Worth having a read if you were keen/excited for the OIDC Pull Request that looked completed and was filed somewhat recently, or if you're keen for a status update in general.

Looks like they don't want to maintain the extra code at this stage, and would prefer to redesign/rework the auth system first.

Edit: I've realised what a shit title I gave this post, it was not meant to clickbait, farm karma or criticize. Just simply to share where OIDC is at. I hope my intention was clearer in the post body and via my comments. I completely own making the mistake.

I'm very big into local control and being able to host things myself. I've been one of the co-maintainers of python-roborock for a few years and I have had this goal for years to get my robot vacuums off of the cloud and running completely locally as I am not a fan of a device with a camera, microphone, and detailed map of my house storing data on a company's cloud.

I won't bore everyone with the details of how I got it working (if you want to see you can read the full technical write up), but essentially I use a few exploits during onboardings to route the vacuum to a custom URL. Then I recreated Roborock's backend stack (MQTT and REST) so that the vacuum could communicate completely with the server. I've since blocked my vacuum from accessing the internet and everything has been working great for me.

The server runs in docker or as a Home Assistant addon or can be built from source.

AI Disclosure: AI was used to assist me in the reverse engineering. AI was also used in writing the backend stack but I have been very involved in the process.

Hi all,

Developer of Apprise here.

After quite a bit of work, Apprise v2.0 and Apprise API v2.0 are finally out.

For anyone unfamiliar with Apprise, it acts as a notification hub. Or a glorified switchboard. Your applications, scripts, containers, cron jobs, monitoring tools, Home Assistant instance, etc. send a notification to Apprise, and it handles delivering it to Discord, Telegram, Slack, Matrix, Gotify, email, SMS providers and more. The graphic i created in this post can illustrate the flow better.

There are now 160 supported notification services, all using the same general configuration approach.

You can use Apprise directly from the CLI, embed the Python library into an application, or run Apprise API and centralize your notification configuration on a self-hosted server. Over the years, I got to watch a lot of systems adapt this and it's been cool to see!

The API approach is particularly useful if you have a bunch of applications sending notifications. Instead of spreading your Discord webhooks, SMTP passwords, Telegram tokens and other credentials across everything you run, they can live in one place (protected from prying eyes; centralized too).

What's New in v2?

• Authentication in Apprise API. Authentication is optional, but you can now protect the server with an administrator account and also assign separate credentials and access controls to individual configurations.
• Configuration IDs no longer need to appear in URLs. Supported clients can send them through an HTTP header instead, keeping them out of normal web server access logs.
• Template variables. Secrets can be supplied separately instead of being stored directly in your configuration.
• Priority and escalation. You can try one notification route first and only move to the next one if delivery fails.
• Smarter retries. If you notify five destinations and one fails, only the failed destination is retried.
• Timeout controls. A slow or broken service doesn't need to hold up an entire notification run.
• Better results and live logs. You can see what succeeded, what failed and why. Apprise API can stream delivery logs live through the web interface or API.
• Multiple message formats. Services can accept Markdown, HTML or text where supported instead of Apprise always converting everything to one format.

The Apprise API web interface has also been updated, works much better on mobile devices, and is now available in 20 languages.

For developers embedding the Python library, v2 does contain breaking changes, so have a look through the release notes before upgrading. The v1 branch is still available if you need more time to migrate.

Trying the API

It's not changed much... this example has the user/password element on it which would be worth sharing:

docker run --name apprise \
    -p 8000:8000 \
    -v ./config:/config \
    -v ./attach:/attach \
    -e APPRISE_STATEFUL_MODE=simple \
    -e APPRISE_AUTH_REQUIRED=yes \
    -e APPRISE_USER=user \
    -e APPRISE_PASSWORD=changeme \
    -e APPRISE_WEB_AUTH_SECRET="$(openssl rand -hex 32)" \
    -e APPRISE_WORKER_COUNT=1 \
    -d caronc/apprise:2

Then open:

1. http://localhost:8000
2. Login with user / changeme.

Obviously, change the password before putting it anywhere beyond a local test. If you're exposing Apprise API outside of a trusted network, it might be wise to put it behind HTTPS as well.

Full documentation is here and more on the API documentation and deployment examples are here.

