Self-host the things whose loss would hurt and whose failure you can survive: passwords, files, code, notes, DNS filtering and your own AI chat front end. Do not self-host the things where a bad week costs you deliverability or data — email in particular. And treat the exit plan as the product: exports, off-site backups and a payment method that is not a single bank. That framing comes from a week in which Switzerland's Federal Council published results of a proof of concept with 172 employees on the openDesk suite and launched a 3,000-employee pilot to run through 2027, Imbue released Cloud in a Bottle (AGPL-3.0) so a Raspberry Pi or an old laptop installs Nextcloud, Vaultwarden, Forgejo, Jellyfin and Open WebUI in one click, and Autistici/Inventati — a collective hosting email and blogs for activists since 2001 — announced its shutdown after a 26 August US terrorism designation made its site unreachable and led its bank to suspend its account on 5 September. The lesson is not "cloud bad". It is that the layer you do not control is the layer that decides.
Why this week and not last year
The Swiss case is the institutional version. On 3 September 2026 the Federal Council published the results of PoC BOSS, a feasibility test in which 172 federal employees used openDesk — a German open-source collaboration platform — instead of Microsoft 365. On that basis a pilot for about 3,000 employees in critical processes runs to the end of 2027, in parallel with Microsoft 365 rather than replacing it outright. Switzerland's military Cyber Command is not waiting: it intends to replace Microsoft 365 entirely with openDesk by October 2026, on the stated ground that foreign governments should not be able to reach sensitive Swiss data. Behind both sits the 2024 EMBAG law, which requires federal agencies to publish government-developed software as open source by default.
Cloud in a Bottle is the individual version. Built by Imbue with open-source contributors and licensed AGPL-3.0, it is a personal cloud platform that installs web applications with one click on hardware you control — an old laptop, a Raspberry Pi, your own VPS — or on Imbue's managed service from $5 a month with a $10 starting credit. The curated catalogue is the self-hosting canon: Nextcloud for files, calendar and contacts; Vaultwarden for passwords; Forgejo for Git; Jellyfin and Navidrome for media; Pi-hole for network ad blocking; SearXNG for search; a Matrix Synapse homeserver for chat; Open WebUI for a local LLM interface; Uptime Kuma for monitoring; plus Minecraft and a notes app. It hit the Hacker News front page with over 600 points because it removes the reason most people never started: the first weekend.
Autistici/Inventati is the warning. A/I ran email, hosting and the Noblogs platform for activists for 25 years. After the US designation on 26 August, its website became inaccessible on 28 August, Banca Etica suspended its account on 5 September, and on 6 September it announced closure. A/I rejects the accusations entirely; that is not the point here. The point is the failure chain: not a server, not a disk, but a domain and a bank. Neither is something self-hosting alone protects you from, and both are things a good exit plan does.
The three tiers
Tier 1 — run it yourself, no debate
Passwords (Vaultwarden, Bitwarden-compatible clients). A breach here is catastrophic and the software is small, stable and offline-capable. Files and calendar (Nextcloud). Code (Forgejo or Gitea): a mirror of everything you have on GitHub, pulled nightly, costs almost nothing and turns a platform outage or account suspension into an inconvenience. Notes: plain Markdown in a synced folder beats any hosted notes app for longevity; if you use Obsidian, the vault is already files, and Nextcloud syncs it. DNS filtering (Pi-hole or AdGuard Home): the single biggest quality-of-life win per hour spent.
Tier 2 — run it yourself if you will maintain it
Media (Jellyfin, Navidrome): great, but storage grows and transcoding wants real hardware. Chat (Matrix Synapse): worth it for a family or a small team; federation and encryption key management add operational load. Local AI (Open WebUI in front of a local model or an API key): the front end is trivial to host; the model is a hardware question. For most people the sane configuration is a self-hosted front end pointing at a paid API, which keeps your conversation history on your disk without buying a GPU. Monitoring (Uptime Kuma): host it somewhere other than the box it monitors.
Tier 3 — do not self-host
Email. Deliverability is a reputation system you do not control; a misconfigured DKIM or a neighbour's spam on a shared IP range costs you real messages. A/I ran mail for 25 years with expertise most of us do not have and still could not survive a sanction. Use a paid provider with export, and keep your own domain so you can move. Anything with legal retention duties — invoicing records, payroll — unless you also own the backup and audit story. Public-facing services for other people unless you are prepared to be on call.
