DEV Community

Meysam
Meysam

Posted on • Originally published at meysam.io on

Self-hosting Listmonk: From ConvertKit to €12/month infrastructure

#selfhosted #kubernetes #devops #opensource

Originally published at meysam.io/blog

When Medium hid subscriber counts in April 2025, I had already solved that problem six months earlier by moving my newsletter to self-hosted infrastructure. Here's how I run a newsletter for 1,500+ subscribers on a €12/month server.

On April 2025, Medium hid everyone's subscriber counts.

I wasn't surprised. I was prepared.

Because six months earlier, I'd already moved my newsletter off platforms I don't control. Not because I predicted Medium's move specifically, but because I'd learned the hard way: if you're building in public and your audience is on someone else's platform, you're building on rented land.

When Medium announced the change, I checked my email list. 1,500+ subscribers. All mine. Real email addresses I can reach directly, regardless of what any platform decides to do tomorrow.

That peace of mind? Worth the setup effort.

Why This Matters (And Why I'm Sharing This Now)

Look, I get it. Self-hosting sounds intimidating. Kubernetes sounds like overkill. "Just use ConvertKit or Buttondown," your brain says. "They're made for this."

They are. And they're great. Until they're not.

Until they change pricing.
Until they add features you don't want but have to pay for.
Until they get acquired and shut down.
Until they decide your content violates their new policies.

I'm not against using SaaS tools. I use plenty. But for your audience—the people who chose to hear from you—I believe you should own that relationship.

The calculation is simple:

  • Managed newsletter service: $30-100/month (and rising with subscribers)
  • Self-hosted Listmonk: €12/month (flat, forever, unlimited subscribers)

That's not the only reason though. It's about control. It's about data. It's about not waking up one day to find the rules changed while you weren't looking.

What You're Actually Building

Listmonk is an open-source newsletter and mailing list manager. Think Mailchimp or ConvertKit, but you run it on your own server.

What you get:

  • Full control of your subscriber data
  • Unlimited subscribers (you only pay for server costs)
  • No platform risk
  • Modern UI (actually good)
  • API for automation
  • Campaign analytics
  • Subscriber segmentation
  • Template customization

What you're giving up:

  • Someone else handling the servers
  • One-click setup
  • Built-in deliverability reputation (use a good SMTP service!?)
  • Hand-holding support

If that trade-off makes sense to you, keep reading.

Prerequisites: Are You Ready for This?

This guide assumes you:

  • Know what Docker/containers are (even if you've never deployed one)
  • Can SSH into a server without panicking
  • Are comfortable copying and pasting commands
  • Have ~2 hours to dedicate to setup
  • Have €12/month for hosting

You don't need:

  • To be a DevOps expert
  • To understand every line of YAML
  • To have Kubernetes experience (I'll explain what matters)
  • To know Go or VueJS (Listmonk's languages)

If you're thinking "I barely know Docker"—that's fine. I'll walk you through it. The whole point is making this accessible.

The Architecture (Without the Jargon)

Here's what we're building:

  1. A small server (Hetzner CCX13: 2 vCPUs, 8GB RAM, €12/month)
  2. K3s (lightweight Kubernetes—it's easier than you think)
  3. Listmonk (your newsletter app)
  4. PostgreSQL (database for subscribers/campaigns)
  5. Automated backups (to Hetzner Object Storage)

Why Kubernetes for a newsletter app? Valid question.

Because once you have K3s running, adding other self-hosted tools is trivial. Want analytics? Add Plausible. Want a CRM? Add Twenty. Want uptime monitoring? Add Uptime Kuma.

It's infrastructure that scales with you, not just for this one app.

But we'll start simple.

Part 1: Get a Server Running

Step 1: Buy the Server (5 minutes)

  1. Go to console.hetzner.cloud
  2. Create an account (if you don't have one)
  3. Create a new project (call it "newsletter" or whatever)
  4. Click "Add Server"

Server specs:

  • Location: Choose closest to your audience (I use Nuremberg, Germany)
  • Image: Ubuntu 24.04
  • Type: CCX13 (2 vCPU, 8GB RAM, 80GB SSD)
  • Networking: Public IPv4 + IPv6
  • SSH Key: Add your public key (generate one if needed: ssh-keygen -t ed25519)
  • Name: newsletter-1 or similar

Cost: €12.09/month

Click "Create & Buy Now."

Wait 60 seconds. You now have a server.