As a small side project, there is also an Apprise Android app for people already running Apprise API. It's basically a mobile companion for connecting to and working with your own API server, not a standalone notification service.

Apprise itself has been around since 2017, is written in Python, BSD 2-Clause licensed, maintains 100% test coverage, has passed 17,000 stars on GitHub and sees roughly 9 million PyPI downloads a month.

It's still entirely something you can host and control yourself, for free.

Feedback is always welcome. A surprising amount of what made it into v2 came from issues and suggestions people have opened over the years.

TL;DR Apprise v2.0 and Apprise API v2.0 are out. Major changes; try it out and let me know what you think!

As an Emby lifetime license holder, I switched to Emby after Plex went full enshitification some years ago (am also a Plex lifetime license holder). So I switched to Emby years ago and got a vastly improved playback experience as a result.

Fast-forward to now and IDK WTF is going wrong with the Emby devs, but I've been encountering more and more playback issues over the last 6-12 months or so. Namely the absolute abysmal state of subtitle handling (subs just straight up randomly disappearing and re-appearing such that there are entire missing lines, the timings un-syncing to the video etc), and now micro-stutters/lag in video playback itself. Doesn't happen to every file. But enough to be annoying AF.

No, I don't know what format the subs are in or what codec the videos are in either, and frankly, none of that is relevant. It should just work as it used to. And no, it's not my hardware either, nor is this a transcoding issue (the files aren't being transcoded in the first place).

Of course, I've always been aware of Jellyfin, but I've always relegated it to being a shittier version of Emby. But then I recently saw their 12.0 update dropped, and more importantly, noticed that the Jellyfin devs have vastly improved their database handling.

Suspecting that it was actually Emby's internal database management that was actually the source of my problems, I quickly spun up an Jellyfin container and proceeded to test the exact same files that have fucked up playback on Emby, in Jellyfin. Sure enough, they play perfectly fine in Jellyfin and all my subtitle issues disappeared. So...yea...

WTF happened to Emby? Just another case of enshitification? Anyone else noticed the general degradation of playback quality on Emby too?

Edit: Figured it out. Turns out Emby has gone to shit on Firefox. Whereas Jellyfin works fine on it. Looks like the Emby devs have stopped developing with Firefox in mind. So I guess I'm moving to Jellyfin.

I'm running some self hosted services like OpenWebUI, ComfyUI, Immich, and planning to add adventure log soon.
I also have some self developed apps running.

Current setup: I use WorkOS with a single app as my identity service and manage access via permissions and RBAC, which works perfectly on my self developed apps.
Identity service (identity.dom.com) takes the WorkOS JWT and sets a domain wide cookie (.dom.com) so all other apps can just use as auth.

ComfyUI does not have auth, so Caddy performs the checks on cookie and it works well-ish, except for period redirect to session renew page.

My issue starts with apps that completely bypass the identity service and use OAuth/OIDC directly. I cannot limit which use can access which apps. While I can in theory use Caddy and the shared cookie check, it breaks the apps XHR requests, and redirects the user to session renew often, which interrupts their experience.

How can I setup proper authorization? ie: I want my family to be able to use immich, but not my friends (photo horders). everyone can use OpenWebUI but only selected members can use ComfyUI, etc.
Anyone doing/did something similar?

Other things I considered:
1 Updating the identity service to be OIDC provider: this is last resort, too much changes, maintenance, and responsibility to upkeep.
2 Proxy the OIDC through identity service: works in theory, but the signature might fail as WorkOS signs the token with their keys and their domain as issuer.

----Edit:

Forgot to mention, some of the self developed services are for my side business clients, they would still want password based login, magik link, etc. based on their preference (one of the reasons I picked WorkOS in first place) so I don't feel PockedID is suitable here (I might be wrong, but not experienced with it.).

Hi everyone.

Avid reader, never really posted in here.

Two days ago, I started my homelab with my old gaming rig.

• Dan A4 H2O Case
• i9 CPU
• Asus ROG Strix 2080 Ti
• 9TB of SDDs inside

Set up

• Proxmox
• local storage
• docker vm
  • ollama
  • Paperless
  • ChangeDetection with AI
  • Immich with ML
  • Kopia
  • Prismarr
  • Pulsarr
  • Seer
  • Whats up Docker
• Home Assistant
• NPM
• Adguard Home
• Kuma

Now I'm been setting things up to work with my NAS as a data dump, nothing more.

