To give everyone time to upgrade, full details will be published as security advisories on November 15, 2026. Once published, the details will be public, so update now rather than waiting for the advisories.

Hi r/selfhosted!

I've just released the 0.35 release of karakeep! This release is special in two ways: 1) We've reached 30k stars on Github. 2) We've also got https://karakeep.com (instead of .app) which I've been chasing for a while. Thanks a lot for your support over the years, it's been quite a journey.

Every time I started talking about the release, without mentioning what karakeep is, someone complains in the comments, so here you go: Karakeep (https://karakeep.com/), is a selfhosted bookmark manager that's meant to be the place where you throw things in that you might need in the future, and it aims to help you with retrieving those things easily in the future. It has a blazingly fast full text search and opt-in LLM based tagging. It's built for the data "hoarders" out there! Karakeep was born because of this subreddit in 2024, and we have a long history here together that old timers will remember.

Black October
Last month, was a crazy month in the security scene. I run karakeep in prod (for the hosted karakeep cloud), so it's been quite exhausting to keep up. And as you might guess, karakeep is not a simple service to host given the amount of untrusted content it deals with. Today's release, packs tons of security fixes (reported to us by the community) and also proactive security hardening work. So please update your instances to the last release.

The one update that I'm most excited about is the new sandboxing feature. Karakeep main functionality involves parsing untrusted HTML to extract content out of it, as well as parsing PDFs, and OCR on images. All of those is karakeep processing untrusted content in the same process that deals with user data. Similarly, the SSRF risk when fetching content from inside your trusted network. Perhaps the risk is less severe when all your users are trusted users, but this was keeping me up at night for the hosted service. This release now makes it possible to offload all untrusted content handling to a remote stateless sandbox that can run outside of your network. The workers talk to this sandbox over HTTP.

The cool thing about this feature is that beside its security benefits, and once this sandbox API is stabilized, it'll allow you to plug in custom content crawling and parsing logic replacing that of Karakeep altogether if you want.

The Polish

This release contains a major polish pass over almost all the screens of karakeep in the web, mobile and browser extension. On the web, the dark mode is now more modern (replacing the old dated bluish color scheme). The bookmark card's aspect ratio now matches the common opengraph images for more beautiful banners. The setting page got a big restructure as well. You can now hide the editor card, which for some reason, annoyed a lot of people (I still like it though!). Tons of improvements also to highlights page, the reader view, the preview page, etc. Better experience those yourself.

On the mobile app, we now have iPhone Duo support for those who already managed to acquire one (and a sidebar for tablets in portrait mode). On iOS, we have long press support for bookmark actions. We also now have card swipe support for archiving/staring. Tons of tiny UX improvements (e.g. search in manage lists, smart list builder, improved highlighting experience, etc). And lots of other fixes as well. The mobile app also gets internationalization support (a bit overdue).

Same for the extension, it also got some love which you might have seen already as i've released it a couple of weeks ago. Overall, Karakeep should feel more polished and more pleasant to use. If you have more suggestions, please keep them coming.

Others

• Text bookmarks and assets now support summarization (previously only links did).

• Smart lists now have a "builder" so that you don't need to write the query language yourself. It also shows you the matching bookmarks as you build the query.

• We're now using defuddle for content extraction which is a great library created by kepano (the creator of obsidian) and it's used in their web clipper. You should see higher accuracy in the content extracted from websites you hoard in reader view.

Thank you for being part of this journey, enjoy the release!

It just occurred to me I'm two months into running my own AI instead of paying for one. I started off with Ollama in Docker with a web UI in front of it, then moved everything to Magnitude on my Mac mini after a few weeks because the wait on long prompts was driving me nuts. At the beginning I had no clue what quantization even meant, and I still don't fully.

I'll admit most of the setup help came from Claude, which is a bit ironic.

There's a lot of models I tried and dropped, these are the ones that stayed. Qwen 3.6 35B for coding questions, a small Gemma for summaries, and a tiny one for titles and commit messages. On the M4 Pro the 35B does about 120 tok/s which still feels unreal to me for something sitting on my desk.

