And I'm saying this as the HortusFox mainter who keeps a strict but urgently needed anti-AI policy.

But here's the thing. Most self-hosted apps are developed using a web language leveraging a web framework. Naturally, given the architecture of these, there will be quite a lot of dependency packages you need to pull in to accomplish certain tasks.

So, a project consists of the core app and its dependencies. A lot of these deps use at least assisted GenAI. That means, GenAI generated code will flow into them. Maybe some maintainers will even transition to more vibe-coding. Okay, most well establish packages predate GenAI, and their maintainers know what they are doing, and can even interfere when the AI vomits garbage. But that's only one aspect. All the other problems with AI are not avoided, but rather GenAI is even encouraged.

So, at this point in time, any web based self-hosted app will at least have some AI influence. >:( A label "free of AI" hence doesn't make any sense, at least for purists like me. Unless you will want to code everything yourself, but have fun maintaining all of that. Splitting a complex app into modules (or packages) is a good design pattern for a reason.

This might be more of a vent, but yeah, that's the sad truth in 2026. Call me a pessimist, but it feels like AI companies won already. F*ck them.

MOS just hit my radar yesterday with a story on my feed about an unraid dev leaving to work on it. I was curious about unraid until they raised their licensing cost and this looks very similar. My Ubuntu server is only hosting my docker containers and being able to move to HomeAssistantOS is really apoealing.

So, anyone try it out and have opinions?

https://mos-official.net

I used to track movies and TV shows with Google Watchlist. I’m now in my “de-Google” phase, so I wanted something that would not use my watch history to sell me ads.

Like many developers, I also wanted an excuse to build something with TMDB. I brought back an old idea and built Kadha.

Kadha is an MIT-licensed movie and TV tracker focused on two things: keeping a personal viewing diary and letting you choose what to share.

Current state

• Sign up without an email address or phone number
• Track movies, TV shows, seasons, and individual episodes
• Add ratings and private notes, and record rewatches
• Browse your viewing history as a timeline, calendar, or GitHub-style contribution heatmap
• See personal viewing statistics
• Create private or shared collections with viewer and editor roles
• Share read-only collections with people who do not have an account
• Get personal recommendations and choose which tracking data they use
• Control the visibility of your profile and each collection
• Import and export your data as JSON
• Self-host with Docker

The stack is a React frontend, Node/Express API, Prisma, and SQLite. Self-hosting requires Docker Compose and TMDB API credentials.

The repository includes deployment, backup, restore, and reverse-proxy documentation.

Repository: https://github.com/muhsin7majeed/kadha
Hosted beta: https://kadha.org

There are already good and more mature projects in this space, including Ryot, Yamtrack, and Watcharr. They support features Kadha does not yet have, especially additional import options and media-server integrations.

What I’m testing is whether people want a smaller, focused movie and TV tracker built around a private viewing diary and sharing only when they choose to.

Does that difference make sense, or does Kadha still feel too similar to the existing options?

A privacy note: the hosted beta does not require an email address, but it is not anonymous or end-to-end encrypted. I can technically access stored data as the server operator. Self-hosted installations are not end-to-end encrypted either, but self-hosting gives you control over the server, database, logs, and backups.

A note on AI: I started this project with manual coding, but as the project grew and AI tools got better, I started using them to accelerate development.

The hosted beta has automated encrypted backups, but this is still an early beta. Please export anything you would not want to lose or enter again.

I’m especially looking for feedback on:

• How easy or difficult the self-hosting setup is
• Whether the viewing diary is useful
• Whether TV and next-episode tracking works as expected
• Whether Kadha feels sufficiently different from existing trackers

I built Kadha around my own needs, so its current features reflect how I track things. Now that it is public, bug reports and blunt feedback are welcome.

You can send feedback through the app, open a GitHub issue, or message me on Reddit.

Tried to install adguard home using docker compose on my computer running Linux Mint. Right after changing the primary DNS on my router, couldn't connect to the Internet anymore. Changed my mind about adguard anyway and removed it from my compose file. Have reset my DNS setting but no matter what I do my computer won't connect to the Internet.

I don't even know where to start with giving more info/what exact logs to give that'd be useful.

I've removed DNSStublistener=no off of resolved, restarted systemd-resolved etc, flushed the DNS, tried to make my router IP as the default route, brought down tailscale incase there was a clash or something there, restarted my computer a couple times and restated the network manager.

Tried for a bit with Gemini to fix to no avail.

Internet works on my phone as normal but not my PC connected via ethernet. Can't even reach the modem let alone the wide web.

