Topic
#self-hosting
Loot, blog posts and adjacent themes connected to this topic. Follow the tag to keep it in your orbit.
6Shown loot
4Shown articles
8Linked neighbor tags
Topic paths
If you want to go deeper, the adjacent tags are the fastest way to compare and branch into related workflows.
Loot
More from this topic
Text: AI-generated
AI-generated · Automatically published by LinkLoot. OpenXet lets you run a chunk-deduplicated Xet server so official hf and Git clients upload only changed file chunks to your own infrastructure. AI-generated: This Loot was created and published automatically by LinkLoot and was not substantively reviewed by a human editor. What it does OpenXet provides an open-source server and client implementation for the Xet protocol, which is Hugging Face's method for storing large, versioned files using content-addressable storage (CAS) with global deduplication. Instead of uploading entire files repeatedly, only modified chunks are transferred. The project currently supports Milestone M1: openxet serve runs as a local CAS that stock hfxet (version 1.7.0+) uploads to and downloads from directly. It includes verified uploads, scoped tokens, and signed download URLs. Reconstruction performance answers 100k-term file requests within 50 ms at p99 latency on an idle node, gated in CI. The system runs on local disk with a SQLite index. Future milestones will add Hub API compatibility (hf upload, huggingfacehub, Git integration) and support for S3, GCS, Azure, and Postgres backends. Who it helps Teams managing ML models or datasets who want data sovereignty without abandoning Hugging Face tooling. If you need files to stay in your bucket while identity remains in your existing login system, OpenXet bridges that gap. The goal is unmodified operation of official tools against self-hosted infrastructure. Getting started Build the openxet binary, then follow the quickstart guide at docs/quickstart-storage-only.md. Start a server instance and test uploads/downloads with hfxet or the openxet command line. The documentation covers server configuration, CLI options, exit codes, and CAS routes. Security tests document each requirement and its enforcement mechanism. Benchmarks detail the latency gate and reconstruction metrics. Note: There is no release yet. This is development-stage software. Limits and costs Current state: Storage server works; Hub API is not implemented. Only local disk with SQLite index is supported—cloud storage backends come in later milestones. No hosted service exists yet despite the openxet.com homepage reference. Apache-2.0 licensing permits commercial use but does not imply free hosting. Performance claims are from CI-gated benchmarks, not production deployments. Source links Official repository: https://github.com/stubbi/openxet Project documentation: https://github.com/stubbi/openxet/blob/main/README.md Project license: https://github.com/stubbi/openxet/blob/main/LICENSE
- LinkLoot access
- Free
- Provider costs
- Unknown
Review open
Text: AI-generated
AI-generated · Automatically published by LinkLoot. A Go server that speaks the real Xet protocol, so the standard hf CLI works against your own endpoint — with a pull-through proxy that keeps cached repos available even when huggingface.co goes down. AI-generated: This Loot was created and published automatically by LinkLoot and was not substantively reviewed by a human editor. What it does xet-server is a Go implementation of Hugging Face's Xet storage protocol, the content-defined-chunking, dedup-first layer that replaced Git LFS for large model files on the Hub. It is wire-compatible: point the real hf CLI (huggingfacehub + hfxet) at it via HFENDPOINT, and hf upload / hf download work end-to-end, producing byte-identical round-trips with genuine BLAKE3 hashing, real xorb/shard binary formats, and LZ4/byte-grouping compression. The project started as a simplified chunking demo and grew into a from-scratch, spec-driven reimplementation, verified against a live hfxet client. Several wire-format quirks were found only by capturing and replaying real client traffic (documented in docs/PROTOCOL.md). It ships two main pieces: The wire-compatible server — a CAS HTTP API (xorb upload/fetch, shard upload, file reconstruction with Range paging) plus a Hub API shim covering repo create, preupload, read/write tokens, commit, and resolve/HEAD, including independent revisions and branches per repo. xet-proxyd — a caching pull-through proxy for the real huggingface.co. This is an offline-resilience layer, not just a performance cache: any repo metadata or xorb bytes it has relayed once stay servable even after the upstream becomes unreachable, and its cache directory can be handed to a plain xetd as a permanent disconnected replacement. Storage backends are pluggable, and interactive Swagger UI docs are included. Who it helps Teams running air-gapped or bandwidth-constrained ML infrastructure who want to serve model weights through the standard toolchain without depending on Hugging Face's hosted endpoint. Also useful for anyone needing a local staging target for Xet-based workflows, or an on-prem resilience layer that survives upstream outages. Getting started Build and run the server, then set HFENDPOINT to its address and use the normal hf commands. The README walks through running the wire-compatible server, pointing the CLI at it, the Xet Data API + CLI, and xet-proxyd. A troubleshooting section covers common issues, and a "Where this diverges from real Xet" section documents known gaps. Limits and costs MIT-licensed, so source use is unrestricted, but hosting is on you — hardware, storage, and operational overhead are not covered by the license. It is a from-scratch reimplementation, so expect documented divergences from the production Xet service; review those before relying on it in critical paths. No pricing is published because there is none beyond self-hosting. Source links Official repository: https://github.com/guilt/xet-server Project documentation: https://github.com/guilt/xet-server/blob/main/README.md Project license: https://github.com/guilt/xet-server/blob/main/LICENSE.md
