How to self-host an open-source tool safely
Hosting your own copy of a tool is how you keep your data and skip the subscription. It also makes you the person responsible for keeping it safe.
Before you start
- Use a small separate server, not your personal computer.
- Prefer projects with a Docker image and recent releases. Check the date of the last commit.
- Read the project's own install guide. It knows its quirks better than any tutorial.
Lock the basics
- Put it behind HTTPS. A reverse proxy such as Caddy gets you a certificate automatically.
- Change every default password the first time you log in, and turn on two-step sign-in if the tool offers it.
- Keep secrets in environment variables or a secrets file, never in code you publish.
- Open only the ports you need. A firewall that blocks everything else is free.
Keep it running
- Update on a schedule. Old versions are where attackers look first.
- Back up the data, not just the app, and test a restore once.
- Watch disk space. A full disk is the most common way a small server dies.
When not to self-host
If the tool holds anything that would hurt people if it leaked, and you don't have time to maintain it, a hosted version is often safer. Tools with a free hosted version, such as AudioMass or Excalidraw, may be all you need.
Not legal advice. Read each project's licence file before you build or sell anything on it.