Step 2: Initial Server Setup (5 minutes)

SSH into your server:

ssh root@<your-server-ip>
Enter fullscreen mode Exit fullscreen mode

Update packages and set up firewall:

# Update system
apt update && apt upgrade -y

# Install required tools
apt install -y curl wget git ufw

# Configure firewall
ufw allow 22/tcp   # SSH
ufw allow 80/tcp   # HTTP
ufw allow 443/tcp  # HTTPS
ufw allow 6443/tcp # Kubernetes API
ufw enable
Enter fullscreen mode Exit fullscreen mode

That's it for basic server setup.

Part 2: Install K3s (10 minutes)

K3s is Kubernetes, but stripped down to essentials. Perfect for single-server setups.

# Install K3s
curl -s https://get.k3s.io | \
  INSTALL_K3S_CHANNEL=stable \
  INSTALL_K3S_EXEC="--secrets-encryption" \
  sh -

# Verify it's running
k3s kubectl get nodes
Enter fullscreen mode Exit fullscreen mode

You should see your node in "Ready" status.

Set up kubectl access (so you don't need to type k3s before every command):

export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
echo "export KUBECONFIG=/etc/rancher/k3s/k3s.yaml" >> ~/.bashrc
Enter fullscreen mode Exit fullscreen mode

Test it:

kubectl get nodes
Enter fullscreen mode Exit fullscreen mode

If you see your node listed, K3s is running. You now have a Kubernetes cluster on a €12 server.

Part 3: Install CloudNativePG Operator (5 minutes)

We need a PostgreSQL database for Listmonk. We'll use CloudNativePG—an operator that manages PostgreSQL for us.

# Install CloudNativePG operator
kubectl apply --server-side -f \
  https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.27/releases/cnpg-1.27.1.yaml

# Wait for it to be ready
kubectl rollout status deployment \
  -n cnpg-system cnpg-controller-manager
Enter fullscreen mode Exit fullscreen mode

That's it. PostgreSQL management is handled.

Part 4: Set Up External Secrets Operator (10 minutes)

We need a way to store sensitive data (database passwords, etc.) securely. We'll use AWS Systems Manager Parameter Store (it's free for our usage).

Install External Secrets Operator 

helm repo add external-secrets https://charts.external-secrets.io
helm repo update

helm install external-secrets \
  external-secrets/external-secrets \
  --namespace external-secrets \
  --version 0.20.x \
  --create-namespace
Enter fullscreen mode Exit fullscreen mode

Set up AWS credentials

  1. Create an IAM user in AWS Console with AmazonSSMReadOnlyAccess permission
  2. Generate access keys
  3. Create a secret in K8s: 
kubectl create secret generic aws-credentials \
  --from-literal=access-key-id=YOUR_ACCESS_KEY \
  --from-literal=secret-access-key=YOUR_SECRET_KEY \
  -n external-secrets
Enter fullscreen mode Exit fullscreen mode
  1. Create a ClusterSecretStore: 
---
apiVersion: external-secrets.io/v1beta1
kind: ClusterSecretStore
metadata:
  name: aws-parameter-store
spec:
  provider:
    aws:
      service: ParameterStore
      region: eu-central-1 # Frankfurt - change if needed
      auth:
        secretRef:
          accessKeyIDSecretRef:
            name: aws-credentials
            key: access-key-id
            namespace: external-secrets
          secretAccessKeySecretRef:
            name: aws-credentials
            key: secret-access-key
            namespace: external-secrets
Enter fullscreen mode Exit fullscreen mode 
kubectl apply -f ClusterSecretStore.yml
Enter fullscreen mode Exit fullscreen mode

Store your secrets in AWS Parameter Store

Go to AWS Console → Systems Manager → Parameter Store and create these parameters:

  • /listmonk/db/username → listmonk
  • /listmonk/db/password → (generate strong password)
  • /listmonk/db/superuser/username → postgres
  • /listmonk/db/superuser/password → (generate strong password)

All as SecureString type.