- LinkLoot access
- Free
- Provider costs
- Unknown
Review open
qsa.sh gives VPS and server operators a quick outside-in security scan of the public IP they are connecting from, with a free tier and paid deeper scans. qsa.sh is a practical terminal-first security checker for people who run their own servers and want a quick view of what the public internet can see. Run curl https://qsa.sh from the server you control and the service scans the public IP behind that request. The free scan covers common ports and selected vulnerability checks, then streams results back to the terminal. That makes it useful for quick VPS hygiene checks after deploying a new machine, changing firewall rules, moving behind a tunnel, or auditing a small self-hosted service. The key constraint is also the safety feature: there is no arbitrary target box. qsa.sh scans the IP that connects to it, gives a short abort window before work begins, and says it refuses common shared-network cases such as mobile-carrier, CGNAT, VPN, Tor, and proxy origins on a best-effort basis. Use it only on infrastructure you are authorized to scan. Pricing/access visible on the source page: Free: common-port live scan with naabu, nmap plus vulners, and a curated nuclei set. Full: paid monthly deeper port coverage. Deep: paid one-time full nuclei-style report. Practical use cases: Verify that a fresh VPS exposes only the services you expect. Re-check a host after changing Docker, firewall, Cloudflared, or reverse-proxy rules. Keep a lightweight manual audit step before publishing a self-hosted app. Compare the free scan with your own local nmap/nuclei workflow before paying for deeper reports. Caveats: this is not a full penetration test, the wrapper service itself is not presented as open source, and any security scan can produce false positives or miss issues. Treat the output as a fast triage signal, not as proof that a host is safe.
- LinkLoot access
- Free
- Provider costs
- Unknown
Review open
A practical self-hosting resource for exposing Docker apps inside a private Tailnet instead of opening router ports, reverse proxies, and public subdomains by default. What this is ScaleTail is a collection of ready-to-run Docker Compose stacks that attach common self-hosted apps to a Tailscale tailnet through a sidecar container. The useful idea is simple: make private tools reachable from your own devices without turning every dashboard, password vault, document archive, or admin panel into a public web service. Best use case Use this when you run services such as Vaultwarden, Paperless-ngx, Jellyfin, Immich, Pi-hole, AdGuard Home, Home Assistant, Open WebUI, Portainer, or Uptime Kuma and want remote access without a new router port, reverse-proxy rule, or public DNS entry for every app. Workflow Create a reusable Tailscale auth key in the Tailscale admin console. Pick the ScaleTail template matching your service. Review the Docker Compose file before running it, especially volumes, environment variables, and exposed ports. Bind the app container to the Tailscale sidecar network stack with the template's networkmode: service: pattern. Start the stack with Docker Compose and confirm the service appears in your Tailnet. Use Tailscale Serve for private Tailnet access. Only use Funnel when the service is intentionally public. Security notes ScaleTail reduces accidental public exposure, but it does not replace Docker hardening, backups, patching, or least-privilege access controls. Treat every template as code: inspect the image source, tags, volume mounts, environment variables, and update policy before production use. Keep admin panels, password managers, document stores, and local AI interfaces private unless you have a strong reason to expose them publicly. Do not confuse Tailscale Serve with Funnel: Serve is private to the Tailnet, while Funnel publishes a service to the public internet. Quick decision table Need Use ScaleTail? Caveat --- --- --- Private remote access to homelab apps Yes Requires Tailscale and Docker Compose Public webhook endpoint Maybe Funnel can be public; harden it carefully Full site publishing No Use a normal deployment and security model Multi-service homelab on one host Yes Still plan backups, updates, and separation Source check The Tarnkappe article explains the privacy angle, the Serve/Funnel distinction, and why ScaleTail fits self-hosted Docker services that should not be exposed publicly by default. The ScaleTail GitHub repository confirms that the project provides Docker Compose sidecar configurations for connecting self-hosted apps to a Tailnet. Tailscale's own Docker documentation provides the official baseline for running Tailscale with containers.
