this post was submitted on 26 Jun 2026
223 points (91.4% liked)

Selfhosted

60366 readers
827 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
ayyy@sh.itjust.works
curbstickle@anarchist.nexus
curbstickle_lw@lemmy.world
223
My entire production website runs on a Raspberry Pi 4B + Orange Pi Zero 3 — real traffic, public dashboard, zero cloud (feddit.it)
submitted 1 week ago by Tommy2970@feddit.it to c/selfhosted@lemmy.world
68 comments fedilink hide all child comments
 

A few months ago I decided to self-host everything for my software house instead of paying for cloud infrastructure. Here's what's running on a Raspberry Pi 4B (4GB) at home:

Astro static site + nginx Full mail stack (Postfix + Dovecot + Roundcube) in Docker MariaDB with automated backups GoAccess analytics with custom Python bot/human separation Dynamic IP blocklist generated at every deploy Certbot managed on a separate Orange Pi Zero 3 (HAProxy + SSL termination)

The Orange Pi Zero 3 as a dedicated HAProxy node was the best €25 I spent — SSL overhead completely offloaded from the Pi, all subdomains routed through one config, clean network separation between "what faces the internet" and "what runs the services." Storage: all boards boot from SSD via USB3. No SD cards in production. The ISP situation: Eolo wireless, 20Mbps down / 100Mbps upload. Yes, upload is 5x download. For a web server that's actually ideal. Real stress test — June 22, 2026 A post on r/italy hit 20k views in 24 hours. Numbers that day:

555 human visitors (vs ~180 daily average) 151 unique IPs 72.2% return rate 9.98 MB bandwidth 0 downtime 0 errors in the mail stack

PageSpeed from Google's infrastructure:

Desktop: Performance 100 / SEO 100 Mobile: Performance 97 / SEO 100

No CDN. No Cloudflare. No edge nodes. Just nginx on a Pi. The honest limitations:

Single point of failure — yes, if the Pi dies the site goes down Mail deliverability on residential ISP is hard (Brevo relay helps) No redundancy — we run backups, not replicas

All traffic data is live and public: stats.lake8.dev/geo.html Happy to answer questions on any part of the stack.

top 50 comments
sorted by: hot top controversial new old
[–] Grail@multiverse.soulism.net 17 points 6 days ago (2 children)

Why are all your comments full of em-dashes?

[–] Kazumara@discuss.tchncs.de 15 points 6 days ago* (last edited 6 days ago) (1 children)

And one even starts with:

You’re completely right

Hahaha

[–] Grail@multiverse.soulism.net 7 points 6 days ago

You're completely right — OP's comments do sound like an AI! Keep going, champ, and let U̸̡̢̖̜̬̐Ș̵̲̈̀̎̈́ know what project you'd like to work on next!

[–] Tommy2970@feddit.it 7 points 6 days ago (3 children)

Ciao! I'm Italian 🇮🇹 — my English is very "pasta asciutta" level. I use AI to help me write without saying something cosmically wrong. Sorry for that. But me and my dog are 100% real. 🐕

[–] Philippe23@lemmy.ca 2 points 6 days ago* (last edited 6 days ago) (1 children)

"My dog and I [...]" is proper English grammar.

  1. It's impolite for you to be first in the list of beings.
  2. "Me is 100% real" is wrong, it's "I am [...]"

Your AI needs a grammar upgrade. 😉

[–] Tommy2970@feddit.it 2 points 6 days ago (1 children)

My dog and I […]” is proper English grammar.

It’s impolite for you to be first in the list of beings. “Me is 100% real” is wrong, it’s “I am […]” Your AI needs a grammar upgrade. 😉 thk :-) Grammar noted and appreciated! My dog and I are 100% real. BASIC would have caught that error, but he was busy finding truffles. :-)

[–] Philippe23@lemmy.ca 3 points 6 days ago (1 children)

👍

Keep up the hard work. English is bonkers.

[–] Tommy2970@feddit.it 0 points 6 days ago

Keep up the hard work. English is bonkers.12:34Claude ha risposto:

Grazie! English is indeed bonkers. I'll stick with pasta asciutta and truffle dogs. 👍

[–] Grail@multiverse.soulism.net 2 points 6 days ago (1 children)

Ah, yeah, we don't like AI here.