Alternatively, use AWS CLI:

aws ssm put-parameter --name /listmonk/db/username --value "listmonk" --type SecureString --overwrite
aws ssm put-parameter --name /listmonk/db/password --value "your-strong-password" --type SecureString --overwrite
aws ssm put-parameter --name /listmonk/db/superuser/username --value "postgres" --type SecureString --overwrite
aws ssm put-parameter --name /listmonk/db/superuser/password --value "your-superuser-password" --type SecureString --overwrite
Enter fullscreen mode Exit fullscreen mode

Part 5: Deploy PostgreSQL (5 minutes)

Create a namespace:

kubectl create namespace listmonk
Enter fullscreen mode Exit fullscreen mode

Create the database configuration files. I'm using the exact setup I run in production—tuned for the CCX13 specs:

---
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: pg-listmonk
  namespace: listmonk
spec:
  bootstrap:
    initdb:
      database: listmonk
      owner: listmonk
      secret:
        name: postgres-listmonk
  instances: 1
  postgresql:
    parameters:
      effective_cache_size: 6144MB
      maintenance_work_mem: 512MB
      max_connections: "100"
      shared_buffers: 2048MB
      work_mem: 16MB
  resources:
    limits:
      cpu: "2"
      memory: 8Gi
    requests:
      cpu: "1"
      memory: 4Gi
  storage:
    size: 40Gi
  superuserSecret:
    name: postgres-listmonk-superuser
Enter fullscreen mode Exit fullscreen mode 
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: postgres-listmonk-superuser
  namespace: listmonk
spec:
  data:
    - remoteRef:
        key: /listmonk/db/superuser/username
      secretKey: username
    - remoteRef:
        key: /listmonk/db/superuser/password
      secretKey: password
  refreshInterval: 24h
  secretStoreRef:
    kind: ClusterSecretStore
    name: aws-parameter-store
  target:
    template:
      type: kubernetes.io/basic-auth
Enter fullscreen mode Exit fullscreen mode 
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: postgres-listmonk
  namespace: listmonk
spec:
  data:
    - remoteRef:
        key: /listmonk/db/username
      secretKey: username
    - remoteRef:
        key: /listmonk/db/password
      secretKey: password
  refreshInterval: 24h
  secretStoreRef:
    kind: ClusterSecretStore
    name: aws-parameter-store
  target:
    template:
      type: kubernetes.io/basic-auth
Enter fullscreen mode Exit fullscreen mode

Apply them:

kubectl apply -f postgres/
Enter fullscreen mode Exit fullscreen mode

Wait for PostgreSQL to be ready:

kubectl wait --for=condition=Ready \
  cluster/pg-listmonk -n listmonk --timeout=5m
Enter fullscreen mode Exit fullscreen mode

Part 6: Deploy Listmonk (10 minutes)

Create the Listmonk configuration:

[app]
address = "0.0.0.0:9000"
root_url = "https://newsletter.yourdomain.com"
site_name = "Your Newsletter"

[db]
host = "pg-listmonk-rw"
port = 5432
database = "listmonk"
ssl_mode = "disable"
max_open = 100
max_idle = 50
max_lifetime = "1h"
params = "application_name=listmonk"
Enter fullscreen mode Exit fullscreen mode 
TZ=Etc/UTC
Enter fullscreen mode Exit fullscreen mode 
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: listmonk
spec:
  template:
    metadata:
      labels:
        app: listmonk
    spec:
      containers:
        - envFrom:
            - configMapRef:
                name: listmonk-envs
            - secretRef:
                name: listmonk-secrets
          image: listmonk/listmonk
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /
              port: http
            initialDelaySeconds: 3
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 5
          name: listmonk
          ports:
            - containerPort: 9000
              name: http
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /
              port: http
            initialDelaySeconds: 3
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 5
          volumeMounts:
            - mountPath: /listmonk/uploads
              name: uploads
            - mountPath: /listmonk/config.toml
              name: listmonk-config
              subPath: config.toml
            - mountPath: /tmp
              name: tmp
      initContainers:
        - command:
            - ./listmonk
            - "--idempotent"
            - "--upgrade"
            - "--yes"
          envFrom:
            - configMapRef:
                name: listmonk-envs
            - secretRef:
                name: listmonk-secrets
          image: listmonk/listmonk
          name: migrations
          volumeMounts:
            - mountPath: /listmonk/uploads
              name: uploads
            - mountPath: /listmonk/config.toml
              name: listmonk-config
              subPath: config.toml
      volumes:
        - emptyDir: {}
          name: tmp
        - configMap:
            defaultMode: 0400
            name: listmonk-config
            optional: false
          name: listmonk-config
        - name: uploads
          persistentVolumeClaim:
            claimName: listmonk-uploads
Enter fullscreen mode Exit fullscreen mode 
---
apiVersion: v1
kind: Service
metadata:
  name: listmonk
  namespace: listmonk
spec:
  ports:
    - name: http
      port: 80
      targetPort: 9000
  selector:
    app: listmonk
  type: ClusterIP
Enter fullscreen mode Exit fullscreen mode 
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: listmonk-secrets
  namespace: listmonk
spec:
  data:
    - remoteRef:
        key: /listmonk/db/username
      secretKey: LISTMONK_db__user
    - remoteRef:
        key: /listmonk/db/password
      secretKey: LISTMONK_db__password
  refreshInterval: 24h
  secretStoreRef:
    kind: ClusterSecretStore
    name: aws-parameter-store
Enter fullscreen mode Exit fullscreen mode 
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: listmonk-uploads
  namespace: listmonk
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 8Gi
Enter fullscreen mode Exit fullscreen mode 
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    traefik.ingress.kubernetes.io/router.middlewares: default-redirect-https@kubernetescrd
  name: listmonk
spec:
  ingressClassName: traefik
  rules:
    - host: newsletter.yourdomain.com
      http:
        paths:
          - backend:
              service:
                name: listmonk
                port:
                  number: 80
            path: /
            pathType: Prefix
  tls:
    - hosts:
        - newsletter.yourdomain.com
      secretName: listmonk-tls
Enter fullscreen mode Exit fullscreen mode 
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
  - deployment.yml
  - externalsecret.yml
  - ingress.yml
  - pvc.yml
  - service.yml