- LinkLoot access
- Free
- Provider costs
- Unknown
Review open
PicoClaw is a fascinating ultra-light agent project — but it is not a clean 1:1 OpenClaw replacement
No votes yet
PicoClaw offers a lightweight AI agent experience built for diverse hardware, emphasizing compact design and broad architecture support. The project highlights fast startup and flexible deployment options, making it appealing for developers targeting low-cost systems. Yes — this is worth a Loot, because the hardware and footprint story is genuinely interesting. PicoClaw makes a credible case for an ultra-light AI agent stack in Go that can run on extremely cheap hardware, with fast startup and wide architecture support. What looks genuinely strong pure Go implementation very broad platform story: RISC-V, ARM, MIPS, x86, Android claimed <10MB core footprint in early builds, though the repo also says recent builds can hit 10–20MB local launcher, Docker path, Telegram/gateway flow, and multi-provider support ambitious feature surface for such a small runtime The critical reality check The viral framing overshoots the evidence. The repo itself says: early rapid development do not deploy to production before v1.0 unresolved security issues may still exist memory usage has already drifted upward in recent builds So the real story is promising lightweight agent engineering, not a fully proven OpenClaw killer.
- LinkLoot access
- Free
- Provider costs
- Unknown
Review open
DocuSeal is an open-source e-signature option worth reviewing before renewing a commercial signing tool. It targets teams that want more control over document workflows, hosting, and long-term costs. If your team is paying DocuSign just to get PDFs signed, DocuSeal is one of the most practical open-source tools to evaluate before the next renewal cycle. DocuSign pricing and plan positioning Why DocuSeal is interesting open source and self-hostable fillable/signable PDFs with drag-and-drop fields multiple signers and signing order reminders, templates, API, webhooks, bulk send PDF signature verification and audit trail DocuSeal product preview What the sources suggest The strongest case for DocuSeal is not hype — it is the combination of: a mature GitHub repo with strong adoption real self-hosting support via Docker developer-first features like API, embedded signing, and webhooks user testimonials explicitly comparing it favorably to DocuSign and PandaDoc
- LinkLoot access
- Free
- Provider costs
- Unknown
Review open
Blog
Related reads
Tools & Apps
Collabora Built-in CODE Server flaw is exploited; CISA sets Oct 26 patch deadline
CISA added CVE-2026-110447 to its exploited-vulnerabilities catalog: an unauthenticated OS command injection in the Collabora Online Built-i…
Tools & Apps
Supabase self-hosted installs move from Kong to Envoy in August
Supabase will make Envoy the default API gateway for self-hosted Docker installs in the week of August 9, 2026, with compatibility paths for…
Tools & Apps
Containarium puts a self-hosted, MCP-native sandbox in front of AI coding agents
Containarium is a fresh open-source option for teams that want isolated Linux sandboxes for Claude Code, Cursor, and other MCP-capable agent…
Deals & Freebies
N8Nitro’s Dealify lifetime deal is a practical shortcut for self-hosted n8n teams
N8Nitro is currently pitched on Dealify as a one-time purchase for teams that want isolated n8n instances, autoscaling, monitoring, and less…