Curious what the next two months bring.

went to change one permission on a custom role in my self hosted infisical today and got this:

“Failed to update custom role due to plan RBAC restriction. Upgrade to Infisical Enterprise plan to update custom roles.” (the line in their code)

I made that role earlier this month on the SAME free install. it’s a create only role for my automation, it can add secrets and that’s it. no edit, no delete. least privilege, the exact thing you’re supposed to do with a secrets manager.

I had claude dig through their github to see what happened. april 1st they merged a commit literally called “feat: custom roles as enterprise-only feature” (e4880e71ed). it went out in v0.159.6, a PATCH release. then in june they changed the docs to say custom roles are enterprise only (PR #7078, the docs now). renovate bumped me past it and now I can’t edit roles I already made. the old ones still work, you just can’t touch them or make new ones without paying for enterprise.

this was never an enterprise feature. it was free on self hosted and they took it away in a patch version with no heads up. and of everything they could lock up they picked the thing that lets you limit what your machine identities can do. so the free option now is give everything full Member access. on a secrets manager. great.

infisical got big off this community. this sub recommending it as the open source vault alternative, people filing bugs, sending PRs, answering questions, giving it stars. and this is how they pay that back.

I’m done helping them until this is reversed. if you feel the same:

unstar the repo.
stop filing bugs, sending PRs and answering questions for them.
tell people about this before they pick infisical for their lab.
let them know in their github discussions: https://github.com/Infisical/infisical/discussions

custom roles back on free self hosted, or they don’t get the community’s help anymore. the selfhosted community isn’t going to take this bullshit.

A terminal app to run WireGuard, OpenVPN and NetBird tunnels side by side. It shows live throughput and latency, checks for IP/DNS leaks, and has a kill switch. macOS and Linux.

brew install vortix · https://github.com/Harry-kp/vortix

Hi all,

I wanted to share a project I've been working on for a while: an open-source pastebin server written in Go. It started as a hastebin fork, but I slowly rewrote everything in Go and added a bunch more for features.

I started building it after hastebin fell into a state of disrepair because I wanted something with a clean UI that was easy to use and reliable. It's a single binary or Docker image, and just needs a database besides that. Everything happens server side, so it's fully functional without JavasSript. The only exception is encrypted pastes, because those are encrypted in your browser.

Features

• Syntax highlighting for most popular languages, plus raw text mode

• Password-protected encrypted pastes: AES-256-GCM in the browser, so the server never sees the plaintext or the password

• Collections: share several pastes under one link, with tabs

• Reader mode (renders Markdown, wraps text)

• Optional accounts so users can edit or delete their pastes

• Basic Auth for fully private instances

• Opt-in document expiration, configurable size limits, ratelimiting, and random-string or word-phrase IDs

• Custom named documents that never expire (handy for a "rules" or "about" page)

• QR codes

• Headless API-only mode, plus curl-friendly uploads

• SQLite, PostgreSQL, or MySQL/MariaDB

• Handles reverse proxies properly

Links

• GitHub: https://github.com/lukewhrit/spacebin

• Public instance to try: https://spaceb.in

It's published under Apache 2.0.Feedback, bug reports and feature requests are very welcome, and I'm happy to answer questions here.

I, like everyone else and their mothers, would like to use proxmox. I understand the basics, what I’m not so sure on is security. I’ll have a few services I want exposed to the internet proper, not just a VPN, though most will just be exposed over wireguard. Basically my internet services would be game servers (primarily Minecraft but possibly others later) and maybe jellyfin? I do have a super cheap VPS, which I used mcrouter and Tailscale on to tunnel to my actual homelab, but as far as that and setting up my firewall I’m not sure what else I need to be considering? I haven’t used proxmox and I guess I’m just looking to do it right for the learning experience. Apologies if I sound dumb lol I just prefer written tips instead of 2 hour YouTube walkthroughs that only have 15 minutes of relative info 😭

Running Searxng, I've been trying to get the config working, and searching properly but it keeps returning absolutely nothing related to my query and content time outs and rate limiting.

I'm getting mighty pissed and looking at better options

Suggestions

I host my own email using a VPS running a build from mailinabox.email. One thing that has always been difficult is having a straightforward resource for searching over 25 years of email from my phone. Any suggestions?

On the desktop, I run Thunderbird and it works perfectly. I run Thunderbird on my phone as well, but it's more difficult to search on the server and results are unreliable.