configMapGenerator:
  - name: listmonk-config
    files:
      - config.toml
  - name: listmonk-envs
    files:
      - configs.env

namespace: listmonk
Enter fullscreen mode Exit fullscreen mode

Apply everything:

kubectl apply -k listmonk/
Enter fullscreen mode Exit fullscreen mode

Wait for Listmonk to be ready:

kubectl wait --for=condition=Ready \
  pod -l app=listmonk -n listmonk --timeout=5m
Enter fullscreen mode Exit fullscreen mode

Part 7: Expose Listmonk to the Internet (15 minutes)

We'll use Traefik as our ingress controller (it comes with K3s).

Install cert-manager for SSL:

kubectl apply -f \
  https://github.com/cert-manager/cert-manager/releases/download/v1.19.1/cert-manager.yaml
Enter fullscreen mode Exit fullscreen mode 
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    email: your-email@example.com
    privateKeySecretRef:
      name: letsencrypt-prod
    server: https://acme-v02.api.letsencrypt.org/directory
    solvers:
      - http01:
          ingress:
            class: traefik
Enter fullscreen mode Exit fullscreen mode 
kubectl apply -f ClusterIssuer.yml
Enter fullscreen mode Exit fullscreen mode

Point your domain DNS:

  • Add an A record: newsletter.yourdomain.com → <your-server-ip>

Wait 5-10 minutes for DNS propagation and SSL certificate issuance.

Part 8: Access and Configure Listmonk

Navigate to https://newsletter.yourdomain.com

Login with the credentials from LISTMONK_db__user & LISTMONK_db__user:

  • Username: listmonk
  • Password: your-strong-password (you did change this, right?)

First-time setup

  1. Settings → General:

    • Update site name
    • Add your logo
    • Set timezone

  2. Settings → SMTP:

    • Use a transactional email service (I recommend Maileroo)
    • Or use your own mail server
    • Test the configuration

  3. Lists:

    • Create your first list (e.g., "Weekly Newsletter")
    • Set double opt-in (recommended for deliverability)

  4. Templates:

    • Customize the default template
    • Match your brand colors

Part 9: Set Up Automated Backups (10 minutes)

Your database is the most critical part. Let's back it up to Hetzner Object Storage.

Create a bucket in Hetzner:

  1. Go to console.hetzner.cloud
  2. Object Storage → Create bucket
  3. Name it (e.g., newsletter-backups)
  4. Create access keys

Configure CloudNativePG backup:

---
apiVersion: barmancloud.cnpg.io/v1
kind: ObjectStore
metadata:
  name: pg-listmonk
  namespace: listmonk
spec:
  configuration:
    data:
      compression: bzip2
    destinationPath: s3://newsletter-backups/postgres/
    endpointURL: https://fsn1.your-objectstorage.com
    s3Credentials:
      accessKeyId:
        key: ACCESS_KEY_ID
        name: hetzner-blob-storage
      secretAccessKey:
        key: ACCESS_SECRET_KEY
        name: hetzner-blob-storage
    wal:
      compression: bzip2
  retentionPolicy: 7d
Enter fullscreen mode Exit fullscreen mode

