Practical, skimmable setup guides for self-hosting, AI operations, websites, and open-source project workflows.
Use LLDAP as the user directory, let Authelia provide the login wall, and keep the scope to one sane LDAP-backed path instead of chasing a giant identity platform before you need it.
Start with VPS setup, then SSH basics, then website deployment.
OpenClaw install, Paperclip workspace setup, durable services, then private access patterns.
Reverse proxy, Docker Compose, backups, recovery, and maintenance-safe operations.
Build a cleaner client-side SSH workflow with host aliases, per-host keys, agent settings, and safer habits so daily server administration is faster and less error-prone.
Use SSH local port forwarding to reach private dashboards and databases through an encrypted tunnel so admin services can stay off the public internet.
Plan DNS changes for a VPS app with a full record inventory, clear A and CNAME decisions, mail-safety checks, and realistic expectations about TTL and propagation.
Expand cramped Docker storage safely by understanding the difference between Docker's data-root, bind mounts, and named volumes before you move anything.
Create a smaller custom Docker image with a multi-stage build, a useful .dockerignore, clean tagging, local testing, and a registry push workflow you can verify before redeploying.
Put an authenticated gate in front of internal dashboards with Authelia and Nginx while keeping the real app bound privately instead of normalizing public exposure.
Move a self-hosted app from SQLite to PostgreSQL with rehearsal, backups, validation, and fallback boundaries instead of treating the cutover like a blind engine swap.
Host a private Docker registry with TLS and authenticated access so internal image distribution stays controlled instead of depending on public exposure or ad hoc tarball sharing.
Step-by-step walkthroughs for installing, configuring, and running practical tools on real systems.
Guides for servers, SSH, reverse proxies, security basics, deployments, and keeping things stable.
Guides that prioritize free and open-source tools whenever they are a strong fit.
A new Learning Center section for clickable drills and fast score-based review. The first live release is a Hawaii Safety Inspector practice test with 120 true-or-false questions.
Review certification rules, station obligations, sticker workflow, and inspection failure conditions with a direct true-or-false recall drill.
Some topics need reps more than reading. This lane gives the Learning Center a cleaner path for exam prep and knowledge checks alongside the long-form guides.
Read the material first, take the test cold, then review the missed list until the weak spots stop repeating.
The newest guides appear first, with older guides preserved underneath as the archive grows.
Use LLDAP as the user directory, let Authelia provide the login wall, and keep the scope to one sane LDAP-backed path instead of chasing a giant identity platform before you need it.
Put Glance in front of your feeds, bookmarks, and a few operational widgets when you want a fast dashboard surface, not another oversized monitoring platform.
Run Homepage as a polished private start page for your own services, then add integrations carefully so convenience does not turn into unnecessary privilege.
Run Beszel when you want quick visibility into server health without committing to a full Prometheus stack, then keep the first deployment honest about the difference between the hub and the agent.
Watch a page for meaningful changes without hand-refreshing it all day, then keep the first deployment private and modest instead of promising that every JavaScript-heavy site will work out of the box.
New guides are prepended on top, while older guides remain available below. The archive now leads with LLDAP plus Authelia, Glance, Homepage, Beszel, and changedetection.io, while the older self-hosting archive stays preserved underneath.
Use LLDAP as the user directory, let Authelia provide the login wall, and keep the scope to one sane LDAP-backed path instead of chasing a giant identity platform before you need it.
Put Glance in front of your feeds, bookmarks, and a few operational widgets when you want a fast dashboard surface, not another oversized monitoring platform.
Run Homepage as a polished private start page for your own services, then add integrations carefully so convenience does not turn into unnecessary privilege.
Run Beszel when you want quick visibility into server health without committing to a full Prometheus stack, then keep the first deployment honest about the difference between the hub and the agent.
Watch a page for meaningful changes without hand-refreshing it all day, then keep the first deployment private and modest instead of promising that every JavaScript-heavy site will work out of the box.
Start from SearXNG's official Compose setup, keep the service private-first unless you truly need public access, and wire the limiter plus reverse-proxy headers correctly before you trust it on the internet.
