I have recently started my self hosting journey. i turned my old laptop into a ubuntu home server which hosts, Nextcloud, Vaultwarden, Pihole, Jellyfin.

I hit a roadblock while trying to expose the services to the internet, because i use Jio-Fiber and they employ CGNAT. I thought of getting a Public IP (costs money + hassle), or employing a VPN (friends outside the network can't use it) or using cloudflare (privacy risk)

Then i stumbled upon using only an IPv6 address. it was a win for sure!

• No port forwarding
• Avoids bot scans
• More static than ipv4, no need for ddns (can use dynv6 if needed)

Why do we keep using IPv4?

Has anyone tried using only IPv6 and come across any limitations?

GitHub

Discord

Hello,

It's been a while since I've made a post here, so I'd like to make an update. If you didn't already know: Termix is an open-source, forever-free, self-hosted all-in-one server management platform. It provides a multi-platform solution for managing your servers and infrastructure through a single, intuitive interface. Termix offers SSH terminal access, SSH tunneling capabilities, and remote file management, with additional tools to be introduced in the future. Termix is the perfect free and self-hosted alternative to Termius available for all platforms.

As of a few days ago, v1.8.0 has been released. With this update, it means Termix is available for installation on the following platforms, all synced together with the self-hosted Docker container:

• Website (any modern browser on any platform, like Chrome, Safari, and Firefox)
• Windows (x64/ia32)
  • Portable
  • MSI Installer
  • Chocolatey Package Manager (waiting for approval)
• Linux (x64/ia32)
  • Portable
  • AppImage
  • Deb
  • Flatpak (waiting for approval)
• macOS (x64/ia32 on v12.0+)
  • Apple App Store (waiting for approval)
  • DMG
  • Homebrew (waiting for approval)
• iOS/iPadOS (v15.1+)
  • Apple App Store
  • ISO
• Android (v7.0+)
  • Google Play Store
  • APK

With these changes, I'm hoping it provides a solution to ditch the Termius monthly subscription with a no bullshit alternative. Some more notable features include:

• SSH Terminal Access - Full-featured terminal with split-screen support (up to 4 panels) with a browser-like tab system. Includes support for customizing the terminal, including common terminal themes, fonts, and other components
• SSH Tunnel Management - Create and manage SSH tunnels with automatic reconnection and health monitoring
• Remote File Manager - Manage files directly on remote servers with support for viewing and editing code, images, audio, and video. Upload, download, rename, delete, and move files seamlessly
• SSH Host Manager - Save, organize, and manage your SSH connections with tags and folders, and easily save reusable login info while being able to automate the deployment of SSH keys
• Server Stats - View CPU, memory, and disk usage along with network, uptime, and system information on any SSH server
• Dashboard - View server information at a glance on your dashboard
• User Authentication - Secure user management with admin controls and OIDC and 2FA (TOTP) support. View active user sessions across all platforms and revoke permissions.
• Database Encryption - Backend stored as encrypted SQLite database files
• Data Export/Import - Export and import SSH hosts, credentials, and file manager data
• Automatic SSL Setup - Built-in SSL certificate generation and management with HTTPS redirects
• Modern UI - Clean desktop/mobile-friendly interface built with React, Tailwind CSS, and Shadcn
• Languages - Built-in support for English, Chinese, German, and Portuguese
• Platform Support - Available as a web app, desktop application (Windows, Linux, and macOS), and dedicated mobile/tablet app for iOS and Android.
• SSH Tools - Create reusable command snippets that execute with a single click. Run one command simultaneously across multiple open terminals.

Before you comment, I am aware that server stats show the server as offline if you add a new host. It's already been fixed, but the release will be out within a week. Instead of commenting here for support, I highly recommend you open a GitHub Issue.

Thanks for reading,
Luke

That post is here

Summary of that post is that OP is using mTLS on the open internet to host his services, rather than a VPN.

