SELF-HOSTING / PRACTICAL FIELD NOTES
A calm route from one small server to a dependable home stack. Decide what to isolate, what to expose, and how you will restore it before adding the next app.
Informed by a real multi-node Proxmox lab. Private names, addresses, and findings are omitted.
Self-hosting is a chain: power, host, network, storage, identity, and the app. A tidy dashboard cannot compensate for a missing restore path. Build one reliable service, document it, then reuse that pattern.
Answer top to bottom. Follow the branch that matches the failure you can live with.
Use a private VPN or tailnet. Give it the few routes it needs; keep admin pages off the public internet.
WIREGUARD / TAILSCALEPublish only the app route through a proxy or tunnel. Add TLS, MFA where available, and an update owner.
TRAEFIK / CADDY / TUNNELAn unprivileged LXC is light to manage. The host kernel is shared; grant only required mounts and features.
LXC / SYSTEMDUse a VM as the stronger boundary. Put Compose inside for portability; pass through GPUs or devices deliberately.
VM / DOCKER COMPOSELocal storage and snapshots may be enough. Label it disposable and exclude it intentionally.
REBUILDABLEUse a named data volume, back up to another physical system, keep an offline or off-site copy, and prove you can restore it.
VALUABLE / RESTORE FIRSTOne host, good backups, and a written rebuild order can be a sensible design.
KEEP IT SIMPLEAdd failover only after storage, quorum, network, and application recovery are designed and rehearsed.
HA IS A SYSTEMThis reference is drawn from an anonymized, real multi-node Proxmox setup: role-based LXCs, Traefik ingress, Authentik identity, AdGuard Home with Unbound, local storage, and an NFS backup target. Exact inventory stays private.
Owns internet routing, DHCP, and the first allow/deny boundary. Keep its admin interface trusted.
ONE CLEAR OWNERSeparate management, servers, trusted clients, IoT, and guests when gateway, switch, and APs support it.
DEFAULT DENYA cluster can centralize management. It does not create shared storage, backup copies, or automatic recovery by itself.
PATCHED HOSTSTraefik routes app traffic; Authentik provides shared sign-in. Keep hypervisor, DNS, and backup consoles private.
TLS + MFAGive each service an owner and data path. Use VMs when isolation, kernel features, or device passthrough justify it.
LEAST PRIVILEGESeparate app state from replaceable files. Guest backups may skip bind mounts or volumes marked to exclude; read job output.
RESTORE TESTEDAlert on failed jobs, thin-pool headroom, disk health, and certificates. Write the order to rebuild DNS, identity, ingress, then apps.
SOMEONE GETS PAGEDWhat this guide leaves out: exact hostnames, IPs, guest IDs, URLs, ports, and security findings. This is a reusable architecture guide, not a live service map.
These playbooks follow this lab’s shape: Proxmox and an AI node, Move Weight Manager, creative AI tools, Cloudflare DNS, Traefik, and a Hestia hosted site. Private names and addresses are removed. Each guide includes alternatives for different budgets and skills.
Cloudflare serves public DNS. Traefik routes requests. The domain remains yours. The proxy does not replace access control or backups.
Treat each node as hardware first and a cluster member second. Assign services by their needs, give every guest a purpose, and record where its data lives.
Alternatives: Incus for containers and VMs; Debian with libvirt for one flexible host; TrueNAS or Unraid for storage-first setups. Choose what you will patch and restore.
A Proxmox node may also run an MWM agent. Those are two observations of one computer, not two computers. Link duplicate sources by stable identity and hardware details before totaling resources.
Keep credentials and API keys in a secret store. Never put tokens in screenshots, docs, shell history, or a public page.
Decide whether you need a local inference endpoint, a creative workstation, or a GPU shared by both. A separate AI host can avoid coupling model drivers to the hypervisor.
Ollama is a straightforward local runner. llama.cpp supports quantized models and varied hardware. vLLM may suit serving workloads; LM Studio offers a desktop workflow. Hosted APIs reduce local maintenance but send requests off-site and may cost per use.
Hybrid routing is practical: keep sensitive work local and use a hosted service for models your hardware cannot run well.