Add a simple web UI for Docker Compose stacks without abandoning file-based workflows, then keep the sensitive stack directory and Docker socket under tighter control than the average dashboard tutorial bothers to mention.
Stream container logs in the browser without standing up a full observability stack, then keep the deployment honest about what mounting docker.sock really means.
Stand up a clean private bookmark manager that is easy to back up, easy to proxy, and modest enough not to turn a simple personal knowledge tool into an infrastructure project.
Put a narrow, intentional web file manager in front of one specific directory, keep its database and config persistent, and avoid the all-too-common mistake of mounting half the server just because you can.
Deploy Vaultwarden behind HTTPS, configure SMTP for real account workflows, and back up the full data directory instead of trusting a password manager install you cannot restore.
Run Headscale for private service access, register clients intentionally, and stay honest about the extra coordination overhead compared with hosted Tailscale.
Put Traefik in front of Docker services, let labels drive routing, and issue TLS certificates automatically without turning the setup into a giant reverse-proxy theory project.
Build a small, practical metrics stack that shows CPU, memory, disk, and load trends clearly enough to catch trouble before it becomes an outage.
Run Paperless-ngx with the upstream Compose bundle, keep OCR support on, and get clear about persistent data, imports, and recovery before you dump a lifetime of documents into it.
Install OpenClaw on a local Ubuntu or Debian machine with the official installer, verify the Gateway, and keep the dashboard private by default before any remote exposure.
Run a small S3-compatible object storage service with MinIO, persistent storage, and a cleaner API-plus-console split for self-hosted apps and backups.
Generate a Hugo site locally, deploy only the built output to a VPS, and let Caddy serve it with automatic HTTPS.
Add CrowdSec to an Nginx-backed VPS so log-driven detection and the Nginx bouncer can block abuse more intelligently than static rules alone.
Deploy Forgejo with Docker Compose, persist its data, and place it behind HTTPS so your self-hosted forge stays usable and maintainable.
Use Caddy and the DNS challenge to issue a wildcard certificate for many self-hosted subdomains without hand-managing separate certificates for each app.
Add PgBouncer in front of PostgreSQL for a self-hosted app while staying honest about pooling modes, compatibility risks, and rollback.
Use a blue-green pattern with Docker Compose and Nginx to cut over a stateless web app more safely than in-place restarts.
Move beyond dump-only backups by pairing Postgres base backups with WAL archiving through WAL-G, then prove the recovery path with a rehearsal restore.
Use OpenTofu to provision one small VPS and matching DNS records from versioned configuration so rebuilding infrastructure stops depending on memory and dashboard clicks.
Protect Docker volume data with a local-first Restic repository, app-aware dump habits, retention rules, and restore drills before you add off-host complexity.
Choose proxied versus DNS-only hostnames deliberately, keep origin HTTPS coherent, and preserve real client IP visibility in Nginx.
Use Docker Compose one-off commands with clearer preflight checks, better service targeting, and less risk than ad hoc container habits.
Keep staging realistic without letting test email, webhooks, or third-party callbacks leak into real users and production systems.
Use systemd tmpfiles rules to create runtime, cache, and state directories cleanly at boot instead of relying on brittle manual setup.
Control a remote Docker engine through the official SSH transport so day-two admin work stays cleaner and safer than exposing the daemon on the network.
Build an encrypted, deduplicated backup path to another Linux host you control so one VPS failure does not turn into total data loss.
Move Docker onto a non-root user service on Ubuntu so you can reduce daemon privilege without pretending it is the right answer for every workload.
Use systemd's credential mechanism for local services so secrets do not need to live directly in unit files or ordinary environment variables.
Define one small container declaratively and let systemd manage its lifecycle through Podman Quadlet instead of jumping straight to a bigger orchestration tool.
Build a private admin tunnel you control yourself so SSH and internal tools do not need to stay exposed on a public VPS IP.
Put a friendlier open-source front door in front of Docker apps so certificates and proxying are easier to run correctly the first time.
