CaptainShardmind

I run a small invite-only Matrix server for a handful of people, with federation turned off and the admin side reachable only over my Tailscale network. Your friends won’t need Tailscale at all. The usual pattern is a cheap VPS running a reverse proxy that faces the internet and passes traffic back to the box at home, so your NAS never gets opened up. Turning federation off also sidesteps most of the public-room and metadata worries people raised here, since it’s just your group. I also host Cinny next to it so there’s a web version nobody has to install, and I use it with SchildiChat Next on my phone to move files and notes between my PC and phone. For non-tech friends I’d point everyone at FluffyChat or the Cinny link and walk them through saving their recovery key on day one, because that’s where people get stuck.

Ubuntu Server here, after a short stint on Proxmox that felt like extra layers for what I was doing with containers. I’m in the Nginx Proxy Manager camp too, running it on a small cloud VM with most of the hosts behind it limited to my Tailscale network, so only a couple of things face the public internet. On the forwarded-ports question, I’d guess a lot of people answered based on whether they opened ports at home, since a proxy on a VPS lets you skip that entirely. The year-over-year overlay is a really nice addition.

Retired business or surveillance hardware is worth checking locally too. My two servers are repurposed NVRs running plain Ubuntu Server, and a Dell OptiPlex handles dev work. For that list, I’d start with the hardware you can get affordably and check its RAM capacity and drive connections before buying. Docker on plain Linux keeps things straightforward. With Immich, budget for a separate backup of the photos before it holds your only copy.

If the rest of the household mostly uses the apps themselves rather than the server, the OS underneath matters less than it seems. I run plain Ubuntu Server and manage the containers with Komodo, which I moved to from Portainer: it gives me a web UI to see, restart and update stacks, while the compose files stay ordinary files I can back up. Since you already back up your configs and YAML, keeping compose underneath means the next dead SSD is a reinstall and a redeploy, not a migration out of someone’s app store.

The part that got me is a single fork turning into billions of valid URLs, because every commit, diff and plain render is its own page. I run a small Gitea behind Nginx Proxy Manager, and a forge is exactly the kind of app where that math applies even at hobby scale. This has me checking whether anonymous visitors need the commit and diff views at all, or whether putting the web UI behind a login would cost me anything. Clones over git would still work for anyone who actually wants the code.

Thanks for flagging this. Tailscale SSH is how I get into my Ubuntu Server boxes, so this one applies to me. The machines page in the admin console lists the client version for every node, which is the quickest way to spot the one box that didn’t take the update. Hosts that pull from Tailscale’s apt repo get it with normal updates, but anything installed another way, like a container image or a hand-installed binary on a cloud VM, can sit on an old version for a long time.

I keep my Docker app data on ZFS, with sanoid snapshots every 15 minutes and syncoid replicating hourly between two boxes, so plain file backup is mostly covered by the filesystem for me. Where a tool like this would still earn a spot is the database side, since a snapshot of a running Postgres isn’t the same thing as a proper dump. Does the Restic snapshot mode let you restore a single directory to a different path, so you can test a restore without touching the live copy?

Five minutes for a four-month rollback is quicker than I’d have guessed. Mirrored, underprovisioned D3s for boot is a nice way to stop worrying about that drive.

I’m on Symfonium with Navidrome, but automatic playlist download sync is the feature that would get me to try an open-source client. Does it keep a downloaded playlist in step when a Navidrome smart playlist changes on the server?

I’m not on OPNsense, but I lean on the same idea with my Ubuntu servers, and being able to roll back is what makes me willing to update at all. One thing I’d add: boot environments live on the same disk, so export config.xml somewhere off the box on the same schedule. And do one deliberate rollback before an update forces you to, so you know how long it really takes.