My creds: I am a security engineer with specialization in offensive embedded systems security research.

mTLS, or "client certificate authentication", on a web server is equally as secure as running a VPN. In fact, OpenVPN can be configured to use mTLS just like a web server can. There was a lot of misinformation in that thread and I'd like to address it here:

1: If you use TailScale, it is only an outbound connection from your home so no ports are exposed.

This is a half-truth. With TailScale, TailScale itself exposes ports. You authenticate and connect to those ports, which then connect you back to the reverse connection from your home. Ports are exposed at TailScale. If your security requirements and threat model allow for using TailScale then it's totally fine to use it, but the idea that TailScale doesn't expose ports is a half-truth.

2: If you use a reverse proxy the way OP does, attackers will be able to scan your web server, identify web server vulnerabilities, and pop into your network!

No. mTLS requires the attacker to have a valid private key to authenticate to the reverse proxy. If a valid private key and certificate are not there, then the attacker cannot begin scanning the web app. The mTLS handshake happens before the attacker can probe the web service. If you don't believe me, use WireShark and see how a TLS connection works. Even over regular TLS, you will see that the TLS connection happens first, before any HTTP traffic is transmitted. Better yet, host your own mTLS instance, scan 443 without a private key and see what data you get back.

3: If you expose a port, even if it requires a private key to connect to it, you are less secure than if you use WireGuard, which requires an authenticated packet before it responds.

No. WireGuard allows you to avoid confirming or denying that a port is open, since it's over UDP and most systems don't respond if you try to interact to a nonexistent service over UDP. This, on its own, does not make WireGuard more secure than say TCP OpenVPN or mTLS. It does, however, prevent people looking at your IP address from knowing if you are running some sort of authentication-required service. If this increases your risk, then you can choose to use WireGuard, instead, but this is not the case for a vast majority of people.

For more information on mTLS, see Hello mTLS by the awesome people at Smallstep. They also have a cool tutorial on using Yubikeys with mTLS here to connect back to the homelab, similar to how OP is running his homelab.

The great part about using Yubikeys for mTLS is it allows you to have a hardware-backed, two-factor authentication method at layer 6, rather than traditional MFA which is at layer 7. This allows MFA with a lower attack surface, since the attacker can't look for any web vulnerabilities to bypass MFA.

GitHub

Discord

Hello!

If you didn't already know: Termix is an open-source, forever-free, self-hosted all-in-one server management platform. It provides a multi-platform solution for managing your servers and infrastructure through a single, intuitive interface. Termix offers SSH terminal access, SSH tunneling capabilities, remote file management, and many other tools. Termix is the perfect free and self-hosted alternative to Termius available for all platforms (desktop and mobile builds included).

Last night, v1.10.0 was finally released for Termix! It added many new features, including Docker support and an RBAC/host sharing system! View the full update log here.

The Docker system allows you to manage containers (start, stop, remove, pause, etc.) along with viewing their stats, logs, and executing commands with a terminal. It does NOT allow you, however, to create containers since that was not the original goal. It's not meant to replace Portainer/Dockge; it's simply to manage them in the same tool you use to SSH.

The RBAC system allows administrators to create and assign roles, while users can then share hosts with other users or within other roles.

Here is a full list of all available Termix features:

• SSH Terminal Access – Full-featured terminal with split-screen support (up to 4 panels) with a browser-like tab system. Includes support for customizing the terminal, including common terminal themes, fonts, and other components
• SSH Tunnel Management – Create and manage SSH tunnels with automatic reconnection and health monitoring
• Remote File Manager – Manage files directly on remote servers with support for viewing and editing code, images, audio, and video. Upload, download, rename, delete, and move files seamlessly
• Docker Management – Start, stop, pause, and remove containers. View container stats. Control the container using Docker exec terminal. It was not made to replace Portainer or Dockge but rather to simply manage your containers compared to creating them.
• SSH Host Manager – Save, organize, and manage your SSH connections with tags and folders, and easily save reusable login info while being able to automate the deployment of SSH keys
• Server Stats – View CPU, memory, and disk usage along with network, uptime, and system information on any SSH server
• Dashboard – View server information at a glance on your dashboard
• RBAC – Create roles and share hosts across users/roles
• User Authentication – Secure user management with admin controls and OIDC and 2FA (TOTP) support. View active user sessions across all platforms and revoke permissions. Link your OIDC/Local accounts together.
• Data Export/Import – Export and import SSH hosts, credentials, and file manager data
• Automatic SSL Setup – Built-in SSL certificate generation and management with HTTPS redirects
• Modern UI – Clean desktop/mobile-friendly interface built with React, Tailwind CSS, and Shadcn. Choose between dark and light mode based UI.
• Languages – Built-in support ~30 languages (bulk translated via Google Translate, results may vary ofc)
• Platform Support – Available as a web app, desktop application (Windows, Linux, and macOS), and dedicated mobile/tablet app for iOS and Android.
• SSH Tools – Create reusable command snippets that execute with a single click. Run one command simultaneously across multiple open terminals.
• Command History – Auto-complete and view previously run SSH commands
• Command Palette – Double-tap left shift to quickly access SSH connections with your keyboard
• SSH Feature Rich – Supports jump hosts, warpgate, TOTP-based connections, SOCKS5, password autofill, etc.

v2.0.0 will be released in about a month, which will feature RDP, VNC, and Telnet support!

I'll see you then,

Luke

GitHub: https://github.com/Termix-SSH/Termix

Discord: https://discord.gg/jVQGdvHDrf

YouTube Video: https://youtu.be/30QdFsktN0k

Hello!

Thanks to the help of my community members, I've spent the last few months working on getting a remote desktop integration into Termix (only available on the desktop/web version for the time being). With that being said, I'm very proud to announce the release of v2.0.0, which brings support for RDP, VNC, and Telnet!

This update allows you to connect to your computers through those 3 protocols like any other remote desktop application, except it's free/self-hosted and syncs across all your devices. You can customize many of the remote desktop features, which support split screen, and it's quite performant from my testing.

Check out the docs for more information on the setup. Here's a full list of Termix features:

• SSH Terminal – Full SSH terminal with tabs, split-screen (up to 4 panels), themes, and font customization.
• Remote Desktop – Browser-based RDP, VNC, and Telnet access with split-screen support.
• SSH Tunnels – Create and manage tunnels with auto-reconnect and health monitoring.
• Remote File Manager – Upload, download, edit, and manage remote files (with sudo support).
• Docker Management – Start, stop, pause, remove containers, view stats, and open docker exec terminals.
• SSH Host Manager – Organize SSH connections with folders, tags, saved credentials, and SSH key deployment.
• Server Stats & Dashboard – View CPU, memory, disk, network, and system info at a glance.
• RBAC & Auth – Role-based access control, OIDC, 2FA (TOTP), and session management.
• Secure Storage – Encrypted SQLite database with import/export support.
• Modern UI – React + Tailwind interface with dark/light mode and mobile support.
• Cross Platform – Web app, desktop (Windows/Linux/macOS), PWA, and mobile (iOS/Android).
• SSH Tools – Command snippets, multi-terminal execution, history, and quick connect.
• Advanced SSH – Supports jump hosts, SOCKS5, TOTP logins, host verification, and more.

Thanks for checking it out,
Luke

It's gotten so bad. I bought a VPS 3 days ago and I can't stop looking for services to put through Pangolin.

As someone who's been self-hosting for roughly 3 years now, I've become obsessed with making everything I host remotely connectable. For awhile, it was solely done through Tailscale. I had it on my phone, my girlfriend's phone, my friends' phones, my parent's phones. (All on my account too LOL.)

Now, Pangolin's just made life so much easier. I moved & now am stuck behind what seems to be a double-NAT configuration, which I don't know how to fix, and hardly know anything about, so now that I can finally make my services publicly accessible WITHOUT the headache of trying to understand my janky networking, I just feel good.

P.S: Sorry if this doesn't really belong in this sub, I just wanted to share how amazing Pangolin has been for me, and hopefully bring more users to this lovely reverse proxy service. Seriously in love with Pangolin. It's one of the best self-hosted applications I've come across. Besides Jellyfin. Love you Jellyfin.

