Self-Hosted

Run five self-hosted apps and you’ve got five separate logins, five separate password resets, and five separate places an old account can quietly stay active after you meant to lock someone out. Once you cross that threshold, a single sign-on layer stops being a nice-to-have and starts being the thing that keeps your homelab’s security model from turning into a pile of unrelated logins nobody’s actually tracking. Here’s what an SSO layer buys you, and how the two most common self-hosted options actually differ. ...

The first time most people find out a self-hosted service is down is when someone tries to use it and it isn’t there. That’s the wrong order. If you’re running more than two or three services at home - Immich, a media server, a reverse proxy, whatever - you’ve already got enough surface area for something to quietly die on a Tuesday and stay dead until you notice by accident. ...

Every self-hosted setup eventually hits the same wall: you’ve got four, six, ten services running on different ports, and typing http://10.0.0.50:8096 from memory has stopped being funny. A reverse proxy fixes that - one entry point, real hostnames, automatic TLS certificates, and a single place to manage access instead of juggling port numbers. The question isn’t whether you need one. It’s which one. There are more options than these three, but Nginx Proxy Manager, Traefik, and Caddy cover the vast majority of homelab setups for good reason - they’re mature, well documented, and each represents a genuinely different philosophy about how a reverse proxy should work. Picking the wrong one isn’t fatal, but re-migrating a dozen services to a different proxy after the fact is a weekend you don’t get back. ...

Updated Aug 12, 2026: added resource requirements, honorable mentions, and an expanded trade-off section. Every “self-host your subscriptions away” list makes it sound like flipping a switch. It’s not quite that simple, but for these five, the trade is genuinely worth it - the software is mature, the setup is reasonable, and you’re not sacrificing much beyond someone else being on call at 3am. 1. Immich → replaces Google Photos / iCloud Photos Immich has closed the gap with commercial photo backup faster than almost anything else in the self-hosted space. Automatic mobile backup, facial recognition, timeline view, shared albums - it’s there. The real cost isn’t the software, it’s the storage: budget for real redundancy (see: data hoarding pillar) since you’re now responsible for not losing your own photos. ...