Turn first-boot VPS setup into a small, reviewable config file so rebuilding the base box stops depending on memory and shell history.
Reduce the damage a compromised service can do by using systemd's built-in security analysis and a careful first pass of sandboxing controls.
Put an authenticated gate in front of internal dashboards with Authelia and Nginx while keeping the real app bound privately instead of normalizing public exposure.
Move a self-hosted app from SQLite to PostgreSQL with rehearsal, backups, validation, and fallback boundaries instead of treating the cutover like a blind engine swap.
Quiet cron jobs, queues, and worker processes before maintenance so schema changes, restores, and storage moves do not race against background writes.
Host a private Docker registry with TLS and authenticated access so internal image distribution stays controlled instead of depending on public exposure or ad hoc tarball sharing.
Use Docker Compose profiles to keep always-on services separate from workers, admin tools, and occasional tasks so operations stay clearer and maintenance stays safer.
Restore a Docker Compose app onto a fresh VPS after a server failure with a recovery checklist that rebuilds the host, restores data safely, and verifies the stack before traffic returns.
Rotate database passwords, API keys, SMTP credentials, Redis auth, and app secrets on a self-hosted stack with a safer sequence that limits outages and makes rollback realistic.
Freeze writes on a self-hosted app before risky updates, schema changes, or storage moves so you can perform maintenance with less chance of data inconsistency.
Create a staging clone of a production self-hosted app without leaking live credentials, sending real email, or letting tests hit production integrations by accident.
Upgrade Postgres across major versions in Docker Compose with a safer dump-and-restore or side-by-side plan, clear rollback boundaries, and verification before reconnecting your app.
Use UFW on a Docker VPS without accidentally exposing containers or locking yourself out, with safer defaults for published ports and reverse proxies.
Troubleshoot 502 Bad Gateway errors in Nginx by checking the backend app, upstream reachability, sockets, Docker networking, and logs in the right order.
Run Postgres in Docker Compose with safer persistence, private-by-default exposure, named volumes, and backup-aware habits that reduce accidental data loss.
Build a cleaner client-side SSH workflow with host aliases, per-host keys, agent settings, and safer habits so daily server administration is faster and less error-prone.
Use SSH local port forwarding to reach private dashboards and databases through an encrypted tunnel so admin services can stay off the public internet.
Plan DNS changes for a VPS app with a full record inventory, clear A and CNAME decisions, mail-safety checks, and realistic expectations about TTL and propagation.
Expand cramped Docker storage safely by understanding the difference between Docker's data-root, bind mounts, and named volumes before you move anything.
Create a smaller custom Docker image with a multi-stage build, a useful .dockerignore, clean tagging, local testing, and a registry push workflow you can verify before redeploying.
Learn how to read Linux logs with journalctl and tail so you can diagnose crashes, boot problems, proxy errors, and failing services faster.
Use systemd timers to schedule backups and maintenance tasks on Linux with better visibility and control than a pile of fragile cron entries.
Manage Docker Compose environment files and secret files more safely so credentials stay out of source control and deployments stay easier to reason about.
Use rsync to ship code and static assets to a VPS quickly, with fewer mistakes and a safer deployment routine than manual file copying.
Set up a simple uptime dashboard with Uptime Kuma so you can monitor websites, APIs, and home lab services from one clean interface.
Reduce accidental exposure in Docker Compose by separating public and private services with custom networks, internal-only containers, and safer port publishing habits.
Keep secrets versioned without storing them in plaintext by encrypting env files and config snippets with SOPS and age, then decrypting only when you actually need them.
Use Trivy to scan Docker images, containers, and Linux packages for known vulnerabilities so you can patch the highest-risk issues first instead of guessing.
Stop Docker logs from quietly filling your VPS disk by setting sensible json-file log limits, understanding when logrotate matters, and verifying rotation before you need it.
Protect SQLite-backed apps with safe backup copies, restore drills, WAL-aware handling, and simple verification steps that reduce the risk of corrupted snapshots.
Provision a self-hosting VPS with Ansible so your base server setup is repeatable, reviewable, and easier to rebuild after mistakes or migrations.
