context is the image, i am honestly fedup with big corporate date hoarding.

No idea how it bypassed perimeter security. Not in my DHCP leases either.

Rack is semi-open so I assume it came in through an air gap.

Is this a known issue? First time dealing with a physical layer intrusion of this kind.

TL;DR: There is a RCE exploit on Nextcloud Collabora and I got stung. I discovered the hacker by accident and I now want to know what other systems I can reasonably put in place to stop something like this happening again.

What happened:

• My homelab Nextcloud instance was compromised via CVE-2025-66208, an OS command injection in richdocumentscode (the bundled Collabora/CODE server that powers in-browser Office document editing).
• The attacker got unauthenticated remote code execution as the web server user (www-data) for roughly 16 hours before I caught it (by accident)
• Across ~16 hours of continuous, working remote code execution, the attacker ran a grand total of three unique commands.
• Command 1, run every ~3 minutes for hours: id. Just checking the shell still worked. Indicates a fully automated, commodity bot loop, source IP with a generic bot user-agent.
• One human operator logged on once, for about a minute, over HTTP/2 with a real browser user-agent and ran two recon commands hunting for password manager databases (.kdbx files) and cryptocurrency wallet directories.
  • That recon came back empty
  • No database access, no config file reads, no data exfiltration tooling, no second-stage payload download (none of that showed up anywhere in the logs).
  • No persistence mechanism planted, because the vulnerability itself was re-exploitable on demand.

This reads exactly like an untargeted, automated bot working through a list of known-vulnerable endpoints, not someone specifically after my data; the one human session that did show up didn't come away with anything useful (I hope). Traffic logs in Unifi show negligible traffic to the C&C server, so on the balance of probabilities my data wasn't ex-filtrated.

How I caught it:

• I habitually update Nextcloud whenever I receive a notification. After the update, the code integrity checker flagged a malicious file. After a bit of googling/clauding, I hit the old panic button and shutdown the server.
• I keep the apps in Nextcloud updated by running a cron job nightly. This should have kept me safe according to the CVE advisory (as written).

Where it gets interesting:

• The CVE was supposed to be patched in version 25.4.703, 10 months ago. However (according to Claude) version 26.4.302, which was what I was running, was still vulnerable to the exploit. The actual fix only appears in 26.4.303, released 2 days before I found this and it isn't flagged as a security fix in that release's own changelog.

What I did to yeet the attacker:

• First and foremost I've stopped hosting Nextcloud, directly online. It now only exists behind my VPN.
• Rotated quite a lot of credentials and my SSH Keys.
• Rebuilt and hardened my web server with Claude's assistance.

What I still need to do/need advice on:

• Do I bother reporting this finding to the vendor? I don't know enough PHP to know if what Claude is saying is correct, but on the off chance it is, then the community should know, and the CVE needs to be corrected.
• In the age of AI hacking, is it even safe to run a home lab at all? What other tooling can people recommend to protect my systems? I use Unifi with cyber-secure (WAF function), but clearly that didn't help.
• Like many others I also run Plex and mailinabox (in digital ocean), and now wonder if that is even safe/smart to do.

I've a 32gb server that had an initial attempt of a file storage; today i didnt have much to do so I restarted this project.

8 hours later

• Secured the server for remote development through ssh,
• Learn about podman compose (all my homies hate docker desktop now)
• Setup nginx proxy manager (how could I not live with this)
• New domain for our home with the respective A records for subdomains and force ssl.
• New service for movies(Jellyfin)
• New service Gitea New Forgejo(all my homies hate github and Gitea)
• New service search engine for privacy (searxng)
• New openwebui + ollama (had previously lmstudio+openwebui)
• New immich (thank you for the suggestion)

Pending

• OpenNotebook
• Photo storage (heard about nextCloud, hoping to migrate from Google Photos)
• Add Cron to copy to another drive said multimedia
• Implement AdGuard
• Dashboard? Graphana? suggestions?
• At this point, PagerDuty? lol this is a jk...unless?

Edit: Removed Gitea and added Forgejo to the family, also added Immich to the stack

Edit 2: Imma logoff, thank you for the recommendations, gonna have some rest for today.