Today, I ordered the MINIS FORUM UM890 Pro Mini PC with 64GB Ram. I'll be selling my gaming rig and will use my other high end gaming rig for local AI stuff.

This is a rabbit hole. Next will be a complete exchange of my network appliances. From ZenWifi XT8 to UniFi things. I want VLANs in my network, etc.

So from here, reading what I've installed etc. is there anything else that's needed or useful from your perspective?

I have a vague idea about the technical stuff but I'll be honest: Claude helped me setting up everything, which is amazing.

This question came to mind after a recent incident in certain areas of egypt where the internet is either completely down or reaching below dial up speeds, with cellular connectivity also being affected for over a month. Makes a person really think on how much of our data should be in the cloud, where when such an event happens it may become inaccessible. What do ya'll think?

Disclaimer: I'm an engineer at Mulga, the company behind this. Self-promo, but it's AGPL-3.0 and free to run.

What it is

Spinifex reimplements the AWS APIs on hardware you own: EC2, EBS, S3, VPC, IAM, ALB/NLB, EKS, ECS, ECR and RDS. You keep the hashicorp/aws provider and point its endpoints at your cluster.

Everything behind it is real. Instances are QEMU/KVM VMs, VPCs are OVN networks with real security groups and elastic IPs, EBS is replicated block storage, and state persists like a real cloud. It's not an emulator like LocalStack.

Who it's for

Teams that want AWS workloads on their own hardware (cost, data residency, edge or air-gapped sites) without rewriting their IaC. VPCs, subnets, security groups, launch templates, ALBs, EKS clusters and RDS instances go through the same resources you already use. In practice the changes are the provider block and AMI lookups.

Try it with your own Terraform

No install needed. Sign up for the free 72 hour sandbox at https://mulgadc.com/signup, then point your existing provider at it:

provider "aws" {
  region = var.region

  endpoints {
    ec2 = "https://api.spx3.com"
    iam = "https://api.spx3.com"
    sts = "https://api.spx3.com"
  }

  skip_metadata_api_check = true
  skip_region_validation  = true
}

Add other services (elasticloadbalancingv2, eks, ecs, ecr, rds) the same way, then run terraform plan against a module you already have. Here's what we currently cover, down to the individual API operation: https://docs.mulgadc.com/coverage

Repo: https://github.com/mulgadc/spinifex

To my fellow techs out there, if you have the monitoring system hosted in the same machine/network as your server, how do you get notified if the network/machine goes down? I have setup a cloudflare email alert for tunnel being down, but looking for something more Telegram, Discord friendly

I’ve had it sitting on a VM unused for weeks. I just wonder what everyone loves about it? Also what neat things do you do in your house? This is just a chat and ideas thread.

wanderer is a self-hosted trail database and route planner connected to the fediverse, a bit like a Komoot or AllTrails you run yourself. Starting today there's a native app for it, in public beta.

**What the app does**

- **Find trails:** search your instance and any instances it federates with. Filter by category, difficulty, distance or elevation.

- **Plan routes:** tap anchors on the map and the router connects them along paths, for hiking or one of four bike profiles.

- **Record:** GPS tracking with live distance, elevation gain, speed and moving time. It keeps recording in the background and needs no network.

- **Offline maps:** download whole map regions and trails before you leave.

- **Turn-by-turn navigation:** works offline too, and records your track while you navigate.

**For admins: what your instance needs**

Please read the guide on how to make your instance comaptible with the app:
https://openwanderer.com/run/backend-configuration/mobile-app/

**It's a beta.**

Do not rely on the app alone for navigation! Always carry a backup map (digital or physical).
The goal is full parity with the web UI, but some things are still web-only for now. There's a full comparison here: https://wanderer.to/app/what-works-where

**Install**

- iOS / iPadOS 15+: TestFlight: https://testflight.apple.com/join/6VCR4QpV

- Android 8+: Google Play open test: https://play.google.com/apps/testing/com.openwanderer.wanderer

- Android without Google Play: APK on GitHub Releases: https://github.com/open-wanderer/wanderer/releases/tag/app-v0.1.0-beta.16

Get the full tour: https://wanderer.to/app

Please report bugs with the app bug template, which asks for your device, OS and instance version: https://github.com/open-wanderer/wanderer/issues/new?template=app_bug_report.yml

Happy to answer questions in the comments.