Ideally a single purpose app (or container-based web app) would be great. Nothing I've seen quite fits the bill. Any suggestions?

So i have my setup like this

• ISP router → MikroTik ac lite used as a VLAN-aware switch.

• The ISP router goes to MikroTik port 1, The WAN travels over a single trunk (port 2), and all VLANs to a Proxmox server.

• Sophos Firewall runs as a VM on that server, with all other VMs. It’s the gateway and DHCP server for all VLANs (5 = Wi-Fi, 10 = wired LAN, 30 = servers).

• Mikrotik handles DHCP requests and sending them to Sophos using relays

• Tiny network: about 2 wired PCs and 4 to 5 phones.

• The VM already starts first on boot, and the BIOS powers on after a power loss.

Everything works perfectly but i'm annoyed (just to play a little more) and i want to separate the Sophos into a device on its own, to make the firewall independent of the main server, so that after a power cut devices don’t wait for Proxmox and then the VM to get IPs, and so the internet survives server failure or maintenance, etc

So i was thinking about two options

A) A small mini PC with one NIC running Proxmox, Sophos stays a VM with virtual NICs for WAN, LAN, and a trunk to the MikroTik.

B) A small SFF PC with one extra PCIe slot for NIC, and use it as bare metal port for WAN and port for LAN

Both options will allow me to use the firewall right after the ISP router and use the Mikrotik as switch only to handle ports traffic

BUT, does it worth it or i'm too paranoid? like i said everything actually works great i don't have any issues but i prefer sophos on its own and most likely bare metal, what do you recommend?

Hello, I'm new to self hosting and I'm looking for some public alternatives.

I self hosted a server from my home and ran some media streams dockers. I was using Private Mesh to access my server out of the network. Then I got to know about the cloudflare tunnel and I bought a domain and hosted some of my nextcloud, vaultwarden on my domain publicly. Since I don't want to give my card details to Cloudflare Zero Trust, I use WAF protection to keep my Url blocked from access and only keep access to certain things.

I got to know about cloudflare's streaming policy that it doesn't allow that and can throttle the speed. And looked for an alternative. And found out about Caddy, tried it and liked it very much. I also found out I have a Public IPv6 address that my router gives me which I can use to expose Caddy on 443 and 80 ports and reverse proxy my docker containers.

But the main issue is security, username, password, 2FA, in app authentication, WAF for url blocking and so on. Since Cloudflare is only handling my DNS now, because I have dynamic IPv6, I think I don't have any WAF protection now.

I wanna know how you guys keep your server and containers protected on the public network. I'm new to this a little help will be appreciated thanks.

I have a directory like

media/downloads/complete

media/jellyfin/shows

media/jellyfin/movies

The media directory is bind mounted into different containers, the torrent client downloads into `downloads`, and the media server reads from `jellyfin`

I am assuming a lot of people must have a pretty similar setup. What I've never solved and never really tried to solve is efficiently moving files into the media server. For years I've just ssh'd into it and moved them over when I'm done seeding.

This is fine really, but is there a better way? I know a lot of people use an Arr stack so there must be a cleaner way. Similarly if you want to seed for a long time but also want to be able to add it to the media server, do you symlink it?

A a chron job is non trivial because some downloads go to movies, some go to shows and sometimes I download ebooks which is completely different.

I would like to host a 26.3 Minecraft server with the Fabric loader and around ~180 mods. BetterX, Macaw’s mods, Biomes O’ Plenty, and TaCZ are the main ones, with other smaller content/QoL mods along with a bucketload of optimizations. I plan for there to be a maximum of 10 people at a time.

I also plan to use Ubuntu, since it’s much lighter than Windows.

My top priority besides lag-free hosting is low power usage. I found a used Dell Optiplex 9020M that seems perfect for the job, but I want to check with y’all just to make sure.

Specs:
CPU: Intel i7-4785T (2.2GHz)
RAM: 8GB 1600MHz DDR3
SSD: 500GB NVMe

Upgrades are a possibility in the future since the sockets are standardized, but I’m looking for a good base configuration.

As a side note, what small monitor would you guys recommend? I want something I can stick to the side of the case to reduce the space needed.

