and monitoring that every app relies on.
- 1. Build Your First Home Server Hardware choices, Ubuntu Server, a fixed IP, Docker, the ~/stacks layout, and a firewall.
- 2. Portainer: Docker in a Browser See, restart, and read logs for every container from a web page.
- 3. Reverse Proxy & HTTPS Nginx Proxy Manager, a domain, and real certificates — private or public.
- 4. Remote Access: Tailscale & WireGuard Use every app from anywhere without opening ports.
- 5. Backups with restic 3-2-1 backups: encrypted, automatic, off-site, and tested.
- 6. Homepage Dashboard One start page with a tile and live stats for every app.
- 7. Uptime Kuma Checks every app every minute and alerts your phone.
- 8. Grafana + Prometheus Graphs of CPU, memory, disk, and network — plus alerts.
Files & Photos
Replace Google Drive, Dropbox, Google Photos and iCloud.
- Nextcloud — your own Google Drive File sync, sharing, calendar, contacts, and online office editing.
- Immich — your own Google Photos Automatic phone backup, faces, maps, AI search, shared albums.
- Syncthing — private folder sync Keep folders identical across laptop, phone, and server with no cloud.
Media
Replace Netflix, Spotify, and Audible-style apps — for media you own.
- Jellyfin — your own Netflix Films and TV with posters, apps for every TV, and hardware transcoding.
- Navidrome — your own Spotify (on a Raspberry Pi) Stream your music collection to any phone app, anywhere.
- Audiobookshelf — audiobooks & podcasts Synced listening progress, chapters, and automatic podcast downloads.
Security & Privacy
Passwords and ad blocking for the whole family.
- Vaultwarden — your own password manager Works with the official Bitwarden apps and browser extensions.
- Pi-hole — block ads on every device Network-wide ad and tracker blocking plus local DNS names.
- AdGuard Home — Pi-hole alternative Ad blocking with encrypted DNS, wildcard rewrites, and parental controls.
Home & Life
Everyday tools for the household.
- Home Assistant — local smart home Every smart device in one app, with automations that work offline.
- Paperless-ngx — go paperless Scan, OCR, auto-file, and instantly search every document.
- Mealie — recipes & meal planning Import recipes from any site, plan the week, share a shopping list.
- FreshRSS — your own news feed Follow sites, blogs, and YouTube channels with no algorithm.
Developer Tools
Version control for your code and your homelab.
- Forgejo — your own GitHub Private Git repos, issues, and GitHub mirrors.
Port Map: Every App on One Server
These are the host ports used in the guides, chosen so every app can run on the same machine without clashing. Keep this table updated if you add your own apps.
| App | Port(s) | Suggested name |
|---|---|---|
| Nginx Proxy Manager | 80, 443, 81 (admin) | — |
| Pi-hole or AdGuard Home | 53 + 8081 (Pi-hole) / 53 + 3004 + 8083 (AdGuard) | pihole / adguard |
| Homepage | 3000 | home |
| Uptime Kuma | 3001 | status |
| Forgejo | 3002, 2222 (SSH) | git |
| Grafana / Prometheus | 3003 / 9090 | grafana |
| Paperless-ngx | 8000 | docs |
| Nextcloud AIO | 8080 (admin), 11000 (app) | cloud |
| Vaultwarden | 8082 | vault |
| FreshRSS | 8084 | rss |
| Jellyfin | 8096 | jellyfin |
| Home Assistant | 8123 (host network) | ha |
| Syncthing | 8384, 22000, 21027 (host network) | — |
| Immich | 2283 | photos |
| Navidrome | 4533 | music |
| Portainer | 9443 | portainer |
| Mealie | 9925 | recipes |
| Audiobookshelf | 13378 | books |
| wg-easy (WireGuard) | 51820/udp, 51821 | wg |
Check what's already in use on your server with sudo ss -tulpn.
The Five Rules of Safe Self-Hosting
- Backups before data. Don't move photos or passwords in until restic is running and you've tested a restore.
- Don't open ports. Use Tailscale to reach things remotely. Forward a port only when a guide says so and you understand why.
- Update regularly. Once a month:
docker compose pull && docker compose up -din each folder, plussudo apt update && sudo apt full-upgrade. Read release notes for Immich and Nextcloud first. - Unique passwords + 2FA on every admin page, stored in Vaultwarden — plus a paper copy of the master password.
- Keep secrets out of screenshots and Git.
.envfiles, API keys, and tokens never go in a video, a blog post, or a repository.