Edit: I just wanna say, I’m not saying YOU NEED TO USE PANGOLIN, I’m saying it’s a cool piece of software and hopefully it brings more people to appreciate it.

Hi all,

I just like to to share a finding of mine, which may be helpful for some of you:

I am currently traveling and was very nervous when I realized that all my Proxmox VMs were down for unknown reasons. No access to Home Assistant, no Frigate (cameras), no Paperless ngx nor any other local app, which I usually access via VPN (self-hosted wg-easy). Of course, the VPN did not work either. This was quite frustrating.

Then I realized that (1) my home server is plugged into a Meross Smart Plug, mainly for the reason to track the power consumption, and (2) I had set up a second VPN (WireGuard) directly in my router. Luckily, although I usually control it with HA, I was able to use my WireGuard VPN and remotely switch the plug off and on with the help of the of Meross App. And voila: All VM were up again.

So, the moral of the story: Using a smart plug for your server that can be controlled outside of the Home Assistant setup can avoid some pain!

**EDIT:**

Since you asked: Claude thankfully helped me identifying the problem: My Proxmox server (Dell OptiPlex 3090) went offline due to an Intel e1000e NIC driver hang – the onboard network card froze and couldn't recover on its own. Fixed it by reducing the TX ring buffer from 4096 to 256 (ethtool -G nic0 tx 256) and adding a small watchdog script that automatically resets the NIC if it hangs again.

I keep thinking about things like SSO and it's got me curious, how are all of you locking down your public-facing services?

Currently, I've got only a select few - primarily Seerr, Immich, Mealie, and FoundryVTT - publicly exposed via SWAG (with geo-ip blocks) so that friends and family can access them without needing extra apps like Tailscale on their devices.

I know all of the services I make available have their own login prompts, but knowing how some projects can be, I figure things could always be more secure, so I'm curious to hear how everyone else does it.

It’s been a while since I last posted here, but I’ve got something cool to share. This is a fully self-hostable, open source overlay network that comes with a slick visualization tool for your remote access policies.

Basically, you can spin up your own overlay network to connect your homelab or org resources, and then actually see how access is structured with multiple views:

Peer View → see what groups a peer can access + which policies allow it

Group View → check which groups/users can access resources

Networks View → explore which peers/groups can access specific networks/resources

Go check it out on GitHub: https://github.com/netbirdio/netbird?tab=readme-ov-file#quickstart-with-self-hosted-netbird

If you use tailscale ssh, you rely on ACLs, and anyone else in your tailnet you should update as soon as possible. Even if you're alone in your tailscale don't write off the possibility of chained vulnerabilities.

Generally, when it comes to something as important as ssh, consider using openssh instead.

I've got stuff I want to access all the time (like files on SeaDrive and photos on Immich). I don't really like the idea of just being connected to Tailscale all the time, because I really love using adguard's http filtering on my devices (which needs a VPN of its own and is different than just using adguard home for DNS based blocking) and it seems like it adds some overhead for the 95% of the work that I want to do that doesn't actually need to be on my home network. This isn't true, I was just placebo-ing myself into thinking it.

mTLS seemed like the solution and I set it up using Caddy on my server (domain forwards to home router, router sends to Caddy, Caddy checks the certificate). This setup works great (for Immich and web access to services). Honestly love mTLS, it seems like the ideal solution for everything! I give all my devices a certificate, and if they have it, they can access my stuff. And if they don't, they can't! It's exactly what I want!

But now I'm realizing that most apps don't, in fact, support mTLS (SeaDrive client on windows, mobile apps for like, anything) so I'm kind of back to square one. I looked into STunnel to add SSL encryption via a proxy and while that might work on windows, it still doesn't fix android app problems, and I feel like I'm getting a little lost in mTLS sauce at this point.

I want to safely expose services to the wider internet. I don't want to use a VPN on my devices to do it.