I'm using unbound dns with oisd.nll blocklists to prevent tracking and seeing advertisements. Sometimes I'll get a 'we detect an ad blocker' banner.

I'm curious if projects like pixelserv-tls where a locally hosted 1px x 1px image is loaded in place of the ad still work in 2026. AI chat sessions say this approach doesn't work so well these days as adblock detection has gotten better.

Any other tips on a network wide adblock method would be appreciated. Thanks.

Hey all.

I think I've finally come to the conclusion that it's time to migrate my Air Traffic Control needs out of the cloud. The uptime on the government's managed service has been completely unacceptable lately, and honestly, I'm tired of relying on third-party infrastructure for basic airspace management.

Does anyone have a good docker-compose stack for this? I’m looking for something lightweight (preferably written in Rust or Go). I looked at the official federal enterprise image, but it seems like legacy Java bloat and requires way too much RAM.

Also, how are you guys handling reverse proxies for the Boeing transponders? I want to put the Eastern Seaboard on its own VLAN, but the Wife Acceptance Factor (WAF) is dropping because the holding patterns over the roof are getting noisy.

I've got a spare Raspberry Pi 4, a couple of RTL-SDR dongles, and a 4-node Proxmox cluster in the garage. Is there a FOSS drop-in replacement for the National Airspace System? Ideally, I just want to route everything through a Tailscale exit node so I can manage JFK arrivals from my phone while I'm at Costco.

Bonus points if it has a Home Assistant integration so I can automatically trigger my backyard floodlights when a 737 is on final approach.

Hey everyone. I bought used parts off ebay and they have all been working on my server for months. I got this at the boot screen today. Im no expert but some simple searching suggests that the gpu died. Is that what happened? Hdmi at the gpu doesnt work right now, but i see it is running and lighting up in the case. Its an AMD RX6700xt.

Second question...You guys know, we all spend so much time building our servers the way we feel are perfect. If the gpu is dead i feel like i should replace it with the same gpu right? All of my transcoding setting were so god damn specific im worried about making a change to a new card that all of a sudden causes those settings to fail. I cant do it again i made it all perfect.

If its dead, well this might be the worst financial catasteophe that i could have imagined.

Hey everyone!

I ran into an annoying issue with my ISP: direct file downloads from overseas and distant servers were consistently throttled down to around 15 to 20 Mbps (2 to 3 MB/s), even though running a test on cloudflare speed test easily hit my full line rate of 100 Mbps.

To bridge this gap, I built CDNFlare — an open-source, lightweight Cloudflare Workers edge download accelerator and streaming reverse proxy.

How the "Speed Jump" Works: Instead of your client establishing a high-latency, throttled connection directly to a slow international host, the Cloudflare Worker fetches the file across Cloudflare's datacenter backbone and streams it to your client through your closest Cloudflare edge server at full peering speeds.

Key Features:

• Full HTTP 206 Partial Content (Range Support): Works seamlessly with IDM, Aria2, and FDM for 8 to 16 simultaneous parallel connections and pause/resume.

• Zero-Buffer Streaming: Passes the stream directly without buffering in Worker RAM, so multi-gigabyte files stream smoothly.

• Smart Filename Detection: Sets proper filename headers if the origin server omits them.

• Anti-Hotlink Bypass: Automatically forwards origin referers and browser user-agents.

• Optional Access Token: Protect your personal deployment with a secret token if you want it private.

• Built-in Web Dashboard: Clean dark-mode interface with one-click command generators for Aria2, cURL, and Wget.

100% Free and Self-Hosted: It runs completely within Cloudflare's free tier of 100,000 requests per day. You can easily deploy it to your own Cloudflare account in under 2 minutes.

The GitHub repository link is in the comments below!

I would love to hear your thoughts, feedback, and any edge-case suggestions!

Hey, I'm trying to set up Jellyglance. I feel like I'm banging my head against the wall because I can't get it to start properly. It seems to be an issue with the password, but I've checked and double checked, and the password is accurate. I've changed the password and secret for the sake of security in this post. Not sure what I could do differently to get this app to launch... I'm setting this up with Portainer on a Raspberry Pi 4 running Raspberry Pi OS. I changed the port from 3000 to 6000 because I'm already running a different app on port 3000. If you have advice, I'd really appreciate it.