Create the secret:

kubectl create secret generic hetzner-blob-storage \
  --from-literal=ACCESS_KEY_ID=your-access-key \
  --from-literal=ACCESS_SECRET_KEY=your-secret-key \
  -n listmonk
Enter fullscreen mode Exit fullscreen mode 
---
apiVersion: postgresql.cnpg.io/v1
kind: ScheduledBackup
metadata:
  name: pg-listmonk
  namespace: listmonk
spec:
  cluster:
    name: pg-listmonk
  immediate: true
  method: plugin
  pluginConfiguration:
    name: barman-cloud.cloudnative-pg.io
  schedule: 0 0 * * * # Daily at midnight
Enter fullscreen mode Exit fullscreen mode

Apply:

kubectl apply -f postgres/objectstore.yml
kubectl apply -f postgres/scheduledbackup.yml
Enter fullscreen mode Exit fullscreen mode

Your database now backs up daily to object storage. If your server explodes, you can restore from these backups.

What You Just Built

Let's recap:

  • ✅ Self-hosted newsletter platform
  • ✅ Unlimited subscribers (only limited by server resources)
  • ✅ PostgreSQL database with automated backups
  • ✅ SSL certificates (auto-renewing)
  • ✅ Modern UI for managing campaigns
  • ✅ API for automation
  • ✅ Full control of your data

Monthly cost: €12 for server + ~€0-5 for backups + transactional email costs (starts at ~$0.4 per 1,000 emails with Maileroo)

Compare that to ConvertKit at $33/month for 1,000 subscribers, scaling to $50/month for 3,000.

The Trade-Offs (Let's Be Honest)

What you gained:

  • Full ownership of subscriber data
  • No platform risk
  • Predictable costs
  • Unlimited scale potential
  • Learning experience
  • Infrastructure for other tools

What you gave up:

  • Managed infrastructure (you're responsible for updates)
  • Built-in deliverability reputation (you'll need to warm up your domain)
  • One-click features (you configure everything)
  • Hand-holding support (you're on your own or rely on community)

For me, it's worth it. Your mileage may vary.

If you send one newsletter a week and have 500 subscribers, maybe ConvertKit makes more sense. If you're serious about building a long-term relationship with your audience and want to minimize dependencies, this setup pays for itself.

What I Learned Doing This

Setting up Listmonk forced me to stay sharp in my Kubernetes game. That knowledge paid off immediately when I wanted to add other self-hosted tools.

Now my €12 server runs:

  • Listmonk (newsletter)
  • Plausible (analytics)
  • Uptime Kuma (monitoring)
  • A few internal tools

That same infrastructure would cost $100+/month across different SaaS providers.

The biggest lesson: Self-hosting isn't as scary as it seems. The initial setup is the hardest part. Maintenance is mostly hands-off.

I spend ~30 minutes per month on server updates. That's it.

Next Steps

If you followed this guide, you now have a running newsletter platform.

Immediate tasks:

  1. Configure your SMTP settings (Maileroo recommended)
  2. Import existing subscribers (if you have them)
  3. Create your first campaign template
  4. Send a test email
  5. Set up a subscription form on your website

Within the first week:

  1. Warm up your domain (start with small sends)
  2. Monitor deliverability (check spam folders)
  3. Create a consistent sending schedule 9. Add analytics tracking (optional)

Ongoing:

  1. Regular server updates (apt update && apt upgrade)
  2. Monitor backup status
  3. Scale server as needed (upgrade CCX type if you grow)

The Real Reason I'm Sharing This

When Medium hid subscriber counts, a bunch of indie hackers panicked in my DMs.

  • "How do I know if anyone cares?"
  • "Should I just quit?"
  • "All my metrics disappeared."

If your entire metric system lives on someone else's platform, you're vulnerable.

I can't control what Medium does. Or X. Or LinkedIn. Or any platform.

But I can control my email list. I know exactly how many people subscribed. I can email them directly, right now, without asking permission or paying per subscriber.

That's not about paranoia. It's about sustainability.

If you're building something long-term—a product, a community, a body of work—own the relationship with your audience. Rent the amplification platforms (social media), but own the foundation (email list).

This setup is my foundation. It took a Saturday afternoon to set up. It'll run for years.

You don't have to use Kubernetes. You could run Listmonk with Docker Compose on the same Hetzner server for even less complexity. I chose K8s because I wanted room to grow.

The point isn't the specific tech stack.

The point is: stop renting your audience.

Running this setup in production? Stuck somewhere? Email me. I read every message.

Building in public? Subscribe to my newsletter where I share lessons like this every week: meysam.io

Top comments (0)