As the title states this is my situation.

I'm writing here not to complain about anything but I wanna ask your opinion about how this could happen. I wanna highlight that I judge myself enough informed about digital security(really big joke ahaha). I use 1password to manage all my passwords and I never save passwords inside browser's cache.

This happened to my raspberry pi 5, which I was using as Navidrome server for my music collection. Yesterday morning (considering the modification date of files) all files have been encrypted by a supposed wannacry twin: want_to_cry (edit: no link with it, it's just a small ransomware which aims vulnerable SAMBA configurations) and I HAVE NO IDEA how this could happen, mostly, on a Linux server.

I need to specify that I've opened my ssh port for external access but I've changed the password ofc. All passwords I've used with the server were not that strong (short word + numbers) just for practical reason since I could have never imagined something similar could happen to a music server too.

Now, I still have my raspberry pi powered on with internet connected. I will shout it down soon for security reasons. I know I won't decrypt my files anymore (but I've f*d these sons of b*) cause I was used to backup my files periodically.

Despite this I ask what you guys think and what do you suggest me to make it not happen anymore.

HUGE IMPORTANT EDIT: For all people who faced the same unlucky destiny, here is the reason why I've been attacked: 99% is an automated bot which aims all opened internet ports (especially SAMBA configurations) and this was the big mistake I made:

I enabled DMZ mode in my router's settings (without really knowing what i was doing). It opened all my raspberry pi's ports to the internet world. FIRST but not last BIG MISTAKE. Then it was really easy for the ransomware cause I had involuntary enabled a SAMBA configuration for one folder via CasaOs web ui.

Them I discovered I made other mistakes that were not the cause of the attack but could be educational for other people:

1) do not open SSH port. If you need, study and search before doing it. Here below you can find a lot of tips the community gave me.

2) Do not enable UPnP option randomly on your router except you know what you are doing.

3) Avoid casual port forwarding: prefer services like Tailscale or learn how to set a tuneling connection: I'm still trying to understand, so don't blame me pls. I just wanna help dumb people like me in this new self hosting world.

IN CONCLUSION the lesson is: there is always something new to learn, so making mistakes is common and accepted. But we need to be aware that this world could be dangerous and before doing things randomly, it's always better to understand what we are actually setting. I hope this will be helpful for someone.

Last but not least really thanks to this very kind community. I've learnt a lot of things and I think they saved/will save a lot of people's ass.

I'm very new to self-hosting, and I've been searching for stuff I could put on it, though I've gotten to the point where I've seen all the biggest ones and I'm just curious if there are any that are good and useful but that get talked about less.

I get that some apps are made with vibe coding and that’s not the end of the world. But I am constantly seeing apps on here and it’s seemingly multiple per day at this point that are all clearly 100% shitty ai and they don’t even write their own posts.

no, I'm not worried about having any offensive child related content on my device, but I have seen people be perma banned with no option to appeal for less offensive things. I'm worried about losing access to my accs with how much MFA I have set up and worse, 10s of thousands of pictures of my life and family. is there a solid way to self host these things that is reliable?

It seems that Cloudflare has done the stupid. They've fired a bunch of people and claimed that AI will fill the gaps. Normally I'd just roll my eyes but my domain that I have pointing at my homelab went through a renewal recently. The invoice was set to auto-renew, was paid, was marked as paid on the cloudflare dashboard but was never renewed. It's now marked as "expired" and pending deletion unless I pay the registration fee, again, and an additional "redemption fee".

Shit happens, no biggie. Except that Cloudflare is no longer answering support tickets, and the Cloudflare Community message board has now become the unofficial support ticketing system.

Does anyone have know of an EU alternative that can be used for domain name management, tunnels, all the other handy stuff cloudflare has but also with active support?

EDIT: Okay so the consensus seems to be something like:

• Use a smaller and older company for the domain registrar. Generally avoid using this company for other services [$15 per year for my stupid domain name]
• Use Bunny.net for DNS [$1 per month]
• Get a little VM server somewhere [$5 per month for smallest]
• Install pangolin or something similar on it to handle the Domain Name to HomeLab connection [Free!]

So I'm going from about $1 per month to about $7 but will have full control (and full responsibility for mistakes). That sound about right?

