Self-hosting means running software on a server you control, instead of relying on someone else’s cloud service. That might be a password manager, a photo library, a website, a file-sync service, analytics, or a wiki. It gives you privacy, ownership of your data, no per-user subscription fees, and a lot of practical Linux skills. This guide is a roadmap for getting started without getting overwhelmed.

What people self-host

Need Popular self-hosted app
Passwords Vaultwarden
Files and sync Nextcloud, Seafile
Photos Immich
Media streaming Jellyfin
Website analytics Plausible, Umami
Uptime monitoring Uptime Kuma
Git hosting Gitea
Automation n8n
Documents Paperless-ngx

More ideas: self-hosted alternatives to popular apps.

VPS or home server?

VPS Home server
Public IP, reachable from anywhere Yes Often behind NAT/CGNAT; needs tunnels
Uptime and power Data centre grade Depends on your home power and internet
Upload bandwidth High Usually limited by your home connection
Storage Smaller (unless you choose a storage VPS) Cheap large disks
Hardware No hardware to maintain You maintain it

A common approach: public-facing apps on a VPS (websites, password manager, monitoring), and bulk storage at home, connected with a VPN. See storage VPS and WireGuard.

A beginner-friendly stack

  1. A VPS with Ubuntu or Debian: 2 vCPU and 4 GB RAM runs a handful of apps comfortably. See how much RAM a VPS needs and Ubuntu VPS.
  2. A domain name, with DNS records pointing subdomains (vault.example.com, status.example.com) to your server. See DNS records explained.
  3. Docker + Docker Compose: most self-hosted apps ship as containers, and one compose.yaml per app keeps things tidy. See install Docker and Docker Compose tutorial.
  4. A reverse proxy with automatic HTTPS: Caddy (simplest), Nginx Proxy Manager (GUI), Traefik, or plain Nginx with Certbot. See Caddy reverse proxy and Nginx Proxy Manager.
  5. Backups: automated and off-site. See Docker volume backups.

Prefer a GUI? Platforms like YunoHost or Coolify bundle much of this. See Cloudron alternatives.

Day-one security checklist

  • Log in with SSH keys, and disable password login. See SSH keys.
  • Turn on a firewall: allow only 22, 80 and 443. See UFW.
  • Install Fail2ban, and enable automatic security updates. See Fail2ban and unattended upgrades.
  • Bind app ports to 127.0.0.1, and expose them only through the reverse proxy.
  • Admin panels (Portainer, databases, dashboards) go behind a VPN (Tailscale or WireGuard), or SSO. See Tailscale.
  • Use unique, strong passwords, and 2FA wherever an app supports it.

Full list: Linux server hardening checklist.

Docker’s firewall gotcha

Ports published by Docker (-p 8080:8080) bypass UFW rules, because Docker inserts its own iptables rules. Publish as 127.0.0.1:8080:8080 unless a port really must be public. See Docker and UFW.

Your first five apps (suggested order)

  1. Uptime Kuma: easy, useful, and teaches the Compose + proxy + HTTPS pattern.
  2. Vaultwarden: high value. Practise backups with it, because you can’t lose this data.
  3. A homepage dashboard to link everything. See Homepage.
  4. Nextcloud or Immich: bigger apps with databases. Watch RAM and disk.
  5. A monitoring stack (or simply alerts from Uptime Kuma) so you know when something breaks.

Habits that keep self-hosting fun

  • Write things down: a README per app (ports, domains, where data lives, how to restore).
  • Keep Compose files in Git, with secrets kept out of it.
  • Update regularly, but read release notes for major versions. See updating self-hosted apps.
  • Test a restore every few months. See backup strategy.
  • Don’t host what you can’t maintain: email servers and public services need more care.

Quick reference

Layer Beginner choice
Server VPS with Ubuntu/Debian, 2 vCPU / 4 GB
Apps Docker Compose, one folder per app
HTTPS Caddy or Nginx Proxy Manager
Access to admin tools Tailscale / WireGuard
Backups Nightly dumps + off-site copy

Related: Portainer and Docker VPS hosting.

  • Self-Hosting
  • Beginners
  • Docker