The pitch for self-hosting has never been stronger, and the walls around it have never been lower. LastPass is still paying down the reputational debt of its 2022 vault breach. Plex reset passwords for users in September 2025 after an unauthorized third party accessed a database of emails, usernames, and hashed credentials. Google, Apple, and Dropbox keep raising storage prices while training increasingly capable models on whatever they can legally touch. Meanwhile, an Intel N100 mini PC idles at 7 watts, Proxmox and Docker Compose have standardized deployment, and CLI coding agents can spin up a hardened Vaultwarden instance behind a Caddy reverse proxy faster than most people can read the documentation.
None of that makes self-hosting your entire digital life a good idea by default. The honest answer — the one you rarely get from homelab YouTube — is that replacing Google Photos, Gmail, Dropbox, 1Password, and your streaming subscriptions with services you operate yourself is a permanent part-time job unless you scope it carefully. This guide lays out what actually works in 2026, which platforms and configs to use, and where the security landmines are.
What “Self-Hosting Your Entire Digital Life” Actually Means
The full-stack dream is familiar: Immich for photos, Nextcloud or Syncthing for files, Vaultwarden for passwords, Jellyfin for media, Home Assistant for smart home, Ollama with Open WebUI for local AI, Paperless-ngx for documents, Actual Budget for finances, Readeck or Wallabag for read-later, AdGuard Home or Pi-hole for network-wide ad blocking, and maybe Matrix (Synapse, Dendrite, or Conduwuit) for chat.
The category people keep underestimating is email. Inbound delivery is easy. Outbound is the problem — Microsoft, Google, and Proton collectively make it nearly impossible for a residential IP or a fresh VPS to land in anyone’s inbox without months of warming, perfect SPF/DKIM/DMARC alignment, and even then you’ll fight spam folders forever. Nearly every experienced self-hoster who tried email has given up on it and runs Mailcow or Stalwart only for internal forwarding, or sticks with Fastmail or Proton. Accept this up front.
Everything else is more tractable than it was two years ago.
The 2026 Hardware Floor
The baseline has dropped to almost nothing. A used Lenovo ThinkCentre Tiny or Dell OptiPlex Micro with an i5 and 16GB of DDR4 runs about $120 on eBay, idles under 15 watts, and will happily run Immich, Vaultwarden, Jellyfin, and Home Assistant in parallel. New Intel N100 and N150 mini PCs from Beelink, GMKtec, or similar sit in the $140–$200 range and include hardware transcoding for Jellyfin via Intel Quick Sync.
The real decision isn’t CPU — it’s storage. Immich plus a decade of raw photos, plus a Jellyfin media library, plus backups of every laptop in the house, adds up fast. A single 1TB NVMe in a mini PC works for most people. Serious libraries want a dedicated NAS: TrueNAS SCALE if you want ZFS and enterprise-style discipline, Unraid if you want to mix drive sizes and add disks over time without rebuilding the array. Skip SD cards and low-end USB drives for anything you care about, regardless of what Raspberry Pi guides told you in 2019.
Skip the Raspberry Pi for full-stack self-hosting. A Pi 5 with a proper NVMe HAT is capable, but the total cost lands close to an x86 mini PC that outperforms it on every axis.
Choosing Your Platform: Proxmox, Docker, or Both
This is where most guides oversimplify. In 2026 there are three mainstream approaches, and picking the wrong one costs you weeks.
Approach 1: Bare-metal Debian + Docker Compose
The simplest stack. Debian 12 or Ubuntu Server 24.04 LTS as the host, Docker Engine and Docker Compose v2 on top, every service as a container defined in a docker-compose.yml. One host, one config, no hypervisor overhead.
Best for: a single mini PC, a first self-hosting attempt, anyone who values simplicity over isolation.
Approach 2: Proxmox VE + LXC + Docker
Proxmox VE 8.3 is a free, Debian-based hypervisor that gives you a web UI for managing VMs and LXC containers. The typical pattern: install Proxmox on bare metal, create one Debian LXC or VM for your Docker stack, create separate VMs for Home Assistant OS and TrueNAS SCALE, and optionally a Windows VM for desktop overflow.