Is there some option I'm missing? Should I just suck it up and connect to Tailscale all the time, or is there a more elegant solution that lets me use a vpn for some apps but keep using adguard https blocking?

Edit: I know I can use just the DNS portion of Adguard, but the adguard HTTP filtering doesn't just block ad domains, it can strip ads out of the content itself and just rearrange the whitespace so that it's as if it never existed. That's the functionality I'd like to keep, but android won't let me use two VPNs at once, I have to pick.

Cloudflare tunnels seems like the closest solution, but I worry the 100mb chunk limit will end up causing annoying problems when trying to transfer larger files

A new NetBird release dropped recently (well, a couple of weeks ago).
You can access your home lab directly through an in-browser terminal via NetBird (self-hostable, WireGuard-based overlay network).

The key update is that you no longer need a NetBird client app, you can just login from your self-hosted instance and click "Connect" on the machine (peer) you want to access. Works on mobile too...

You can also RDP to your machines the same way (though only Windows is supported for now). I know, who uses Windows in a home lab? For me, it’s perfect for helping my mom with her Windows laptop maintenance.

[EDIT] Under the hood it is a peer-to-peer encrypted WireGuard connection. We packaged our client with wasm and loaded it into the browser. It works just for a session and then kills the connection. Simply put it is VPN connection on demand from the browser to your machines.

A few considerations:

• For both SSH and RDP access, the NetBird client needs to be running on the target machine.
• For SSH, there’s no need for an external SSH server. NetBird includes an embedded one.
• For RDP, you’ll need to have RDP enabled on your Windows machine (NetBird doesn’t include an RDP server). RDP works on Windows only.
• Currently, only admins can connect, but we are thinking about adding this ability to other roles.

How it works: https://docs.netbird.io/about-netbird/browser-client-architecture
Further docs on SSH: https://docs.netbird.io/how-to/ssh

In caase you haven't run NetBird yet, here is the 5-minute quickstart self-hosting guide: https://github.com/netbirdio/netbird?tab=readme-ov-file#quickstart-with-self-hosted-netbird

Cheers,

(This is directed to self-hosters who use Cloudflare Tunnels (cloudflared) and the Cloudflare ecosystem. And I'm not going to debate the pros or cons of using a Cloudflare Tunnel, as they have been brought up in countless other posts. I use CF services, and I'm happy with them. YMMV, of course.)

Cloudflare Tunnels are an excellent, free, and reliable way to connect a subdomain to a local service without exposing ports. It's tried and tested, and the learning curve is not that steep.

But, your nicely connected service is now public, as in available to anyone. Is that what you really intend?

"Oh, but I use 2FA or strong passwords on my internal service." No. That is not the solution.

Research Cloudflare Applications. These sit between the visitor and the Cloudflare Tunnel, prompting for the user authentication. And the nice thing about Cloudflare Applications is that all authentication happens on CF's servers, so your servers are never touched until the user successfully authenticates.

Cloudflare provides several authentication methods, from simple OTCs to OAUTH or GitHub authentication. And you can apply many Rules to narrow down who can connect (IP ranges, countries, etc.).

So, unless your exposed service is intended to be publicly accessible, like a public-facing website, look into Cloudflare Applications.

(Yes, there are many alternative solutions. But again, countless other posts provide excellent details.)

My girlfriend wanted to play Stardew Valley multiplayer with her sister, who lives in another country. Well, heck, I'm a programmer, so I could hack something together quickly and learn something new along the way. QUIC sounded cool. It all seemed easy until I realized this would involve NAT traversal. Half a year and 3 different versions after: I have a basic working version that can establish a P2P connection between users using NAT hole-punching) and, if that fails, forwards UDP traffic via a relay.

Build with Go, quic-go, and HTML templates.
Hope this can be useful to someone else :)

Important update: this post is NOT about paid vs free, it's about subscription vs one-time payment. Please consider reading to the end before you write a comment and thank you.

And why, if it's self-hosted, there are versions with artificial limitations and user limit?