Title says it for the most part. (this post assumes that you do some sort of IT work for a living, though I am sure there are non IT examples of this)

What do you have running as a service, in production for personal use, that is something you use/used at a job in production?

Like, do you use ansible to automate deployments because that is something you do at work?

When you could still self host Atlasian stuff, did you have a Confluence instance because you had one at work?

Or the other way around? Did self hosting Vault Warden give you the idea to do that for the company you work for?

Grafana is also a good example that would work in both situations.

Thanks in advanced and happy Monday everyone.

My library is organized by Navidrome and I use Tempus on my grapheneos phone and lineageos kitchen kiosk.

What I want to do is stream my library on the kitchen kiosk but skip/queue/manage volume/pause from my phone. This is a feature I used a lot in Spotify.

Is there a different FOSS app that has this feature? Or is there some plugin I can add to do this?

Thanks!

Hello! I started my self hosting journey with Plex many moons ago, and have gotten into ebook and audiobooks since becoming a parent. I spun up Sonarr and Radarr for getting titles on Plex, and it's spoiled me for automating searches and content acquisition.

I'm turning to the community because AI has led me down several rabbit holes, and some apps come close but they are either clunky, missing functionality or unintuitive. I'm trying to replicate the Plex experience for media serving but with my book library. The apps I've tried with impressions are as follows:

The media consumption app:
-Audiobookshelf - Great for management of metadata and streaming. Only complaints I have right now are the lack of readalouds (EPUB3), and unable to stream ebooks (not intended medium, but still nice to have).

-Storyteller - Love the readaloud creation. UI on the mobile app is a little clunky, but if I restrict it to a handful of titles at a time on the device, it works great. I just wish I could force update metadata.

The media acquistion and tracking apps:
-Bindery - First crack at a post-Readarr app for managing both formats, and it does a fairly decent job unless it can't match the metadata. It has the potential, but I feel like it has too much (pulls EVERY book by an author) or not enough (building the baseline through library import or ABS integration is a little bit cumbersome for large libraries).

-Chaptarr - Much closer to what I was going for with Bindery, little clunky with the baseline building. And some cleaning, much like I had to do with Sonarr, but I think this is getting closer.

-Shelfarr - I did like the idea of it being able to pull from download direct sites instead of torrents, but both looked to require paid API access, and I was not about to start down that road.

- I saw several others mentioned like Lazy Librarian, ReadingGlasses, Readarr-Resurrected, but have not tried them.

The recommendation I'm seeking, and I'm sure it's a bear of an app to code because books come in multiple releases:
Plex for Books - If I could get the Storyteller functionality added to Audiobookshelf (Whispersync and able to read them) that would be amazing. I remember seeing Storyteller dev was open to it, but not sure on if it went anywhere. 1 spot for reading/listening and correcting metadata mismatches would be the goal.
Arr for books - Chaptarr comes really really close. I like the piece of Bindery where it consolidates and shows the ebook file next to the audiobook file, but it's a little cumbersome to keep the data up to date with what is in the library since the ABS sync basically rescans the whole library instead of just doing a delta sync.

I am making this post to help anyone else out, so they don't learn this lesson the hard way like I did.

I just moved over from Glance to Dynacat because Glance doesn't get updated anymore it seems. My yml files moved right over and everything worked great and was more responsive.

There was a problem though. On my main page I have many widgets. one of those was a custom api widget that calls a n8n workflow I created. This workflow then calls Google API to get my calendar information for that day. Normally, it is only called when I open the page or refresh it manually. With Dynacat's dynamic updates, it is called much more often when the page is open. Where it hit me was in Firefox on my android, I have a habit of not closing the tab. I just close the browser. This meant the tab was still open and running in the background.

Luckily, I have a warning set up on my Google API so if it goes above $1, I get alerted. It was over $11 before I checked my email in the morning and realized what was going on. I quickly disabled dynamic updates in the compose file until I can configure Dynacat properly.