This is the sweet spot for serious self-hosters. Proxmox lets you snapshot a VM before updates, roll back when something breaks, pass through a GPU to a specific VM for Jellyfin transcoding or Ollama inference, and back up everything at the VM level with Proxmox Backup Server. The community-maintained tteck helper scripts (now maintained at community-scripts/ProxmoxVE after tteck’s passing in late 2024) let you deploy a Vaultwarden LXC, a Nextcloud LXC, or an AdGuard Home LXC in a single command.
Best for: anyone running more than five services, anyone who wants Home Assistant OS (which really wants its own VM), anyone planning to add a GPU later.
Approach 3: All-in-one appliances
CasaOS, Umbrel, HomeDock OS, and Start9 StartOS wrap Docker in a polished app-store UI. You get one-click installs for the major services. The trade-off is a thinner abstraction — when something breaks you’re debugging both the app and the wrapper.
Best for: non-technical users who want the experience without the terminal.
My recommendation for a serious 2026 build: Proxmox VE on bare metal, one Debian 12 VM running Docker Compose for most services, Home Assistant OS as its own VM, and TrueNAS SCALE as a storage VM if you have more than four drives. Everything else lives in the Docker VM.
A Working Stack, End to End
Here’s a practical, reviewed stack that fits on a single 16GB ThinkCentre or N100 mini PC. Every component is battle-tested as of April 2026.
Reverse proxy: Caddy. Automatic Let’s Encrypt, two-line config, handles HTTP/3. Nginx Proxy Manager if you prefer a GUI.
Identity layer: Authelia or Authentik in front of apps that don’t natively support MFA.
Secrets: SOPS with age keys, checked into git. Never plaintext .env files in a repo.
Reverse proxy config — a working Caddyfile for the core stack looks like this:
{
email [email protected]
}
vault.example.com {
reverse_proxy vaultwarden:80
encode zstd gzip
header Strict-Transport-Security "max-age=31536000"
}
photos.example.com {
reverse_proxy immich-server:2283
request_body {
max_size 50000MB
}
}
cloud.example.com {
reverse_proxy nextcloud:80
}
media.example.com {
reverse_proxy jellyfin:8096
}
home.example.com {
reverse_proxy 192.168.1.50:8123
}The corresponding docker-compose.yml for the core services (Vaultwarden, Immich, and Caddy) — edited for clarity, not production-ready until you review secrets and volumes:
services:
caddy:
image: caddy:2-alpine
restart: unless-stopped
ports:
- "80:80"
- "443:443"
volumes:
- ./Caddyfile:/etc/caddy/Caddyfile:ro
- caddy_data:/data
- caddy_config:/config
vaultwarden:
image: vaultwarden/server:latest
restart: unless-stopped
environment:
DOMAIN: "https://vault.example.com"
SIGNUPS_ALLOWED: "false"
ADMIN_TOKEN: "${VW_ADMIN_TOKEN}"
LOG_FILE: "/data/vaultwarden.log"
volumes:
- ./vaultwarden:/data
immich-server:
image: ghcr.io/immich-app/immich-server:release
restart: unless-stopped
environment:
DB_HOSTNAME: immich-db
DB_USERNAME: immich
DB_PASSWORD: "${IMMICH_DB_PASS}"
DB_DATABASE_NAME: immich
REDIS_HOSTNAME: immich-redis
volumes:
- /mnt/photos:/usr/src/app/upload
depends_on:
- immich-db
- immich-redis
immich-redis:
image: redis:7-alpine
restart: unless-stopped
immich-db:
image: tensorchord/pgvecto-rs:pg15-v0.2.1
restart: unless-stopped
environment:
POSTGRES_PASSWORD: "${IMMICH_DB_PASS}"
POSTGRES_USER: immich
POSTGRES_DB: immich
volumes:
- ./immich-db:/var/lib/postgresql/data
volumes:
caddy_data:
caddy_config:Add Jellyfin, Home Assistant, and AdGuard Home on the same network. For Jellyfin with Intel Quick Sync transcoding, add a devices stanza:
jellyfin:
image: jellyfin/jellyfin:latest
restart: unless-stopped
devices:
- /dev/dri:/dev/dri
volumes:
- ./jellyfin/config:/config
- ./jellyfin/cache:/cache
- /mnt/media:/media:ro
environment:
JELLYFIN_PublishedServerUrl: "https://media.example.com"Exposure: The Decision That Determines Everything
How you make services reachable from outside your LAN is the single most important security decision in any self-hosted setup. Every other control is downstream.