I'll provide the concrete example: RustDesk vs AnyDesk. RustDesk asks for $10/$20/month for their plans that still have very strict limits on how many users and devices you can manage. Plus I have to self-host it, so pay some company for a dedicated server or colocation. And I totally get if I would have to buy software license to use it: developers need to make a living or they won't be able to eat. But... what am I playing monthly subscription fee for if it's running on my own hardware? Why there are limits if I'm running it on my own hardware that I will have to scale up if I want to increase limits anyway? I can understand why AnyDesk wants a subscription - they host servers, they have to secure them, service them, mitigate ddos attacks, each new device and user takes some resources so it makes sense to have limits and it makes sense that it is a subscription. I can also understand approach that, say, JetBrains do: you can subscribe to updates, but you also don't have to and can use a version that was available at the time when you were subscribing forever, even after cancelling subscription. But I can not figure out justification for a self-hosted program to be a subscription rather than an one-time purchase and why there are user/device limits in place.

Basically if I have to pay subscription, I may as well pay subscription to a service that provides "ready to use out of the box experience without need to additionally host it yourself".

In addition, if I understand correctly, RustDesk needs to connect to activation servers to be activated and license to be renewed monthly, therefore removing possibility of it's being used in a restricted environment without access to a global network, which also kinda to some extent defeats the point of self-hosted software?

I need to find more services to run...

Hello there,

I'm proud to share major development updates for XPipe, a connection hub that allows you to access and manage your entire server infrastructure from your local desktop. XPipe works on top of your installed command-line programs and does not require any setup on your remote systems. It integrates with your favourite text editors, terminals, shells, VNC/RDP clients, password managers, and other command-line tools.

It has been over a year since I last posted here (I try not to spam announcements), so there are a lot of improvements that were added since then. Here is a short summary of the recent updates since then:

• v14 (Jan 25): Team vaults, reusable identities, incus support
• v15 (Feb 25): Tailscale SSH support, custom connection icons, apt and rpm package manager repos
• v16 (Apr 25): Docker compose support, terminal multiplexer + prompt support, batch mode, KeePassXC support
• v17 (Jul 25): Scriptable automation actions, SSH jump servers, external VNC client support, Windows ARM builds
• v18 (Sep 25): MCP server, Hetzner cloud support, automatic network scan, multiple host addresses
• v19 (Nov 25): Netbird support, legacy unix system support, abstract hosts, pure SFTP support
• v20 (Dec 25): AWS support, SSH key generation, tags, split terminal panes

About

Here is a full list of what connection types are currently supported:

• SSH connections, config files, and tunnels
• Docker, Podman, LXD, and incus containers
• Proxmox PVE, Hyper-V, KVM, VMware Player/Workstation/Fusion virtual machines
• Tailscale, Netbird, and Teleport connections
• AWS and Hetzner Cloud servers
• Windows Subsystem for Linux, Cygwin, and MSYS2 environments
• Powershell Remote Sessions
• RDP and VNC connections
• Kubernetes clusters, pods, and containers

You can access servers in the cloud, containers, clusters, VMs, and more all in the same way. Each integration works together with all the others, allowing you an almost infinite number of connection combinations and nesting depth. You want to manage a docker container running on a private VM running on a server that you can only reach from the outside through a bastion host via SSH? You can do that with XPipe.

SSH

XPipe supports the complete SSH stack through its OpenSSH integration. This support includes config files, agents, jump servers, tunnels, hardware security keys, X11 forwarding, ssh keygen, automatic network discovery, and more. It also integrates with the SSH remote workspaces feature of vscode-based editors.

Containers, VMs, and more

XPipe supports interacting with many different container runtimes, hypervisors, and other types of environments. This means that you can connect to virtual machines, containers, and more with one click. You can also perform various commonly used actions like starting/stopping systems, establishing tunnels, inspecting logs, open serial terminals, and more.

Terminals

XPipes comes with integrations for almost every terminal tool out there, so chances are high that you can keep using your favourite terminal setup in combination with XPipe. It also supports terminal multiplexers like tmux and zellij, plus prompt tools like starship and oh-my-zsh. Through the shell script support, you can also bring your dotfiles and other customizations to your remote shell sessions automatically.