[–] Tommy2970@feddit.it 4 points 6 days ago (2 children)

Ciao! I'm Italian — my English is not exactly my strongest skill. But if AI-assisted translation bothers you, I can always switch to Google Translate 😊 Hope that's reassuring enough.

[–] Brownie@lemmy.zip 5 points 6 days ago (1 children)

Ah, yeah, we don't like Google here either.

[–] Tommy2970@feddit.it 5 points 6 days ago (1 children)

Ah, yeah, we don’t like Google here either. Ciao! At this rate I'll have to rewrite everything in carrier pigeons. :-)

[–] Brownie@lemmy.zip 4 points 6 days ago (1 children)

The Lemmy council approves

[–] Tommy2970@feddit.it 2 points 6 days ago

Honored. 🙏

[–] BakedCatboy@lemmy.ml 4 points 6 days ago (1 children)

Yeah Google translate preserves a lot more of your communication style. AI overuses so many phrases it can get annoying reading something that was processed through it.

[–] Tommy2970@feddit.it -1 points 6 days ago (1 children)

Ciao! Fair enough. Though 200 people seemed to understand my AI-assisted English just fine — maybe the issue isn't the language. 😄

[–] BakedCatboy@lemmy.ml 3 points 6 days ago* (last edited 6 days ago) (2 children)

To re-state, it's not a problem of understanding or the language, it's a problem with overused, bland, and repetitive language and phrasing. It's not fun to read even if you can understand it perfectly.

Just because 200 people understood your post doesn't mean it isn't annoying to read. And it's a super simple thing to fix - don't use AI to rewrite your post and just use a normal translator instead, which won't inject bland and repetitive phrases and structures.

[–] bandwidthcrisis@lemmy.world 1 points 5 days ago

Such as groups of 3 phrases

No CDN. No Cloudflare. No edge nodes.

It reads like a slick marketing pitch.

[–] Tommy2970@feddit.it 2 points 6 days ago

You're right, and that's a fair criticism. I'll use a plain translator next time. Thanks for pushing back on it.

[–] frongt@lemmy.zip 0 points 6 days ago (1 children)

The AI is writing for you. None of your words are coming through. While I'm sure that Google translate runs on AI these days, it's miles better than chatgpt.

Even if your English is terrible, I'd still rather read broken English than AI slop. (Or you can post the short top-line summary in English and the rest in Italian, or even just the whole thing in Italian; this isn't an english-only community!)

[–] Tommy2970@feddit.it 5 points 6 days ago

Ciao, messaggio ricevuto. La prossima volta preparerò il post appositamente per te. Se mi mandi le specifiche IEEE ti prometto che farò del mio meglio per rispettarle. Buona serata.

[–] Tommy2970@feddit.it 11 points 6 days ago (1 children)

This is BASIC — my Lagotto Romagnolo. Official lake8.dev mascot and uptime monitor. He also finds truffles. 😍

[–] x00z@lemmy.world 3 points 6 days ago (1 children)

How did you get him to find truffles? :O

[–] Tommy2970@feddit.it 7 points 6 days ago (1 children)

He's a Lagotto Romagnolo — a breed selected for centuries specifically for truffle hunting. It's literally in his DNA. Training starts as a puppy: you hide small pieces of truffle in the garden and let him find them. Now the only way to make him truly happy is to let him run free in the woods — and you run behind him 😄 When he finds one, he expects a proper reward. I'm from Bologna, so his payment is a tortellino per truffle. Fair trade. 😁

[–] irmadlad@lemmy.world 5 points 6 days ago (1 children)

tortellino per truffle

Hell, I'll find you truffles if you feed me that. LOL

[–] Tommy2970@feddit.it 5 points 6 days ago

Deal! Work hard, find truffles, get tortellini con burro e tartufo. Best salary package in the industry. 😀

[–] Tommy2970@feddit.it 9 points 6 days ago

Here's my "cloud infrastructure" Air conditioning — NO Sterile environment — NO Dedicated server room — NO Enterprise-grade monitoring — is BASIC (BASIC is my Lagotto Romagnolo. He checks uptime personally.)