Practical WireGuard setup in 2026: install wg-easy (one container, clean web UI for generating peer configs and QR codes) or use Tailscale for a managed mesh. The wg-easy compose is:
wg-easy:
image: ghcr.io/wg-easy/wg-easy:latest
restart: unless-stopped
cap_add:
- NET_ADMIN
- SYS_MODULE
sysctls:
- net.ipv4.ip_forward=1
- net.ipv4.conf.all.src_valid_mark=1
ports:
- "51820:51820/udp"
- "51821:51821/tcp"
environment:
WG_HOST: "vpn.example.com"
PASSWORD_HASH: "${WG_ADMIN_HASH}"
volumes:
- ./wg-easy:/etc/wireguardForward UDP 51820 on your router. That’s the only port you need open for the entire stack if everything else lives behind the VPN.
The Threat Model Self-Hosters Keep Getting Wrong
The community talks about privacy constantly and operational security rarely. The real threats to a home-hosted stack in 2026 are unglamorous:
Credential stuffing and brute force on exposed admin panels. The Plex incident that forced password resets in September 2025 — on top of the 2022 breach that affected up to 15 million of roughly 30 million accounts — wasn’t exotic. It was database access that turned into downstream credential-stuffing risk for everyone who reused their Plex password.
Application vulnerabilities in the services you run. Nextcloud has over 340 CVEs in its history. March 2026 saw a high-severity remote code execution advisory (GHSA-g7vj-98x3-qvjf) in Nextcloud Flow via a vulnerable Windmill version. December 2025 brought XSS in SVG handling (GHSA-qcw2-p26m-9gc5), HTML injection in Nextcloud Mail subject text, predictable participant tokens in Nextcloud Calendar, and information disclosure in Contacts search. None of these will make a front page, and all of them matter if your instance is exposed.
Misconfiguration, not exploitation. Vaultwarden’s own security posture is strong — the dani-garcia/vaultwarden project has a clean CVE history — but the dominant compromise pattern remains weak admin tokens, signup-enabled instances left public, absent rate limiting, and exposing the admin panel to the internet. Always set SIGNUPS_ALLOWED=false after creating accounts and gate /admin with Authelia or block it entirely at the proxy layer.
Ransomware via lateral movement from a compromised household device. If your server’s SMB share is mounted on a Windows laptop that catches a loader, everything on that share is encryption-eligible. Network segmentation and immutable backups exist to blunt this.
Backup discipline. The NIST Special Publication 800-53 controls for contingency planning (CP-9, Information System Backup) and the widely-cited 3-2-1 rule — three copies, two media types, one offsite — are the floor. In 2026 the practical formulation is 3-2-1-1-0: add one immutable or air-gapped copy, and zero errors in the most recent restore test. Backups you have never restored from are not backups.
A Security Baseline That Actually Holds Up
.env to git. Rotate admin tokens quarterly.The go-bag principle is worth isolating. If your Vaultwarden instance dies and the backup encryption key is in Vaultwarden, you have a cryptographic catch-22. Export your vault to an encrypted file on a USB drive once a quarter and put it somewhere that is not your house.
Restic backup example — this is the actual cron-driven script most people end up with, minus the provider-specific auth:
#!/bin/bash
export RESTIC_REPOSITORY="b2:home-backup:/server"
export RESTIC_PASSWORD_FILE="/root/.restic-pass"
export B2_ACCOUNT_ID="..."
export B2_ACCOUNT_KEY="..."
# Stop services that need consistent snapshots
docker compose -f /opt/stack/docker-compose.yml stop vaultwarden immich-db
restic backup /opt/stack /mnt/photos /mnt/docs \
--exclude-caches \
--tag nightly
docker compose -f /opt/stack/docker-compose.yml start vaultwarden immich-db
# Retention: 7 daily, 4 weekly, 12 monthly, 3 yearly
restic forget --prune \
--keep-daily 7 --keep-weekly 4 \
--keep-monthly 12 --keep-yearly 3Backblaze B2 at roughly $6 per TB per month beats S3 Glacier Deep Archive for restore latency; Glacier wins on raw cost for cold data. Pick one and actually run a restore drill.