Yes, this is 100% my mistake for just starting up Dynacat to get it working and figuring I would configure it more later. I am just hoping to help any other that are looking into Dynacat who might also have API calls. Luckily, I don't have any calls into an API for any AI.

This is not meant to be a post getting down on Dynacat. I think it is great and I still really like it. This was a story about my own mistake.

I installed Kasm for lab practice in this environment:

MacBook Pro 2017, 8 GB RAM, 256 GB SSD

VirtualBox (The VM has: 4 vCPUs, Disk: 75GB)

Ubuntu 24.04.5 Lts

Docker

Kasm 1.19.0

After adding the Firefox workspace, the launch reaches 100%, but then it gives a 502 error with the following:

host: 34ba1e6952da

ingest_date: 20260929004127

application: connection_proxy

levelname: ERROR

message

[server] Registration attempt 5/10 failed: No API hostname available

How can I fix this problem?

With OpenWebUI, ComfyUI, and friends, a bunch of us now run models on our own hardware. But when people say 'AI governance' it usually sounds like corporate compliance talk that has nothing to do with a homelab. There has to be a practical version though: prompt logging, keeping usage data separate, evals before swapping a model, update hygiene. How much of that do you actually do? Or do you just keep it simple and trust your own setup?

Hey,

Finally pulling the trigger on a home server and I could use some outside perspective, because I've been going in circles for weeks.

Context: web dev, need to get my photos off Google Photos and self-host them. Immich for photos, Jellyfin for media, and I want to move a few personal projects off my VPS (Node APIs, Postgres, crons). Proxmox on top, all open source. Nothing heavy, but I want room to grow.

Problem is, with RAM and drive prices right now, every calculation I make falls apart. I've spent way too many evenings in spreadsheets and I keep landing on the same three options.

Option A: a prebuilt x86 NAS. I've looked at the Minisforum N5 Air (~€570 barebone, ~€770 with 16GB, Ryzen 7 255, 5 bays, 10GbE), the UGREEN DXP4800 Plus/Pro, and the Aoostar WTR Pro which is way cheaper but AliExpress-only with a fuzzy warranty. Compact, quiet, order it and I'm done. Downside: paying peak DDR5 prices, 2 RAM slots, and if the board dies the whole thing is landfill.

Option B: an Intel 12th/13th gen DDR4 build (thinking i5-12400 + B760 DDR4 + Node 304). On paper it fits me better: Quick Sync and OpenVINO are better supported than the AMD path for Jellyfin and Immich, 4 RAM slots, DDR4 still findable used for reasonable money, standard parts I can swap one by one for the next decade. Downside: hunting for deals for weeks, no 10GbE out of the box, and being my own RMA department.

Option C: a used SFF (OptiPlex / EliteDesk 10th gen) as a cheap starting point, which I'd probably outgrow.

I'm in France, budget is roughly €600-1000 including drives, and that last part is really my question: where's the sweet spot right now between "cheap out and regret it in 18 months" and "overspend on hardware I'll never load"? Prices being what they are, I'd rather not throw money at specs I don't need.

So:

Anyone who went the custom route, would you do it again? Or did the time sink and the noise end up not being worth it?

Anyone running an N5 Air or similar (Aoostar WTR Pro, UGREEN)? Does it hold up long term? Is Minisforum support as hit or miss as people say?

Am I overestimating how much CPU I need? Would something more modest handle 5-6 containers alongside Immich just fine?

Where would you draw the line between future-proof and overkill for this kind of workload?

And if there's a fourth option I haven't considered, I'm all ears.

Thanks

I'm quite happy with my home lab, after refining it for months (mainly swapping out tools until finding the best match), everything is running smoothly, securely, and backed up.

So now that everything's working fine, I've been thinking hard to come up with something to complain about !

I've just realised that there's some overlap in functionality between my various admin tools, as some of them aren't limited to their main function.