The exit plan is the product
Every service above gets three things before it goes live. An export you have actually tested — Nextcloud's is a folder, Vaultwarden's is an encrypted JSON, Forgejo's is git clone --mirror. A 3-2-1 backup: three copies, two media, one off-site, with the off-site copy encrypted with a key that lives in the password manager and on paper. And a second payment method for the domain and the VPS, because the A/I chain started with a bank, not a server.
Network layout matters more than most guides admit. Put self-hosted services on their own subnet or VLAN, expose them through a single reverse proxy, and never port-forward a database. The subnet calculator is the quickest way to carve a /24 into a services range, an IoT range and a trusted range before you plug anything in. Generate every admin credential with the password generator and check the old ones with the strength checker; the weakest link in a home server is a reused admin password.
A minimal starting compose file
services:
vaultwarden:
image: vaultwarden/server:latest
volumes: ["./vw-data:/data"]
environment:
SIGNUPS_ALLOWED: "false"
restart: unless-stopped
uptime-kuma:
image: louislam/uptime-kuma:1
volumes: ["./kuma:/app/data"]
ports: ["3001:3001"]
restart: unless-stopped
Two services, both Tier 1, both with volumes you can back up as folders. Add Nextcloud and Forgejo in week two, once the backup job has run and you have restored from it once.
The honest counter-argument
A well-run hosted service has better uptime, better security staffing and better backups than any individual. That is true and it is why Tier 3 exists. The self-hosting case is not that you will run things better; it is that for a specific small set of services, the cost of someone else's decision — a policy change, a suspension, a sanction, an acquisition — is higher than the cost of your own maintenance. Switzerland reached that conclusion for critical processes and still runs Microsoft 365 alongside. Draw your line the same way: by consequence, not by ideology.
Backups you have actually restored
A backup you have never restored is a hypothesis. The pattern that has survived three hardware failures for us is deduplicating, encrypted snapshots to a remote bucket, with a restore drill on a fixed day.
# nightly, from the host running the containers
restic -r s3:https://s3.example.com/homelab-backups backup ./vw-data ./kuma ./nextcloud-data
restic -r s3:https://s3.example.com/homelab-backups forget --keep-daily 14 --keep-weekly 8 --keep-monthly 12 --prune
# first Sunday of the month: restore into a scratch directory and start the stack from it
restic -r s3:https://s3.example.com/homelab-backups restore latest --target /tmp/drill
docker compose -f /tmp/drill/compose.yml up -d && curl -fsS http://localhost:3001 >/dev/null && echo "restore OK"
The repository password lives in the password manager and on a printed card in a drawer, because the failure mode where the password manager is the thing you are restoring is not hypothetical. The bucket is with a provider that is not your VPS host, in a different legal jurisdiction if you can arrange it; that is the A/I lesson applied to data rather than to money.
What it costs, honestly
Hardware: an old laptop or a used mini-PC you already own is enough for everything in Tier 1, and a Raspberry Pi handles Pi-hole and Vaultwarden on its own. If you prefer not to run hardware at home, a small VPS covers Tier 1 for a few dollars a month, and Cloud in a Bottle's managed option starts at $5 a month with a $10 credit if you want someone else to keep the box patched. Off-site backup storage for a household is typically in the single dollars per month at current object-storage prices. Time is the real cost: an hour to set up, then perhaps an hour a month for updates and the restore drill. Compare that against the subscriptions it replaces and the answer is usually favourable, but the honest framing from earlier stands — you are paying with maintenance for control, not for savings.
Start with Vaultwarden and Pi-hole this weekend, test the export before you trust either, and write the exit plan in the same notes vault you are about to self-host. Our self-hosted sandbox guide for managed agents covers the same principle for AI workloads, and the Obsidian Developer Productivity Vault is the notes layer we sync through Nextcloud; the MCP Server Pack includes the configs that point Claude and Open WebUI at self-hosted services. Every product mentioned is available at wowhow.cloud — pay once, ship forever.
Originally published at wowhow.cloud
Top comments (0)