2·
2 days agoMy Current Self-hosted Setup
Hardware
Server 1
- Trycoo / Peladn mini pc
- Intel n97 CPU
- Integrated GPU
- 32gb of 3200mt/s ddr4 (Upgraded from 16gb)
- 512nvme
- 2x 2tb ssd’s (Raid1 + LVM)
- Startech usb to sata cable
- Atolla 6 port powered usb 3.0 splitter
- 2x 8tb hdd’s
- 2 bay usb 3.0 Fideco dock
- Each 8tb HDD is split into 2 equal size partitions, making 4 x 4tb partitions
- Each night, the 2tb SSD array backups to the alternating first partition of the HDD’s .
- Each 1st of the month, the 2tb SSD array backups to the alternating 2nd partition of the HDD’s .
Server 2
- Raspberry pi 4b
- 32gb SD card
- 4gb ram
Services
Server 1
- Nginx web server / reverse proxy
- Fail2ban
- Crowdsec
- Valutwarden
Bit warden reimplantation for storing credentials - Forgejo
Remote federated git - rs_maps
Simplified Google Maps replacement, with tagging and GPX creation. - Matrix / Continuwuity
Federated IM protocol - Immich
Google Photos replacement
External libraries only
4 users - Radicale
Calender and contacts - Lemmy
Federated replacement for Reddit - Navidrome
Spotify replacement
2 users - Adguard home
1st instance
Provides Network wide DNS filtering and DHCP server - Unbound
Provides recursive DNS - Go-notes
Rich Text formatting, live, real time multi-user notes app - FMD
Find my device - Transmission
Torrent client - PIA VPN
Network Namespace script to isolate PIA & Transmission - Searxng
Meta search engine - integrates with Go-llama - StirlingPDF
PDF editor - File browser
This is in maintenance mode only so I am planning to migrate to File Browser Quantum soon - Syncthing
Syncs 3 android and 1 apple phone for immich - Custom rsync backup script
- Darkstat
Real time Network statistics
Server 2
- Fail2ban
- Crowdsec
- Honeygain
Generates a tiny passive income
I’m UK based and in the last 6 months it has produced £15 - Adguard home
- 2nd instance
Provides Network wide DNS filtering and DHCP server - Unbound
Provides recursive DNS - Custom DDNS update script
Overview
Been running this hardware setup since July 2025, although a couple of services have been added in that time. All works really well and has minimal maintenance as everything is fully automated with scripts. -
A reverse proxy is the traditional safe route. Use a web server like Apache, nginx or caddy, and setup to reverse proxy all your services through port 443, and use let’s encrypt and certbot to generate and manage TLS certificates.
I host around 15 public facing web services this way using nginx.
Just be aware, this is very public facing so server security and hardening is important. Things like strong passwords, disabled root, use ssh keys instead of passwords, setup fail2ban, setup crowdsec etc.
The more modern safer way is not to truly expose to full public and use things like tailscale or cloudflare tunnels. But this relies on 3rd party servers and I’m not a fan of that, but it does bring benefits.