For me, the most essentials are definitely:

• PhotoPrism
• Jellyfin
• Navidrome
• Wiki.js

Even though it’s not as popular as the other options, parts of NetBSD are used for many usecases. Take a look at

https://netbsd.org/gallery/products.html

and you’ll see many familiar names.

I took a look at it. From what I understand, some of the lines in your setup are redundant. The final product seems to do basically the same job as mine. In any case, if it works, it works.

Hey, great post. I have one request. Can you maybe add some description for what the iptables entries do? I have a similar setup with a lot less iptables rules that works well for me. But I’m not an expert in networking, and am now worried that I might be missing something that can leak my home IP.

Navidrome does that. I think you just used a bad frontend. Try Tempo if you’re using Android. Or Feishin on desktop.

I’ve been very happy with Navidrome. I have it accessible on a subdomain, so I can just use it from wherever I want. Feishin is a great frontend for Linux desktop, and Tempo is a great frontend for Android.

My friend uses Jellyfin instead of Navidrome, and he’s also happy with it. Both the frontends that I mentioned work with Jellyfin as well.

I’ve heard many people complain about DuckDNS. Personally use desec.io for DDNS and it’s been solid.

What I’ve realized in my (very limited) experience in selfhosting, it’s always best to use a general purpose server OS rather than anything geared to a specific usecase, unless that’s the only thing you’re gonna use it for. So, if you want a separate NAS drive, then it’s a good idea to use TrueNAS on it. But on your main server, it’ll be best to use some sort of RHEL downstream distro like AlmaLinux.

I use Syncthing and a bunch of rsync scripts to keep my machines in sync. The stuff I want synced continuously is handled by Syncthing. Other stuff is synced on a daily basis using the rsync scripts and anachron. For Photos, I use PhotoPrism. I simply sync the Photos from my smartphone to a folder and make PhotoPrism scan it on a regular basis using ofelia. For cameras, I need to copy the photos manually, but I don’t think there’s a way around that.

Don’t mean to necrobump. But I have Syncthing GUI working over a very similar setup. Let me know if you still need help setting it up.

Relevant xkcd

Some people are also building a reverse proxy using pingora called river.

For media, I host the some of the arr apps, qbittorrent, Jellyfin, gpodder2go, and navidrome. For personal photos, I host PhotoPrism. I host a file sharing service fileshelter, and a link shortening service chhoto-url. I host Wiki.js for mostly recipes, and some notes. I’ve recently started hosting Forgejo for my git repos. I also host SageMath for computation, it’s especially useful when I only have my phone with me and need to use it. I use caddy as a reverse proxy and serve these through a VPS using a Wireguard tunnel.

Thanks, I’ll check it out.

Thanks for the suggestion.

Where are you, if I may ask? Their Intel offers are not based in the US. Most of the time, I’ll access it from inside US, so I’m worried about the latency.

Without anything extra, there are three ways of doing it:

1. Using Tailscale Funnel
2. Direct port forwarding in your router, and pointing to the IP using some DDNS provider (e.g. desec.io)
3. Through Cloudflare tunnel (not recommended due to privacy reasons)

In each case, you’ll need a reverse proxy (e.g. Caddy) if you want secure https connections.

If you’re willing to spend money, the better way would be to proxy through a VPS (using something like a Wireguard tunnel). In that way, you won’t have to open ports on your home router. You can get a very cheap one since proxying doesn’t need much CPU power. Just choose one with enough bandwidth. I personally proxy most of my stuff through a $12/yr RackNerd VPS.

That’s why docker was created.

My setup looks like the following:

/etc/wireguard/wg-vps.conf on the VPS
-----------------------------------------------------
[Interface]
Address = 10.8.0.2/24
ListenPort = 51820
PrivateKey = ********************************************

# packet forwarding
PreUp = sysctl -w net.ipv4.ip_forward=1

# port forwarding 80 and 443
PreUp = iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 10.8.0.1:80
PreUp = iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination 10.8.0.1:443
PostDown = iptables -t nat -D PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 10.8.0.1:80
PostDown = iptables -t nat -D PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination 10.8.0.1:443

# packet masquerading
PreUp = iptables -t nat -A POSTROUTING -o wg-vps -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -o wg-vps -j MASQUERADE

[Peer]
PublicKey = ********************************************
AllowedIPs = 10.8.0.1

/etc/wireguard/wg-vps.conf on my home-server
---------------------------------------------------------------
[Interface]
Address = 10.8.0.1/24
PrivateKey = ********************************************

[Peer]
PublicKey = ********************************************
AllowedIPs = 10.8.0.2
Endpoint = :51820
PersistentKeepAlive = 25

Now, just enable the tunnel using sudo systemctl enable --now wg-quick@wg-vps. Make sure that the port 51820, 80, and 443 are open on the VPS. Now, allow 80, 443 through the firewall on the home-server (not on the router, just allow it locally), and it should work.

I’m afraid that I don’t have any guides. But, you’re halfway there anyway. Which one of these methods do you prefer? I can maybe give you some pointers.