A useful self-hosted starter kit is not “fifty Compose files from Reddit.” It is ten apps that cover daily jobs—photos, files, passwords, analytics, docs, git, DNS filtering, a dashboard, optional media, and a private AI chat—without requiring a Kubernetes thesis on Saturday morning.
Weekend success depends on saying no. Skip high-maintenance chat federations, giant monitoring stacks, and anything you cannot back up before Monday. If an app does not have a clear restore path, it does not belong in round one.
This list assumes Docker Compose on a single well-backed-up machine or VPS, reverse proxy with TLS, and offline copies of vault and identity recovery material. Read when self-hosting is worth it if you are doing this for a company rather than a household.
Key takeaways
- Ship a reverse proxy + TLS + automated backups before app #1 feels “done.”
- Vaultwarden and Immich/Nextcloud deliver the fastest quality-of-life wins.
- Pick Umami or Plausible CE for analytics—defer Matomo until you need depth.
- Forgejo/Gitea beats “git on bare SSH” once you want PRs and mirrors.
- Homarr/Dashy only help after you have URLs worth bookmarking.
- Jellyfin is optional; Open WebUI is optional—add them after restores work.
Weekend ground rules
- One host, one Compose project layout, one proxy (Caddy/Traefik/Nginx Proxy Manager).
- Snapshots or borg/restic before every major change; test one restore Sunday night.
- Put Vaultwarden and recovery codes on a path that survives disk death.
- Do not expose admin UIs without SSO or at least fail2ban/VPN discipline.
- Write a 20-line runbook: where Compose lives, how to update, where backups go.
The 10-app kit
| # | App | Job | Notes |
|---|---|---|---|
| 1 | Vaultwarden | Passwords | Do this first; clients already exist on every device |
| 2 | Immich | Photos | Google Photos-shaped; GPU optional; storage hungry |
| 3 | Nextcloud | Files | Drive/calendar; heavier than Immich—still worth it |
| 4 | Umami or Plausible | Analytics | Umami easiest self-host; Plausible CE richer but heavier |
| 5 | Paperless-ngx | Documents | Inbox → OCR → searchable archive |
| 6 | Forgejo or Gitea | Git | PRs, mirrors, actions-light workflows |
| 7 | AdGuard Home or Pi-hole | DNS filter | Network-wide blocking; pair with careful allowlists |
| 8 | Homarr or Dashy | Dashboard | Launcher for your new URLs |
| 9 | Open WebUI | Private AI chat | Needs Ollama or API keys; not an IDE agent |
| 10 | Jellyfin (optional) | Media | Skip if you lack a library or bandwidth |
1–3: Vaultwarden, Immich, Nextcloud
Vaultwarden
Open in catalogRemoves shared-password chaos with a Bitwarden-compatible server. Strengths: immediate daily use and familiar clients. Limits: you own vault database backups—lose them and you lose the keys. Do this first in the kit.
- Best for
- Households and small teams fixing password anti-patterns.
- Deployment
- Docker Compose behind TLS.
- Pricing
- Open-source; cost is storage + electricity/VPS.
- Unique
- Highest weekend ROI security win.
Immich
Open in catalogTakes over phone photo backup with a modern Google Photos-shaped UI. Strengths: immediate daily use. Limits: storage hungry; do not run without backup budgets. Migrate photos in batches.
- Best for
- Households leaving Google Photos defaults.
- Deployment
- Docker Compose behind TLS.
- Pricing
- Open-source; cost is storage + electricity/VPS.
- Unique
- Fast quality-of-life photos win.
Nextcloud
Open in catalogHandles documents and sharing as a Drive-shaped suite. Strengths: files, calendars, and sharing under your control. Limits: heavier than Immich—still worth it; needs upgrade attention and backup budgets. Migrate files by project folder, not a blind rsync of junk.
- Best for
- Households and small teams leaving Google Drive defaults.
- Deployment
- Docker Compose behind TLS.
- Pricing
- Open-source; cost is storage + electricity/VPS.
- Unique
- Drive/calendar system of record for the kit.
4–5: Analytics and Paperless-ngx
Umami
Open in catalogLow-friction pageview stack on Node/PostgreSQL. Strengths: easiest self-host analytics in the kit. Limits: will not match GA marketing features. Pair with a written retention note even at home.
- Best for
- People who want privacy-friendly metrics.
- Deployment
- Self-hosted containers.
- Pricing
- Open-source.
- Unique
- Easiest analytics self-host in the kit.
Plausible
Open in catalogPolished privacy analytics UI; Plausible CE fits if you accept a heavier footprint. Limits: heavier than Umami; hosted Plausible remains a paid alternative if ops hurt.
- Deployment
- Self-hosted containers or paid hosted.
- Pricing
- Open-source; hosted plans paid.
- Unique
- Polished privacy analytics option.
Paperless-ngx
Open in catalogTurns PDFs and scans into a searchable archive with OCR—ideal for invoices and household admin. Limits: needs a clear consume folder discipline or it becomes another junk drawer.
- Best for
- People who want searchable household/business documents.
- Deployment
- Self-hosted containers.
- Pricing
- Open-source.
- Unique
- Inbox → OCR → searchable archive.