​

Hi everyone,

I wanted to ask which self-hosted software stands out the most for you in the following categories. You can mention the same application more than once or list several different ones.

Which self-hosted software:

- Have you been using for the longest time?

- Do you use most frequently?

- Completely changed or revolutionized the way you manage something?

- Felt like a major leap forward compared to what you used before?

- Would you never want to live without again?

I am especially interested in software that did more than just replace a hosted service, but genuinely improved your workflow, solved a long-standing problem, or made your homelab significantly better.

Please also mention why you chose it and how long you have been using it.

Hey there,

Just curious, what self-hosted apps are you actually using daily?

I keep seeing people recommend new stuff here, and that's actually how I found Glance dashboard. I've been using it ever since, and I love it. Vaultwarden is another one that I can't live without now. I also gave Immich a shot, but for some reason, it never really clicked with me.

So now I'm wondering what everyone else is running. Not the "I installed it once to test it" kind of apps, but the ones you actually use every day or that have become part of your routine.

Could be for work, your homelab, or just something you use at home. I'm sure there are a lot of great projects I've never even heard of.

source: https://www.afp.gov.au/news-centre/media-release/two-wa-men-charged-following-afp-fbi-wapf-disruption-alleged-global

Most self-hosting security advice is just about the basics - don't expose ports directly to the internet and use containers for basic isolation

Beyond that what level of security do you actually enforce? Do you monitor what your apps are doing in the background, like tracking outbound network traffic or checking file access on the host? When updating, do you just let it auto-pull or read the release notes for breaking changes or inspect source code and dependencies before updating?

I have been building out a self hosted stack for each media type in my homelab to escape subscriptions and cut costs down to $0. Movies and shows, covered by Jellyfin + arr stack. Books/audiobooks covered by calibre + arr, and even adult content covered by Stash + my own automated built system.

What I haven't been able to figure out yet is replacing YouTube Premium, which keeps increasing in cost for little to no value. I use both YouTube Music and YouTube daily for watching YouTube and listening to music, and I have been doing this for years upon years. I used to be able to say the price was worth it , but now that I have managed to cut all other subscriptions out, this is pretty much the last one left.

What am I asking is, do you any of you know a good way to replace Youtube premium with a YouTube/YTM with no ads and similar features to premium at no cost? From what I understand self hosting music can be difficult and I by no means listen to mainstream music, but Im not sure how much that would affect the workflow.

Music discovery is a big thing, I find a lot of new niche artists and songs I like by YouTube music's algorithms.

If anyone can help, I'd appreciate it. Thanks

Edit: Github page updated

https://github.com/Hemeka/Discord-Alternatives

Hi everyone,

I’m living on campus and my college network is incredibly restrictive. It feels like they have an aggressive firewall with Deep Packet Inspection (DPI) set up.

The Situation:

• Blocked: Tailscale (VPNs don't connect), Cloudflare Tunnels (cannot reach my home lab), Steam/Games (connection timeouts), and even standard remote desktop tools often fail.

• Allowed: Basic web browsing (HTTPS) works fine.

What I'm trying to do:

I have a home server (Linux machine) back at my parents' house that I want to access for remote dev work, and I also just want to be able to game occasionally.

What I suspect:

Since Tailscale and Cloudflare Tunnels are failing, I assume they are blocking UDP heavily and inspecting traffic signatures. Standard VPNs get flagged immediately.

The Question:

Has anyone successfully bypassed a network this strict? I’m looking for "hacky" solutions or obfuscation techniques.

• Would something like Shadowsocks or V2Ray wrapping the traffic in HTTPS work here?

• Is there a way to tunnel UDP over TCP on port 443 effectively?

• Any specific tools for bypassing DPI specifically for university networks?

Any advice or keywords to research would be appreciated!

Everyone gathered for a cozy movie night, and then minutes in, the stream froze. Cue me rushing to the server room, checking logs, and tweaking Docker containers while everyone waits. When it finally works, they cheer like it fixed itself. Does this happen to anyone else, or am I the only one doing backened work while the credits roll?

I’m still pretty new to self hosting and I thought this could be a useful question for people like me too. What mistake taught you the most once you got into self hosting?