Docker Compose

services:
  jellyglance-db:
    image: postgres:16-alpine
    container_name: jellyglance-db
    restart: unless-stopped
    shm_size: "1gb"
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: Z4vQLPL92dGqL2fBZatvHx1SgiP1JYtE
      POSTGRES_DB: jellyglance
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready --dbname=jellyglance --username=postgres"]
      interval: 10s
      timeout: 5s
      retries: 5

  jellyglance:
    image: ghcr.io/nerdy-technician/jellyglance:latest
    container_name: jellyglance
    restart: unless-stopped
    depends_on:
      jellyglance-db:
        condition: service_healthy
    ports:
      - "6000:6000"
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: Z4vQLPL92dGqL2fBZatvHx1SgiP1JYtE
      POSTGRES_IP: jellyglance-db
      POSTGRES_PORT: 5432
      POSTGRES_DB: jellyglance
      JWT_SECRET: cac0c70d9fde982b
      TZ: Europe/London
      CONFIG_DIR: /app/config
      BACKUP_DIR: /app/backups
    volumes:
      - ./config:/app/config
      - ./backups:/app/backups

volumes:
  postgres-data:

Error from logs

[MIGRATIONS] Waiting for database (27/30): password authentication failed for user "postgres"
Acquire connection error: error: password authentication failed for user "postgres"
    at parseErrorMessage (/app/node_modules/pg-protocol/dist/parser.js:306:11)
    at Parser.handlePacket (/app/node_modules/pg-protocol/dist/parser.js:143:27)
    at Parser.parse (/app/node_modules/pg-protocol/dist/parser.js:37:38)
    at Socket.<anonymous> (/app/node_modules/pg-protocol/dist/index.js:12:42)
    at Socket.emit (node:events:514:28)
    at addChunk (node:internal/streams/readable:568:12)
    at readableAddChunkPushByteMode (node:internal/streams/readable:519:3)
    at Readable.push (node:internal/streams/readable:399:5)
    at TCP.onStreamRead (node:internal/stream_base_commons:189:23)

From postgres

admin@xanthtastic:/etc/postgresql/17/main $ sudo -u postgres psql
psql (17.12 (Debian 17.12-0+deb13u1))
Type "help" for help.

postgres=# ALTER USER postgres PASSWORD 'Z4vQLPL92dGqL2fBZatvHx1SgiP1JYtE';
ALTER ROLE
postgres-# \q

Back in March I posted about turning my old 2014 MacBook Pro into a home server for Plex and Miniflux: https://www.reddit.com/r/selfhosted/comments/1s72q8q/turned_my_old_2014_macbook_pro_into_a_small_home/

It's still running, and some of the advice in that thread ended up shaping what I did next. Here's what I changed:

• Wi-Fi to Ethernet: 4K movies kept buffering on Plex. Moving the server and the TV to Ethernet fixed it right away, and file transfers are about 10x faster.

• Storage: My drives are over 10 years old, so I bought enclosures and plan to move to two 4TB drives (one for backup). I'm holding off on the drives because prices have almost doubled this year.

• Pi-hole: for network-wide ad blocking, including in phone apps where a browser ad blocker doesn't help.

• Plex library cleanup: Years of messy file names and metadata, finally sorted

• Security: After the recent Plex exploits I set up a monthly update routine. No port forwarding, UPnP off, Plex remote access off; remote access only through Tailscale.

Full write-up with costs and details: https://andreagao.com/posts/upgrade-macbook-turned-home-server/

Questions for people here:

• Any recommendations for 4TB drives, or is it worth waiting for prices to come down?

• What does your update routine look like? Mine is manual, once a month.

I started working on OpenShip in March and launched it in July. We went viral in a lot of places, #2 github ternding, now +15k stars and now we're getting close to 2K PRs from the community.

More than 110 people have helped me improve and stabilize the platform, which is honestly amazing.

We've also managed to build a lot of great features already:

• Auto scaling

• Clustering

• Regular deployments

• Self-hosted Actions

• tunneling

• And a lot more.