6–8: Forgejo/Gitea, DNS filter, dashboard
Forgejo
Open in catalogPRs, issues, and mirrors without depending on a single forge. Strengths: sticky git habit once configured. Limits: pick one forge and move on—forge hopping wastes weekends.
- Best for
- Builders who want self-hosted git with PRs.
- Deployment
- LAN/VPS services.
- Pricing
- Open-source and free to run.
- Unique
- Self-hosted forge with PRs and mirrors.
Gitea
Open in catalogAlternative self-hosted forge with PRs, issues, and mirrors. Strengths: mature packaging paths. Limits: pick Forgejo or Gitea—do not run both as primary.
- Best for
- Builders comparing forge options.
- Deployment
- LAN/VPS services.
- Pricing
- Open-source and free to run.
- Unique
- Credible Forgejo peer for self-hosted git.
AdGuard Home
Open in catalogNetwork-wide DNS filtering—powerful, easy to misconfigure, and worth a careful allowlist for work domains. Limits: can break captive portals and some SaaS apps.
- Best for
- Homelabs wanting network-wide DNS filtering.
- Deployment
- LAN gateway path.
- Pricing
- Open-source and free to run.
- Unique
- DNS filter with careful allowlists.
Pi-hole
Open in catalogClassic network-wide DNS blocker. Strengths: well-known ops patterns. Limits: same allowlist discipline as AdGuard Home.
- Best for
- Homelabs preferring Pi-hole’s ecosystem.
- Deployment
- LAN gateway path.
- Pricing
- Open-source and free to run.
- Unique
- Classic DNS filter option.
Homarr
Open in catalogBookmark homepage / dashboard for the URLs you just deployed. Limits: goes stale if you do not prune tiles.
- Best for
- Builders who want one launcher for new services.
- Deployment
- LAN/VPS services.
- Pricing
- Open-source and free to run.
- Unique
- Dashboard after you have URLs worth bookmarking.
Dashy
Open in catalogAlternative dashboard/launcher for self-hosted URLs. Limits: prune tiles or it goes stale.
- Best for
- Builders comparing dashboard options.
- Deployment
- LAN/VPS services.
- Pricing
- Open-source and free to run.
- Unique
- Homarr peer for service launchers.
9–10: Open WebUI and optional Jellyfin
Open WebUI
Open in catalogChatGPT-like frontend over Ollama or hosted APIs—great for private Q&A, not a Cursor replacement. Limits: LLMs need RAM/GPU realism. Add only after the first eight apps survive a reboot and a restore test.
- Best for
- Users who want private AI chat.
- Deployment
- Self-hosted; models/API costs separate.
- Pricing
- Open-source core; hardware is the real bill.
- Unique
- Optional private AI chat layer.
Jellyfin
Open in catalogPersonal media streaming when you actually have a library. Limits: storage creep and remote-access risk. Skip if you lack a library or bandwidth.
- Best for
- Users who want home media streaming.
- Deployment
- Self-hosted.
- Pricing
- Open-source; hardware/storage is the bill.
- Unique
- Optional media layer—do not block the weekend on it.
Migration tips that prevent Monday regrets
- Photos: enable Immich mobile backup alongside Google Photos for two weeks before deletion.
- Files: move active projects to Nextcloud first; archive cold data to plain object storage/ZFS datasets.
- Passwords: import into Vaultwarden, verify MFA codes, only then disable the old manager.
- DNS: run AdGuard/Pi-hole in parallel with an easy bypass path for guests.
- Git: mirror important repos to Forgejo before making it primary.
- Updates: Watchtower-everywhere is how you earn surprise breakages—update deliberately.
Frequently asked questions
- What hardware do I need?
- A quiet NAS/mini-PC with plenty of disk for Immich/Nextcloud, or a mid-size EU VPS if you only run vault, git, analytics, and dashboards. Photos and media dominate storage; everything else is mostly CPU/RAM for databases and OCR.
- Is this kit enough for a small company?
- It is a start for secrets, files, and git—but companies should add SSO (Keycloak/authentik), logging, and named on-call before calling it production. Read the GDPR/NIS2 stack guide and the self-hosting decision framework.
- Umami or Plausible?
- Umami if you want the easiest self-host on PostgreSQL. Plausible if you prefer its UI and accept a heavier stack—or just pay for Plausible Cloud. Matomo waits until you need GA-like depth.
- Forgejo or Gitea?
- Both are credible. Pick one, mirror remotes, and move on—forge hopping wastes weekends. Favor the community and packaging path you are willing to follow for upgrades.
- What should I skip in weekend one?
- Full Matrix federation, Kubernetes, elaborate SIEM stacks, and exposing every admin port to the internet. Earn boring backups first.
Conclusion
Ten apps are enough to feel the benefits of self-hosting without drowning in maintenance. Sequence for dependency and risk: vault and proxy first, photos/files second, analytics and documents third, git and DNS fourth, dashboard next, AI/media last.
If Monday arrives and restores work, you won the weekend. If you only have screenshots and no backups, you built a museum exhibit—not a kit.
Build a stack for this use case.
Answer nine practical questions and compare three transparent architectures with costs, free limits, lock-in, and migration paths.
Build my stack