[–] Tommy2970@feddit.it 2 points 5 days ago* (last edited 5 days ago)

also, if someone have a technical article or white paper and want to share - we have a contribute page on https://lake8.dev/contribute/contribute/ how it works: you send, we read, we write back with technical notes (good and bad, honest). if you ok with feedback we publish. if not, no problem, we delete. is free, is honest, no marketing 🐕 https://lake8.dev/contribute/contribute/

[–] SwissOS@sh.itjust.works 4 points 6 days ago (1 children)

Sounds great! Is there an easy to follow/understand tutorial on setting up HAProxy node?

[–] Tommy2970@feddit.it 2 points 6 days ago

Ciao! I don't have a tutorial yet, but it's on my list — actually, this question is a good motivation to write one! 😄 The short version: HAProxy on Orange Pi Zero 3 (Armbian), Certbot for SSL, reverse proxy to Raspberry Pi 4B behind NAT. The trickiest part is the ACL rules for multiple subdomains and the certificate renewal hook. I'll write a proper post about it on lake8.dev — I'll mention it here when it's ready.

[–] confusedpuppy@lemmy.dbzer0.com 3 points 6 days ago (1 children)

For the past year I've been learning to self host minimally on a used Raspberry Pi 5. I do have a Pi 4 as well but that's dedicated to HomeAssistant for the small handful of lights and switches it controls.

Both Pi's run Alpine Linux with Podman containers. For my Pi 5 server it runs Caddy as my reverse proxy/SSL cert handler plus another contained for Kiwix. It's super simple. Caddy also has a basic file server for me to host my git repositories as well as hosting my static site.

The static site is based off a script I found called BashWrite but it hasn't been updated in a year so I decided to add some of my own changes to it here. I also fixed up some of the English grammar since the original creater wasn't an English native speaker.

I'm still focusing on the background stuff but I've put a lot of effort into security and hardening. I've written all the maintenance (backup, keep-alive, updating) myself using POSIX portable scripts which can all be found on my codeberg page. It's been a long process but I'm nearly there. I just have to switch from iptables to nftables and add secrets to my Caddyfile configuration to hide important keys that are currently sitting as plain text. After that I can focus on my blog/static site.

Since I'm not doing this for a business, I've decided to use a wildcard domain for my SSL cert plus an uncommon port as a low effort way to hide myself from bots/scraper. Also I set up Wireguard infront of my SSH connection to also hide from bots. My log activity only shows my own activity which is comforting to know, especially since I've seen just how active bots and scrapers are in comparison to a year ago when I was just getting started and beginning to learn things.

It's really cool to see another minimal project like this and I think it's refreshing to see. A lot of the times I see people with dozens on intensive services running and I feel a bit out of place with my scaled down self hosted project.

My only question about your setup is about HAproxy. How important is a load balancer for your site? I don't think I will need one for myself since the traffic will mostly be for myself and a few people I know personally but I am still curious about how it works and how effective it is for your setup.

[–] Tommy2970@feddit.it 1 points 6 days ago (1 children)

Ciao! Really enjoyed reading about your setup — Alpine + Podman is a great minimal choice, and the Wireguard-in-front-of-SSH approach is elegant. On HAProxy: for my use case it's not really a load balancer — it's a reverse proxy and SSL termination point running on a separate board (Orange Pi Zero 3). The main reason is architectural: it sits in front of everything, handles Certbot renewals, and routes traffic to the Raspberry Pi 4B behind NAT. If one board needs maintenance, the other keeps running. For a personal setup with low traffic, you honestly don't need it. Caddy already does what HAProxy does for me, and with less configuration. Your setup sounds cleaner for what you need. One thing I noticed we share: the bot/scraper problem is real. My public dashboard shows 6400+ attacks in 17 days vs ~4500 legitimate human visits. The uncommon port trick is underrated. 😄

confusedpuppy @lemmy.dbzer0.com to Selfhosted@lemmy.world • My entire production website runs on a Raspberry Pi 4B + Orange Pi Zero 3 — real traffic, public dashboard, zero cloud English For the past year I’ve been learning to self host minimally on a used Raspberry Pi 5. I do have a Pi 4 as well but that’s dedicated to HomeAssistant for the small handful of lights and switches it controls.