ComfyUI is a node-based interface for generative workflows. Separate the application, models, custom nodes, workflow files, and output library so upgrades do not erase work.
Use ComfyUI on the workstation, LAN, or VPN. Add authentication if trusted people need access. Keep the raw UI and API off public DNS; a reverse proxy alone is not authentication.
Alternatives: Forgeverse can provide a creative catalog and AI connections; desktop tools suit a single workstation; hosted generation fits occasional jobs or oversized models.
Forgeverse brings creative apps and AI providers into one workspace. Catalog and integrations evolve, so check the current site for available tools and providers instead of assuming every item runs locally.
Local providers offer control but use your hardware, power, storage, and maintenance time. Hosted providers ease setup and may offer larger models; review data handling and pricing.
Forgeverse includes a broad creative app catalog, AI-provider connections, local runtimes, MCP integrations, and media-service connections; the exact catalog changes over time. It currently advertises more than 40 creative apps and 60+ AI providers across photo, vector, layout, film, audio, 3D, characters, documents, and CAD.
Local Bridge calls go from the browser to your local service without passing through Forgeverse. The Bridge is a small Python script; keep it and the connected AI endpoint on your workstation, LAN, or VPN. It is not a public reverse proxy. Signed-in provider keys are stored by Forgeverse using account-scoped encryption; review current connection and privacy documentation before saving a key.
Use Forgeverse’s current docs for account, Bridge, provider, and project behavior. Never put account keys in a public guide or shared workflow.
Edit project files in a multi-tab code editor; search, compare diffs, and apply reviewed changes.
Visually edit HTML with blocks and a style panel. CSS changes use an override file so original stylesheets remain intact. Framework components stay code-edited.
Inspect responsive sizes, capture a preview, and refresh after saved changes. The current preview serves static files; it does not run npm/Vite builds or framework HMR.
Review status, file diffs, history, branches, and commits. Ask the connected AI about selected project context, then inspect the proposed diff before applying it.
Practical flow: make a project copy → edit → preview common screen sizes → review the diff → commit → deploy through your usual host. Treat the preview as a design check, not proof that a production build succeeds.
Mesh2Motion supports browser-based motion generation and downloadable assets. Input formats, exports, and offline builds can change; check its current release documentation.
Use it for rapid motion exploration, then clean and retarget in Blender or a dedicated animation tool. For mature rigging pipelines, compare established DCC tools before changing production formats.
Check current license, data handling, supported formats, and local versus hosted processing before using client or commercial assets.
The registrar, Cloudflare DNS zone, Traefik edge, and Hestia web account have separate jobs. Record who owns each one and keep management interfaces private.
Port forward: send inbound web traffic to Traefik and keep other ports closed. Cloudflare Tunnel: an outbound connector avoids inbound origin ports but depends on Cloudflare. VPS relay: useful when an ISP blocks inbound traffic, with another server to maintain.
DNS/proxy is not identity. Add app authentication where needed. Keep Proxmox, router, DNS, backup, and raw AI consoles off public routes. Use Hestia’s documented panel workflow instead of editing generated config it may overwrite.
# Pattern only; replace hostname and backend
http:
routers:
example-site:
rule: "Host(`example.com`)"
entryPoints: [websecure]
service: example-site
tls:
certResolver: cloudflare
services:
example-site:
loadBalancer:
servers:
- url: "http://SITE_BACKEND:PORT"A media server indexes and plays your library. Keep media files, metadata/database, and app configuration in known locations so reinstalling does not mean rebuilding everything.
Prefer wired networking for the server and access point. Test real bitrate and client codec support before buying hardware. Transcoding needs decode/encode capability and sustained headroom.
Remote playback also depends on upload speed and the client network. Use media you own or are licensed to access.
The host captures a game, encodes frames, and sends them to a client. A wired local network and working encoder usually matter more than a public web proxy.
Steam Remote Play suits Steam libraries. Parsec can fit remote desktop and collaboration. Console-native remote play is simplest for console games. Compare latency, clients, privacy, and account needs.
Cloud gaming removes the home host but depends on a provider catalog, subscription, and internet route. Traefik is not the game-stream transport.