The Cost Picture, Honestly
A realistic year-one cost for a household running Immich, Nextcloud, Vaultwarden, Jellyfin, Home Assistant, AdGuard Home, Paperless-ngx, and nightly off-site backups: $200 for a used ThinkCentre, $100 for a 1TB NVMe, $80 for a 2TB external drive for local backup, $30 annually for a domain, $20 to $60 per year for off-site cloud backup depending on library size. Call it $350 in year one and $50 per year after that.
Compared to iCloud 2TB, Google One 2TB, a 1Password family plan, and two streaming subscriptions, you’re displacing roughly $600 to $900 per year. Break-even is under a year on paper.
The part the spreadsheet doesn’t capture: at least one weekend a quarter debugging something, a Saturday morning every few months when an update breaks a service, and the mental overhead of being the IT department for your own household. Price that at $0 if you enjoy it and at whatever your hourly rate is if you don’t.
What Works Now and What Still Doesn’t
Some services have matured to the point where self-hosting is simply better than the commercial alternative. Some are good enough. Some remain traps.
Clearly mature: Vaultwarden, Jellyfin, Home Assistant, Immich, Syncthing, Pi-hole/AdGuard Home, Uptime Kuma, Caddy, WireGuard, Tailscale, Proxmox VE, TrueNAS SCALE, Paperless-ngx, Gitea/Forgejo, Navidrome, Actual Budget, Ollama.
Viable with effort: Nextcloud (powerful but heavy, more attack surface than most realize — use the Nextcloud AIO Docker image for saner defaults), Matrix (Synapse is a resource hog; Conduwuit or Dendrite are leaner), Mastodon (only if you want to run a community, not a personal instance), Joplin Server.
Traps: Self-hosted email for outbound. Self-hosted calendar and contacts as sole source of truth without verified replicas. Running Home Assistant as a Docker container when you actually need HAOS — you lose the add-on ecosystem and the Core/Supervised install methods were deprecated in 2025.
FAQ
Is self-hosting Vaultwarden actually safe? The project has a strong security record, and vaults are encrypted client-side with a key derived from your master password — the server never sees plaintext. The risk is operational: exposing the admin panel, leaving signups enabled, skipping MFA, or losing the database without a backup. Run it behind a VPN or reverse proxy with rate limiting, set SIGNUPS_ALLOWED=false, and back up db.sqlite3 nightly.
What if my home internet goes down? Services hosted at home go with it. VPN-based remote access also fails. This is why the go-bag principle matters and why services with hard uptime requirements should either have an offline mirror or stay on a commercial provider. Some people run a $4 Hetzner VPS as a secondary Vaultwarden replica for exactly this reason.
Proxmox or just Docker for a beginner? Start with Docker on bare Debian if you have one mini PC and want to see something running today. Move to Proxmox once you have more than five services or want VM-level snapshots before updates. Migration is mostly copying docker-compose.yml and named volumes to a new VM.
Is a Raspberry Pi enough? For Pi-hole, Home Assistant, and Uptime Kuma alone, yes. For Immich with machine learning, Jellyfin with transcoding, or anything resembling a full stack, no — get an x86 mini PC.
Can a CLI coding agent really replace a sysadmin? For configuration and day-to-day operations, meaningfully yes. For threat modeling, incident response, and deciding what not to expose, no. Treat agents as accelerators of work you already understand directionally, not substitutes for knowing how the network sits together.
The Honest Bottom Line
Self-hosting your entire digital life in 2026 is possible, cheaper than it has ever been, and — thanks to Proxmox, Docker Compose standardization, and coding agents — less tedious than at any point in the last decade. It is not, and will not be, lower-maintenance than cloud services. What it buys you is control, privacy, and the narrow but real satisfaction of owning the stack your life runs on.
Start with one service. Vaultwarden is the right first one: high privacy value, low resource footprint, and it forces you to learn backups, reverse proxies, and MFA before anything worse is at stake. Get it running behind WireGuard, restore from backup to prove it works, then add the next thing. The people whose setups collapse are the ones who tried to cut over everything in a weekend.
The walled garden is easy to step out of. Staying out of it is the part that takes discipline.
META DESCRIPTION: A practical 2026 guide to self-hosting your digital life — Proxmox vs Docker, real configs for Vaultwarden, Immich, Jellyfin, plus security and backup discipline.