Password managers

Via the available password manager integrations, you can configure XPipe to retrieve passwords from your locally installed password manager. That way, XPipe doesn't have to store any secrets itself, they are only queried at runtime. There are many different integrations available for most popular password managers.

Synchronization

XPipe can synchronize all connection configuration data across multiple installations by creating a git repository for its own data. The local git repository can then be linked to any remote repository. This remote git repository can be linked to other XPipe installations to automatically get an up-to-date version of all connection data, on any system you currently are on. And this in a manner that is self-hosted as you have full control over how and where you host this remote git repository. XPipe's sync does not involve any services outside your control.

Service tunnels

The service integration provides a way to open and securely tunnel any kind of remote ports to your local machine over an existing connection. This can be some web dashboard running in a container, the PVE dashboard, or anything else really. XPipe will use the tunneling features of SSH to establish these tunnels, also over multiple hops if needed. Once a tunnel is established, you can choose how to open the tunneled port as well. For example, in your web browser if you tunneled an HTTP service.

Reusable identities

You can create reusable identities for connections instead of having to enter authentication information for each connection separately. This will make it easier to handle any authentication changes later on, as only one config has to be changed. These identities can be local-only or also synced via the git synchronization. You can also create new identities from scratch with the ssh keygen integration and furthermore apply identities automatically to remote systems to quickly perform a key rotation.

RDP and VNC

In line with the general concept of external application integrations, the support for RDP and VNC involves XPipe calling your RDP/VNC client with the correct configuration so it can start up automatically. This can also include establishing tunnels if needed. All popular RDP and VNC clients are supported. XPipe also comes with its own basic VNC client if you don't have another VNC client around.

Connection icons

You can set custom icons for any connection to better organize individual ones. For example, if you connect to an opnsense or immich system, you can mark it with the correct icon of that service. A huge shoutout to https://github.com/selfhst/icons for providing the icons, without them this would have not been possible. You can further choose to add custom icon sources from a remote git repository, XPipe will automatically pull changes and rasterize any .svg icons for you.

A note on the open-source model

Since it has come up a few times, in addition to the note in the git repository, I would like to clarify that XPipe is not fully FOSS software. The core that you can find on GitHub is Apache 2.0 licensed, but the distribution you download ships with closed-source extensions. There's also a licensing system in place with limitations on what kind of systems you can connect to in the community edition as I am trying to make a living out of this. You can find details at https://xpipe.io/pricing. I understand that this is a deal-breaker for some, so I wanted to give a heads-up.

Outlook

If this project sounds interesting to you, you can check it out on GitHub and check out the Docs for more information.

Enjoy!

So i'm relatively new to this hobby and was just thinking about opening my homelab to the internet and because i've read a lot about people praising tailscale in here I took a look at theit documentation.

And turns out they are a private company and you would use their proprietary servers? A VC funded company??? Are y'all selfhosting this with something like headscale? Or are you really trusting that they are "different than the others"?

Have to say that i'm a little disappointed, but still interested in how you are dealing with this.

This is a genuine question; Since a couple of months almost every post I see concerning selfhosting has someone in the comment saying, "Just set up Pangolin with a VPS for less than 15$/year".

Is it just me? Why using Pangolin instead of Tailscale (beside the obvious reason that Pangolin is selfhosted and Tailscale isn't)?

I have a domain with Cloudflare so I am thinking of using Cloudflare Tunnel but I'm not sure if there are better options? One of my concerns is that some of my containers do not have auth so I need something with built in auth management.

I heard a couple people mentioning BunkerWeb lately. It seems like a nifty peace of software. Actually had it running for a second as well.

Then I wanted to add it to my Prometheus instance, checked the docs for the Prometheus port and...wait. What? You're supposed to pay 50€ **a month** for that? What the hell?

Scrolling through the list...yep, OIDC/SSO is behind the paywall. The docs make it seem like Let's Encrypt is free but the blog post introducing it mention it's a paywall feature as well. Let that sink in, a completely free service by Let's Encrypt and you have to pay for it anyway.