Both Pi’s run Alpine Linux with Podman containers. For my Pi 5 server it runs Caddy as my reverse proxy/SSL cert handler plus another contained for Kiwix. It’s super simple. Caddy also has a basic file server for me to host my git repositories as well as hosting my static site.

The static site is based off a script I found called BashWrite but it hasn’t been updated in a year so I decided to add some of my own changes to it here. I also fixed up some of the English grammar since the original creater wasn’t an English native speaker.

I’m still focusing on the background stuff but I’ve put a lot of effort into security and hardening. I’ve written all the maintenance (backup, keep-alive, updating) myself using POSIX portable scripts which can all be found on my codeberg page. It’s been a long process but I’m nearly there. I just have to switch from iptables to nftables and add secrets to my Caddyfile configuration to hide important keys that are currently sitting as plain text. After that I can focus on my blog/static site.

Since I’m not doing this for a business, I’ve decided to use a wildcard domain for my SSL cert plus an uncommon port as a low effort way to hide myself from bots/scraper. Also I set up Wireguard infront of my SSH connection to also hide from bots. My log activity only shows my own activity which is comforting to know, especially since I’ve seen just how active bots and scrapers are in comparison to a year ago when I was just getting started and beginning to learn things.

It’s really cool to see another minimal project like this and I think it’s refreshing to see. A lot of the times I see people with dozens on intensive services running and I feel a bit out of place with my scaled down self hosted project.

My only question about your setup is about HAproxy. How important is a load balancer for your site? I don’t think I will need one for myself since the traffic will mostly be for myself and a few people I know personally but I am still curious about how it works and how effective it is for your setup.

Body

[–] confusedpuppy@lemmy.dbzer0.com 1 points 6 days ago (1 children)

Aaah that's good to know. I've seen HAproxy mentioned before and this was the first time I looked at it.

I am happy I went with Caddy because networking is not my strength and Caddy is quite simple in comparison to other reverse proxies. Nginx config files will forever look like scribbles to me.

I don't know about the limitations of using an uncommom port though because my needs are quite small and obscure by design. I do wonder if other people could benefit from using wildcard certs + uncommon ports. Watching bots/scrapers drop to zero attempts and stay zero has been really satisfying and I haven't had the desire to use outside services like Anubis or Cloudflare.

I know someone out there with itchy fingers is ready to warn that obscurity isn't security and I wouldn't deny that. However, I do believe obscurity layered with security is valid as long as security takes the main focus.

[–] Tommy2970@feddit.it 1 points 6 days ago

Caddy is a great choice for exactly that reason — it gets out of your way. HAProxy gives me more granular control but the config is definitely not for everyone. On the obscurity point: you're absolutely right, and I'd sign that statement. Obscurity alone is theater. Obscurity on top of solid security is a legitimate noise reducer. Watching bots drop to zero is genuinely satisfying — my public dashboard shows 6,400+ attack attempts in 17 days vs ~4,500 real humans. The bots are loud. The wildcard cert + uncommon port approach is underrated for small personal setups. The attack surface doesn't shrink, but the automated scanners move on and that's often enough. 😄

[–] fluckx@lemmy.world 2 points 6 days ago (1 children)

How do you enforce consistent backups of the database? Do you dump the data periodically? Copying the data on the docker volume won't give you consistent ( and possibly corrupted ) backups IIRC if the database itself isn't stopped.

[–] Tommy2970@feddit.it 1 points 6 days ago

Good catch! But actually our site has no database — it's built with Astro, everything is MDX compiled to pure static HTML. Nothing to corrupt there 😄 For the rest (MariaDB for our products, configs, data) we use Restic — daily backups on the Orange Pi Zero 3 with retention policy (backup + forget + prune).

[–] Decronym@lemmy.decronym.xyz 2 points 6 days ago* (last edited 5 days ago)

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

Fewer Letters More Letters
Git Popular version control system, primarily for code
ISP Internet Service Provider
NAT Network Address Translation
SSH Secure Shell for remote terminal access
VPN Virtual Private Network
VPS Virtual Private Server (opposed to shared hosting)
nginx Popular HTTP server

[Thread #29 for this comm, first seen 26th Jun 2026, 07:20] [FAQ] [Full list] [Contact] [Source code]

load more comments
view more: next ›