Use ntfy to send simple self-hosting alerts from cron jobs, backup scripts, and server checks without paying for a heavyweight monitoring platform first.
Deploy from GitHub Actions to a VPS with a simple SSH-based workflow that keeps secrets under control and supports quick rollbacks.
Pin Docker images so rebuilds stay predictable, accidental major upgrades are less likely, and rollbacks are easier when an update goes wrong.
Back up Docker volumes to MinIO with Restic so your self-hosted app data has off-host protection, retention, and a restore path you can actually test.
Use Tailscale to reach your VPS over a private mesh network so SSH and admin services stay off the public internet by default.
Collect Docker container logs in Loki and explore them in Grafana so troubleshooting stops depending on whatever happens to still be in docker logs.
Structure Docker Compose projects with a shared base file and environment-specific overrides so development, staging, and production stay similar without becoming identical by accident.
Diagnose and fix Docker volume and bind mount permission problems without blindly chmod 777-ing everything and creating a bigger mess.
Create reliable MariaDB backups from a Docker Compose stack, store them safely, and test restores so the database can actually be recovered when needed.
Update Docker Compose apps with cleaner version pinning, preflight checks, backup-aware habits, and a rollback path you can actually use under pressure.
Use Docker Compose healthchecks, restart policies, and resource limits to make self-hosted apps more predictable and easier to recover when something goes wrong.
Monitor backups and scheduled jobs with Healthchecks so silent failures stop hiding for days or weeks before you notice them.
Connect self-hosted apps to an SMTP relay so password resets, alerts, and transactional messages leave your VPS more reliably and with less deliverability pain.
Run Redis in Docker Compose with persistence, password protection, and private-by-default networking so it is useful to your apps without being casually exposed.
Move a self-hosted app to a new VPS with a cleaner migration plan, safer cutover habits, and less downtime than an improvised move.
Free disk space on a Docker VPS methodically so you can recover a full server without deleting the wrong images, volumes, or application data.
Add swap and make a few safe memory-tuning changes on a small Ubuntu VPS so brief RAM spikes are less likely to kill your services.
Install Netdata on a VPS to watch disk, CPU, memory, and load in real time so you can spot resource problems before they become outages.
Create Postgres backups with pg_dump, store them safely, and verify you can restore them before you trust the backup routine.
Lock down SSH on Ubuntu with key-based logins, safer sshd settings, UFW, and Fail2ban so your server is much harder to abuse.
Use unattended-upgrades on Ubuntu to install security patches automatically, reduce maintenance gaps, and keep control over what changes on your server.
Serve several Docker Compose apps from one VPS with Nginx, subdomains, clean port mapping, and a structure that stays understandable as you add services.
Use Syncthing to keep files in sync between your devices without handing the data to a third-party cloud storage provider.
Use rclone to send server data offsite to S3-compatible storage or Backblaze B2 so one machine failure does not become total data loss.
Set up Paperclip in a real OpenClaw workspace with practical structure, identity files, and safe project-operation guardrails.
Use systemd to keep self-hosted services running reliably with restart policies, boot persistence, logs, and safer day-2 operations.
Deploy Docker Compose applications on a VPS with better directory structure, volumes, env files, updates, and rollback habits.
Protect your VPS with off-server backups, restore drills, retention policies, and a recovery-first mindset using open-source tools.
Use Tailscale and Nginx to keep AI dashboards and operator tools privately reachable without exposing raw services to the public internet.
A thorough beginner-friendly guide to setting up a Linux VPS for self-hosting with a secure foundation, using free and open-source tools.
A practical beginner-friendly SSH guide covering keypairs, first login, config shortcuts, file copy, and safe recovery habits.
A practical guide to deploying a simple website on a VPS with Nginx, DNS, HTTPS, and a clean update workflow using open-source tools.
Learn the reusable reverse proxy and HTTPS pattern for self-hosted services using Nginx and Let’s Encrypt with safe backend routing.
A practical guide to installing OpenClaw on a VPS with a secure, production-minded setup and a focus on safe access patterns.