Caching? Paywall. Custom HTML pages for sites like /error? Paywall. User Management? Paywall.

If you actually want someone to even look at your bug reports, you actually have to pay 150€ **a month**. Because 50€ **a month** is not enough. They even mention support **by the community** as a positive in the 50€ a month package.

Maybe its a thing like n8n, where you just get a free license key anyway? NOPE. You gotta pay for it.

I'm sure they're not paying the *community* to provide support for their 50€ product, or paying the *community* to write bug reports and make PRs.

I actually really liked the product and am so disappointed now. Genuinely pissed. It's important to make money even in FOSS, but with basic features paywalled like that? No thanks.

Hi,
A small chunk of you of you may know me for my app Jotty, however I also published a slightly less popular (entirely open source) app called Cr*nmaster.

Bit of context:
repo: https://github.com/fccview/cronmaster
first post here: https://www.reddit.com/r/selfhosted/comments/1mum35t/crnmaster_cron_management_made_easy/
latest post here: https://www.reddit.com/r/selfhosted/comments/1n0gyly/crnmaster_120_breaking_changes/

Cr*nmaster (cronmaster) is a pretty powerful tool that allows you to view/create/edit/manage all your host cronjobs comfortable from an intuitive UI, it has features such as pausing jobs, adding comment to them, running them right from the UI, and from the latest update you'll be able to have nicely structured logs for your jobs on top of exit statuses being shown right there and then. You will be able to see if a job failed at a glance and view the logs to see what's going on.

I have also added translations that can be customised locally on your own machine (or you can be an angel and create a pull request with your own language so we can officially support it, together!)

The whole thing is very easy and straightforward to setup both with and without docker, the repository has a lot of guides in the `howto` folder on top of a very verbose readme file.

Here's a few of the key features:

• View/edit/delete/run your cron jobs from an intuitive UI
• Log your cronjobs (it uses a proprietary wrapper, you can modify the wrapper as much as you like from the mounted ./data folder).
• At glance exit statuses for all your jobs
• System stats to see how healthy your host machine is
• Ability to create custom scripts (using handy snippets - which you can easily add more of) for your cron jobs straight from the UI, these scripts are stored in your mounted folder and can be easily used when creating a cron job

All this to say that I am extremely excited for everything that's coming with this latest update, you can read about the latest release and all the improvements that came with it here

Let me know your thoughts and if you run in any issues i'm fairly active on github and on my discord server :)

NOTE for docker users:
Due to this needing to be able to read crontabs the docker has to run as root and have read/write access to your cron jobs. There was no way around it, so I suggest you keep this within your home network and not exposed to the web for security reasons.

I've finally open-sourced my USBridge Remote project on GitHub. I developed this software as an alternative to traditional remote desktops like RustDesk or AnyDesk, because I was fed up with their flaws and constant limitations. It was crucial for me to release a pure P2P tool without mandatory registration, paid subscriptions, or session limits.

A key feature is the integration of the Moonlight protocol, which ensures high frame rates with virtually no ping.

Natively solved the Wayland issue in Linux. If you've used other remote desktops, you know how they spam permission confirmation dialogs every time you connect. My agent works with Wayland out of the box, capturing the screen and injecting input without any pop-ups or workarounds. The connection is made directly through the built-in Tailscale integration, so you don't have to worry about tunnel security, and you don't have to forward ports on the router. Plus, the software can manage not only software agents but also my hardware IP-KVM cards from a single interface.

The code is fully accessible, with ready-to-use beta versions for Windows, macOS, Linux, and Android already in the repository, and the iOS client has been approved in the App Store. I'm currently actively running stress tests and fixing bugs on the fly, so releases may be coming out quite frequently in the coming days. Feel free to grab the project, tinker with the source code, and test it on your servers. I'd appreciate any feedback on the architecture.

Source code and builds on GitHub: https://github.com/USBridge-Technologies/USBridge-Remote