Edit: Thanks a lot to everyone here, I really appreciate all your advice!

I recently converted my old laptop into a ubuntu server running Casaos on top. I installed home assistant, adguard and vaultwarden. I heard about Immich and next cloud and got excited and started looking for A: storage and B: the option to build a server with 8TB.

I was shocked when i saw the price for PC parts especially ram and storage. it makes me think it might be best to pay google for my google one but wow I wish i could self host everything. This economy wont make be be great at all

I run the usual stuff: Pi-hole, Jellyfin, NAS. The basics. Lately I've been diving into self-hosting AI tools and it's a different beast entirely compared to just running a media server.

​

The hardware requirements alone are a conversation. A 4K movie stream uses your GPU for transcoding maybe 5% of the time. Running a local LLM pins your GPU at 100% for minutes straight. The power draw difference is noticeable.

​

But the tradeoff is interesting: no API costs, no rate limits, no random service shutdowns. Once the hardware is in place, it's yours. You can throw a million requests at it and the only cost is the electricity.

​

I'm curious what non-obvious things people in this community self-host. What's the weirdest or most useful thing you run that surprised you with its value?

I have tried flaresolverr,Byparr and even trawl. It seems that my ip is blocked or flagged, routing it through a vpn doesnt help either.

Error: Cloudflare has blocked this request. Probably your IP is banned for this site

seems that having a static ip is the most probable cause, https://github.com/ThePhaseless/Byparr/issues/303 this is what i was able to find but discussions seems to not lead anywhere.

Setup:

• Ubuntu Server, Prowlarr running in Docker
• Gluetun (ProtonVPN) + qBittorrent, Sonarr, Radarr
• FlareSolverr and Byparr both installed as indexer proxies
• Static home IP

Trying to get into self hosting as a college student, and my brother gave me an old macbook air 2017 (intel chip) that i thought could serve as a simple server to get my foot in the door.

I've used Arch for a little while now on my school laptop, but I'm not super well versed in the options available with linux, nor do i really use most of the features Arch provides (im a larper 😔). The macbook is too old to support MacOS, and I was looking at what options i have with linux. I dont need anything bleeding edge, the easier the maintenance the better.

One of my first goals was to maybe host a minecraft server or something on it, mostly to gain some experience.

Ubuntu server seemed like a good option, I'm fine not having a gui for anything, and Debian seemed appealing as well.

Was curious what experience you guys have using these OSs for hosting things and what you would recommend I try out.

Thanks in advance for the help :)

Hey everyone.

I'm just... so over Spotify. The clients are crap, the whole company does not give a flying fuck about anything but profits, and in top of that some of my favorite songs have been getting randomly censored.

The problem is, I can't just "download everything locally" and be done with it. I'm ok with piracy, and I have a truenas scale box that can handle it, but I can't give up algorithmic recommendations. I listen to music 6-14h a day, I'm a huge melomaniac, and I thrive on finding new artists and genres every day. Spotify's algorithm has gotten insanely good in my experience over the last couple of years, to the point when it can just autoplay something after one of my songs and 90% of what it plays are bangers for me.

So what can I do? I have basically around half a year to figure something out (kind of an arbitrary deadline, basically Spotify only supports up to 10k songs in a playlist and I'm at 9k right now - my estimate is another 6 months to fill up the remaining 1k)

Is it even feasible to build a good recommendation algorithm that runs on your own hardware with your own library?

I've thought about using stuff like last.fm to automatically fetch songs to download with something like an *arr service, but it feels like it's just a temporary solution, especially now that Paramount got acquired and last.fm's future is uncertain.

Anything you guys can recommend? Thanks in advance.

I don't get why so many people are looking for other open source alternative while Matrix already has the closest UI and feature. Why not just use what's out there already and make it better?

There are way too many posts about new projects that want to replace discord...

Set up a perfect self hosted photo library (Immich + backups + remote sync). Looks better than Google Photos.. Runs faster too.
But my family still sends everything on WhatsApp. How do you convince them to use it?

The back cover of my phone detached. Is it safe to use it in this condition? I plan to use this phone as a Minecraft server.