Hardware wise I’d go AIO. A mini and a pair of mirrored USB drives is my setup. I have an off-site backup running: another mini + USB. Finally, I have an inherited laptop as a redundant network box/local backup/immich compute. I have 5 households on my network, and aside from immich spiking in resources (hence the laptop), I have overhead to spare.

An n100 mini (or n150, n200, whatever) is cheap enough and powerful enough for you to jump in, decide if you want to spend more later. They’re small, quiet, reasonable Value for Money, easy Wife Acceptance Factor, and can age into a bunch of devices if you decided self hosting isn’t for you. I’d make a retro console out of any spare mini.

This way, when spending £x00s on a server, you’ll have some idea on what you actually need/want. The n100 can the age into a firewall/network box/local back up/etc if/when you upgrade.

All that said. An AIO storage-compute box is where I’m headed. I now know I need a dedicated graphics card for the immich demand. I now know I want a graphics card for generative AI hobby stuff. I know how much storage I need for everyone’s photos, and favorite entertainment, permanent stuff. I know how much storage I need for stuff being churned, temporary stuff. I now know I don’t care about high availability/clusters. I now know… Finally, the ‘Wife’ has grown used to having a server in the house: it’s a thing I have, and do, which she benefits from. So, a bigger, more expensive, and probably louder box, is an easier sell.

Update went fine on a bare metal install. Customising the webUI port is a little easier now, instead of editing lighttdp.conf I think you can do it in the UI.

I struggled to find some settings, I looked for ages for the API token. Found it in all settings: expert, scroll for half a mile down the webUI API section.

Also, struggled with adding CNAMES in bulk, I thought you could do that in the old UI. You might be able to in the new UI. I just 'one by one’d them.

Docker update went flawlessly.

I have an lxc and to go which is a task for another day, unless TTeck’s updater beats me to it.

+1 for running pihole in an LXC, and a redundant pihole in a docker container.

They never update at the same time, or in the same way so near as dammit constant uptime.

My main storage is a mirrored pair of HDD. Versioning is handled here.

It Syncthings an “important” folder to a local back up only 1 HDD.

The local Backup Syncthings to my parents house with 1 SSD.

My setup can be better, if I put the versioning on my local backup it’d free space on my main storage. I could migrate to a dedicated backup software, Borg maybe, over syncthing. But Syncthing I knew and understood when I was slapdashing this together. It’s a problem for future me.

I’ve been seriously considering an Elitedesk G4 or Dell/Lenovo equivalent as back up machines. Mirrored drives. Enough oomph to HA the things using the “important” files: immich paperless etc.

My big problem is remote stuff. None of my users have aftermarket routers to easily manipulate their DNS. One has an android modem thing which is hot garbage. I’m using a combination of making their pi be their DHCP and one user is running on avahi.

Chrome, the people’s browser of choice, really, really hates http so I’m putting them on my garbage ######.xyz domain. I had plans to one day deal with Https, just not this day. Locally I just use the domain for vaultwarden so the domain didn’t matter. But if people are going to be using it then I’ll have to get a more memorable one.

System updates have been a faff. I’m 'ssh’ing over tailscale. When tailscale updates it kicks me out, naturally. Which interrupts the session, naturally. Which stops the update, naturally. Also, it fucks up dkpg beyond what --configure -a can repair. I’ll learn to update in background one day, or include tailscale in the unattended-upgrades. Honestly, I should put everything into unattended-upgrades.

Locally works as intended though, so that’s nice. Everything also works for my fiancee and I remotely all as intended, which is also nice. My big project is coalescing what I’ve got into something rational. I’m on the make it good part of the “make it work > make it good” cycle.

In that case. Homarr is awesome, no complaints.

I probably won’t retroact this, my family aren’t going to explore and it was more to keep them on their specific homepage and stop them getting lost. New users will be locked to their specific page, I don’t expect they’ll ever go exploring to find out.

+1 for Homarr. I didn’t need to learn how to write any configs. Everything can be setup in realtime, in the GUI, and is immediately testable. Homarr brought a homepage down to my skill level.

My only wish is to lock homepages behind user permissions but it’s fine, my family friends don’t intend to explore, just to get to where they’re going.

That was my conclusion as well, however I am at work and it’s not appropriate to be reading docker documentation. Thank you for the write up.

I am not the person to be asking, I am no docker expert. It’s is my understanding depends_on: defines starting order. Once a service is started, it’s started. If it has an internal check for “healthy” I believe watchtower will restart unhealthy containers.

This is blind leading the blind though, I would check the documentation if using watchtower. We should both go read the “depends on” documents as we both use it.