Still a lot to come, If anyone of you have any feedback about the platform, I'd love to hear your thoughts

AI disclosure: the app has been developed by hand since 2023, the new features added this year have been developed with AI assistance. A detailed breakdown of how AI has been used can be read in the disclosure comment.

Gitlab: https://gitlab.com/Nystik/inkheart
Live demo: https://inkheart-demo.thiefling.com

I shared this earlier this year in January, and it's about time to provide an update on what's changed this year. But lets begin with a re-introduction:

Inkheart is a lightweight, focused application created to solve a specific problem: Self-hosting a library of PDF documents that were too large to properly open in Google Drive's PDF reader, and allow linking to specific pages. Over the years it has evolved to include a few more features and quality of life improvements, while still remaining close to its original narrow usecase.

Inkheart is not trying to be a complete self-hosting library for e-books, or comics, or textual media in general. It's not made to compete with library apps like Kavita or Komga, or document managers like Paperless. And it's never going to. But I am happy to take feature requests provided they remain within the scope I've set.

It is a simple PDF library indexer and reader, a svelte UI over a Rust backend for a small and light footprint. The library reflects your filesystem, showing your folder structure, and displaying your documents with minimal metadata. There's no database, the index is kept in-memory and only persisted to disk for faster startup if you configure it that way. If you enable full text search, the search index is the only substantial piece of metadata the app maintains. At this time the app is read-only, as in it does not handle uploads of documents. You'd place your PDFs on your server by some other method; personally I sync a folder with documents from google drive, mounted as the document root.

As for what has been added this year: There has been a full UI refresh where I have gone over the entire styling of the application and made it more uniform and consistent, I've added full text search, multi-document reader so you can have multiple documents open and switch between them quickly, and I've finally implemented my own skinned PDF.js reader instead of embedding the default one. There have also been a number of minor quality of life improvements like reading progress and settings for default reader page spread and zoom, as well as some memory optimizations.

Note: Inkheart is currently a single user application, and is designed to sit behind a reverse auth proxy for secure access, the included Firebase auth implementation is a legacy method from when I first built it, and works fine, but I have since personally moved on to using Cloudflare Access. Multi-user is a possible future feature if enough people request it or I find myself in a spur of motivation, along with other potential roadmap items you can see further down.

Features:

• Filesystem based navigation

• Integrated PDF reader built on PDF.js

• Multi-document reader tabs

• Direct linking to specific pages

• Reading progress tracking

• Collections for organizing PDFs into custom groups

• Pinned folders for quick sidebar access

• Filename search and full-text search across PDF content

• Optional authentication via Firebase Auth with whitelisting

• Light and dark color themes

Potential future additions (If enough people ask for them, and time allows):

• Multi-user ACL and OIDC

• Standalone PWA support

• Administration panel for uploading documents and managing your library

Inkheart is one of dozens of projects I've been working on for years, most of them not yet ready for sharing. So development on Inkheart isn't particularly fast even with the assistence of AI. My process doesn't allow me to pump out feature after feature like some I see on this site. I put a lot of effort into reviewing and testing, and thinking through any code I am going to take responsibility for, and the project's pacing reflects that.

Anyway, maybe someone else finds this little app of mine useful, which is enough reason for me to share it.

Devlog for following updates when they happen: https://dev.thiefling.com/inkheart

If my house burned down, everything is backed up off-site but is protected with complex encryption keys which are all stored in Bitwarden (Vaultwarden) that's self-hosted. I've always tolerated the local cache on my phone / laptop as being acceptable to recover, but if these burnt down too I'd be toast.

I want a completely out-of-band way of getting my Bitwarden safe, so I can get started again.

I have devised a plan and I'm interested in challenges on it or better ideas:

1. Vaultwarden safe is exported in JSON password protected

2. Encrypted export is further encrypted with age and a genuinely long/complex password I remember

3. Age export is then hosted on public cloud storage and has a public share link but needs a password to access (another one I remember)

4. The public cloud link is hosted on my public website at a well-known URL

My thinking is I could get back in to this reliably, and it's the most secure way I can think of doing it. But it sits uncomfortably with me that the keys to my life are stored "publicly".

The alternative I was thinking is instead of Step 3 going to public cloud, it goes to a USB drive that a close friend/family has, but these seems less reliable (albeit more secure).

Any thoughts / how are other people doing this?