A guest snapshot is useful for rollback. A backup is an independent copy that can survive failure of its source. Keep app state and reconnection steps.
Keep an offline copy of the order, network layout, and restore contacts. Do not put live passwords or tokens in it.
“Seen here” anchors this guide in a working setup. Alternatives fit different budgets, skills, and failure targets.
| Layer | Seen here | Alternatives | Choose when |
|---|---|---|---|
| Host | Proxmox VE Multi-node LXC and VM mgmt | Incus; TrueNAS SCALE; Unraid; Debian + libvirt | Choose the UI and recovery model you will maintain. One host is a fine start. |
| Workload | Role-based LXCs Some nested app stacks | Compose in a VM; Podman; systemd; full VMs | LXC for trusted Linux services and density; VM for stronger kernel boundary or hardware. |
| Ingress | Traefik | Caddy; Nginx Proxy Manager; Cloudflare Tunnel; VPS relay | Caddy favors compact config and automatic HTTPS. A tunnel avoids inbound origin ports but adds a provider dependency. |
| Identity | Authentik | Authelia; existing identity provider; app-native MFA | Use single sign-on where supported. Keep a tested local recovery account. |
| DNS | AdGuard Home + Unbound | Pi-hole + Unbound; Technitium; router DNS | Put two resolvers on different failure domains. Same host or circuit is partial redundancy. |
| Storage | LVM-thin, mounted data, NFS | ZFS mirrors; NAS shares; object storage for off-site | Snapshots help roll back; they do not replace an independent backup. |
| Backup | Scheduled vzdump to NFS | Proxmox Backup Server; restic or Borg off-host | Keep one copy outside the source host. Encrypt off-site data and test restores. |
| Local AI | Dedicated AI host + local tools Private LAN/VPN | Ollama; llama.cpp; LM Studio; vLLM; hosted APIs | Local control costs hardware and maintenance; hosted models trade data control for less local setup. |
| Creative AI | ComfyUI + Forgeverse Workflows and creative front door | Blender; Krita; desktop AI apps; hosted suites | Use formats your next editor can reopen. Keep project sources beside exports. |
| Motion | Mesh2Motion Motion exploration | Blender; Mixamo; Cascadeur; other DCC tools | Check formats and licensing; validate exports in the consuming tool. |
| Media | Self-hosted media server LAN-first playback | Jellyfin; Plex; Emby; NAS apps | Match clients and codecs; direct play is simpler. Back up metadata and config. |
| Game streaming | Home gaming host Private network path | Sunshine + Moonlight; Steam Remote Play; Parsec; console remote play | Tune local latency and encoder first. Prefer VPN for remote access. |
| Public website | Cloudflare + Traefik + Hestia Domain you control | Caddy; Nginx Proxy Manager; tunnel; VPS; static hosting | Scope DNS tokens, publish app routes only, and keep an off-host copy. |
| Monitoring | Proxmox task views | Uptime Kuma; Prometheus + Grafana; hosted alerts | Start with failed backup, low space, unreachable DNS, and expiring certificate. |
Do these in order. Save each answer somewhere outside the server being configured.
Label hosts, disks, switch ports, gateway, UPS, and recovery access. Record management addressing.
Use DHCP reservations for infrastructure and local home.arpa names. Document the resolver path.
Include guest disks, databases, bind mounts, media, secrets, and config as needed. Verify a restore.
Keep admin devices and management UIs private. Isolate IoT and guests with narrow rules where possible.
Use one proxy or tunnel. Add TLS, MFA, and an update owner; never publish the hypervisor console.
Record known-good config, restore steps, and local host access if DNS, proxy, or identity is down.
Operations are part of design. A system is not recoverable until someone follows its recovery steps.
Check jobs, disk alerts, failed logins, certificates, and service health. Confirm alerts reach a real inbox.
Restore a guest or file to a temporary target. Check data and startup; record time and missing steps.
Read release notes, check headroom, verify backups, update one layer, and keep rollback before the next.
Record what moved, the data it owns, what can reach it, how it is backed up, and who gets alerts.
Versions and defaults change. Check upstream documentation before copying configuration into a live system.