It’s Watchtower that I had problems with because of what you described. Watchtower will drop your microservice, say a database, to update it and then not reset the things that are dependent on it. It can be great just not in the ham fisted way I used it. So instead I’m going to update the stack together, everything drops, updates, and comes back up in the correct order

Uptime Kuma can alert you when a service goes down. I am constantly in my Homarr homepage that tells me if it can’t ping a service, then I go investigating.

I get that it’s scary, and after my Watchtower trauma I was hesitant to go automatic too. But, I’m managing 5 machines now, and scaling by getting more so I have to think about scale.

I’ve encountered that before with Watchtower updating parts of a serrvice and breaking the whole stack. But automating a stack update, as opposed to a service update, should mitigate all of that. I’ll include a system prune in the script.

Most of my stacks are stable so aside from breaking changes I should be fine. If I hit a breaking change, I keep backups, I’ll rebuild and update manually. I think that’ll be a net time save over all.

I keep two docker lxcs, one for arrs and one for everything else. I might make a third lxc for things that currently require manual updates. Immich is my only one currently.

deleted by creator

Release: stable

Keep the updates as hands off as possible. Docker compose, TTeck’s LXC updater, automatic upgrades.

I come through once a week or so to update the stacks (dockge > stack > update), I come through once a month or so to update the machines (I have 5 total). Total time updating is 3hrs a month. I could drop that time a lot when I get around to writing some scripts to update docker images, then I’d just have to “apt update && apt upgrade”

Minimise attack surface and outsource security. I have nothing at all open to the internet, I use Tailscale to create tunnels. I’m trusting my security to Tailscale but they are much, much, better at it than I am.

I use Joplin for day-to-day: to-dos, journals etc. I like Joplin, but I haven’t tried the others. I tend to be sticky with services, if something “works” I don’t go looking for better. Only when I have a specific problem I can’t solve do I branch out.

I use bookstack for documentation on the server, faqs guides, updates etc. perhaps that works for others. The lack of android app is what moved me to Joplin.

Lemmynsfw here, we see you. Do you, errr, see us?

You can still use a reverse proxy inside the VPN and use your own DNS server that spits out that internal address to your devices for your various applications.

Excuse me what? Here’s my dumb ass navigating to "[device name]:[port] over tailscale.

I’ve tried this a couple times and I’ve always failed. I could never figure out how to get a http://service.domain request to my Nginx install to be proxied in the first place. I tried putting pihole on tailscale and setting that as tailscale’s DNS. It blocked ads but I couldn’t navigate to custom domains. I put NPM on tailscale hoping that was the issue. I looked for LocalDNS/CNAMES in tailscale to see if I could do it that way. Do I have to set a local machine as an exit node and do split DNS shenanigans, service.domain goes through to my local and everything else the wider web? Do I set a router node?!

Not expecting you to troubleshoot, I don’t have time to see it through anyhow. Just annoyed at myself I couldn’t figure it out and driven to try again.

If you’d permit a short quiz. Ntfy is really interesting to me. I would like to send general server updates and didn’t know how to ensure users, just family and friends, get them. I think ntfy could solve that problem, right now I just text and maintain a bookstack document.

I would also like to send user specific notifications though. For example a user requests a show from Jellyseerr, the admin legally obtains said show and uploads it to jellyfin, user then gets notification that the show they requested is available.

Pet detection is sorta on the roadmap for 2025… I couldn’t be happier.

+1 for immich, if I didn’t already know I would be doing photo backups it would have been my entry. For things “I didn’t know I needed”

My server is full of bindmounts. Too many bind mounts. It causes a host of permissions issues if I’m honest. There wasn’t a storage problem I didn’t solve with bindmounts. Except this one, this one I decided I had to have interact over SMB or some shit.

I remember, I tried to solve it with bind mounts before. I couldn’t figure out why it wasn’t saving to /mnt/important/paperless/… I think when I get to /originals it’s going to look like ./originals/mnt/important/paperless/… Somewhere it’s going to look like that. Urgh

Thank you. With that problem solved Paperless is, currently, perfect for my needs.

Thank you. Setting it up seems less daunting now. I’m going to try for setting up emails.

The android app is fairly functionally complete, and I only interact with my phone or tablet. In fact, for desktop tasks I have a Linux Mint VM I just console into from my tablet, a sort of sudo laptop.

In anycase, for manual uploading files my phone is probably easier. But, your advice is good for everybody that’s not me, sensible people.

Your comment about bindmounts might have solved my biggest problem with Paperless, in that it doesn’t write to my 3-2-1 back up folder directly so I end up 3-2-1ing the whole machine. Which is fine, but I keep multiple snap shots of my LXCs so it’s multiples of multiples.

/zpool/important/paperless:/use/src/paperless/original

Specific file paths aside, would [path to zpool]:[path to originals] have paperless saving the originals to my zpool so I would only have 3 copies instead of 3*#of snapshots?