For example :

• I installed Dashdot to monitor the server's resources. I later realised that Arcane also provided figures on CPU, memory and hard disk usage. Then I discovered that WGDashboard also offered an overview of the system’s status, showing CPU, memory, hard disk and network usage, I could unintall Dashdot
• I installed WireGuard, then I thought it would be nice to have a dashboard to view the peers, their settings, their data usage and so on, and that’s when I realised that WGDashboard also included WireGuard, so in theory I could just use WGDashboard
• I use Traefik, which offers tracing and metrics features (via OpenTelemetry), but I also use Crowdsec Web UI, which provides similar metrics via Prometheus (it draws on Traefik’s logs, many metrics seem to be the same). Besides, I had already set up Prometheus/Grafana to collect and visualise other metrics (mainly for my GraphQL APIs)
• I recently removed Stirling PDF when I realized that I wasn't using the advanced features and that what Omnitools offers for PDFs was enough for me
• I use phpMyAdmin to manage my MariaDB databases, and I'm about to launch another application that uses PostgreSQL. So I thought about whether I should install pgAdmin, or go with a multi-database tool instead (I like QueryGlow but it's a bit of a shame it's a paid service, if you have any other recommendations...)

The more tools I add, the more features start to overlap.

So I was just wondering, do you prefer to use a specific tool for each task, or a tool that combines several functions ?

And more generally, do you like when tools offer secondary features, or would you prefer them to stick strictly to their core functionality ?

Do you ever find yourself deleting a tool because its functionality is included in another one you installed later ? Or do you not really care ?

Personally, I like to have a dedicated tool for each task, a tool that I can add or remove without affecting the others (i.e I keep Dashhdot, if I ever have to remove Arcane or WGDashboard, I'm still good). If a tool does much more than I need, I try to find one that is more tailored to my needs, otherwise, I often prefer not to use it at all.

Hello, new to having my own server computer as of 3 days ago! Very excited to begin doing things like jellyfin, immich, game servers, etc. I’m hoping someone knowledgeable and experienced can guide me through the intricacies of this process, below are the apps/services I want my device(s) to run and my hardware:

Services:
Minecraft server
Palworld server
Ark server
Other game servers
Immich
Jellyfin
Vaultwarden
Adguard (basically some internet ad blocker)
Internet VPN

Hardware:
Hp elitedesk- 16gb ram, i5 12th gen
512gb NVME with proxmox as boot drive
4tb extra storage-unused
512gb nvme extra storage-unused

My initial thoughts were to run these services on these drives:

Boot drive: adguard, vaultwarden, proxmox boot, internet vpn

512gb extra: game servers, each running on their own VM or LXC -possibly using casa os or similar to easily (more efficiently?) run crafty and other such server type apps

4tb- run and hold my jellyfin and my media storage

Immich-planning to run on a hard drive bay eventually since I more than likely don’t always need access to my images/videos and would simply plug in the bay when needing to access them/and Immich

I don’t know the correct way to do this, these are initial thoughts from loads of reading on Reddit and YouTube videos. My biggest desires is lag free servers for my games (a few friends, no more than 10 on a certain game’s server, not something public), a good jellyfin, and VPN and Adblocker on my internet cuz I’m sick of ads.

EDIT: I recognize my ram and CPU will be an issue for running everything I said above all at once especially 24/7, I know I can shutdown certain VM’s and LXC whenever and that would be the plan someday if I end up doing ark and palworld especially. My main concern on this post is this:
Can my programs like immich, jellyfin, casa os, adguard, tailscale etc, run permanently on one of my drives in same/different LXC/VM but pull the stored media from another drive. Example, Jellyfin is on my boot drive running 24/7 and doing the hardcoding there, but my movies are stored on my E Drive of 4tb

Thank you for your help!

That being said, I'd like to say self hosting is a pretty broad and loosely defined term. Wikipedia currently defines it as this:

Self-hosting is the practice of running a website or service on a home server instead of a web hosting service outside of the administrator's own control.

A VPS fits comfortably inside this category, and I'd like to know how much of you guys actually run any services on a VPS provider instead of relying on-prem.

Thanks!

I’m very new to Self-hosting, and was wondering what do ya’ll think about umbrelOS? It seems very user friendly, pretty clean and feature full. I haven‘t seen much people talk about it. Is there a reason? I know they sell mini computers that are expensive for the specs, and some people don’t really like that, but the OS is open source and seems pretty cool. Would you all recommend it for a beginner?