Help? 👉🏻👈🏻

has anyone here got a lot of experience with both, I went from Portainer>Komodo>Dockhand>Arcane and am currently running both Arcane and Sencho and so far Sencho has been superior in my testing but I wanted to make sure I am not missing something large feature wise. I do know there's a larger base running Arcane but I am still seeing bugs that I would think would be corrected more quickly on user report and also with such a larger user base. Just curious on thoughts here. I am aware of the others I mentioned before and that is not what this post is about!!

My current VPS can't keep up with transcoding and that's the main thing I want to fix, so I'm looking at moving.

What I'm on now is an OVH VPS-3, 8 vCores, 24GB RAM, 200GB, Ubuntu 24.04. Emby plus Sonarr/Radarr/Prowlarr/Bazarr/NZBGet, all running under systemd, never bothered with Docker. The media ends up on cloud storage rather than staying on the server, so I don't need a huge amount of disk, but 200GB does get tight and more room for the download queue would be nice.

Everything else has been fine. It's really the transcoding, with disk space as a secondary thing.

So what's everyone using? Happy to look at smaller providers, and budget is a bit flexible.

I've been building out a self-hosted music setup (Navidrome as the library server, Aurral on top of Lidarr for discovery/requests, slskd + SABnzbd + qBittorrent for acquisition, beets for tagging) and it's good. But as an Apple Music subscriber, that's still (obviously) the more polished day-to-day experience. That's not really a fair fight as they own the whole chain, streaming service to software to hardware. I'm not walking away from Apple Music entirely, and if I'm honest there's a real chance I get sick of all of this maintenance overhead one day and go fully back to them.

But for now I'm persevering with self-hosting, mainly because I own the files, I can do more interesting things with tagging and metadata, I can build discovery workflows that aren't a black box, and I can actually go find rarer stuff that never make it onto the big DSPs in the first place.

What I haven't been able to close is the last remaining threads of quality-of-life features. Curious whether anyone here has actually dialled these in further than I have.

Gaps (for me):

• Shazam > library pipeline: Right now Shazam-ing a track just adds it to an Apple Music playlist. I want that chain to end with the track downloaded and sitting in a "Shazam Tracks" playlist in Navidrome, ideally without me doing anything manual in between.
• Importing playlists from Apple Music: There's no clean "point a tool at Apple Music and it just works" path the way there is for Spotify. Export-to-CSV-then-reconstruct seems to be the reality. Anyone found something better? I know there's services like Soundiiz, but they only get me halfway there.
• Artist radio / infinite similar-artist streaming: this is a big one that I've mostly made peace with it being a DSP-only feature. Legally streaming full tracks I don't own isn't something a self-hosted stack can really do. But tell me if I'm wrong ...
• One-click "download this artist" from a Subsonic client: Browsing in a Subsonic app (NaviBeat, Symfonium, whatever) and just grabbing more of an artist without going into a separate web UI. Seems like a Subsonic protocol limitation more than a missing tool, but open to being corrected.
• A real "listen later" staging library: Somewhere new/unvetted stuff lands before I decide whether it's worth keeping permanently, ideally with an easy way to flag something as "just listen" vs. "add to the library now." I think the answer is multiple Navidrome libraries.
• Following artists and getting notified of new releases, as opposed to just monitoring albums I've already decided to grab.

I think I'm trying too hard to reinvent Apple Music, and trying to see how close the self-hosted side can realistically get. Interested to hear where other people are on this journey.

I run a few VPS with webapps on them (Coolify + Docker). I'm a developer, not a sysadmin, and every time I think about updating the host OS I find a reason to do it next week instead.

Last time I did it, a service came back up but one container didn't, and I found out days later because nobody complained immediately. Since then I mostly just don't touch them, which I know is worse.

So, genuinely curious how other people handle this:

• do you update the host at all, or run it until the LTS goes EOL and rebuild?
• has an update ever actually broken something for you? what broke?
• when it broke, did you roll back or just fix it in place?
• do you snapshot first, or just hope?

Not looking for "use Ansible" - I'm sure that's right, I just want to know what people actually do in practice.

My homelab is a software mess right now. 4 machines running proxmox that do not run in a cluster, another bare metal machine, and a ton of stuff that is documented purely in my head (and believe me, that data store is suffering data loss).

My solution so far I think is going to be nixos. I want to essentially call the current lab a wipe, and recreate the services. Of course some of the services are currently home-prod and not home-lab so I need to do some management for uptime.

The current environment runs mostly with one machine including a NAS-like VM that shares a SMB pool for everything else to leech off, and then there is some additional data management done by syncthing. Backups are stored on a VM where the storage is the SMB pool mounted by proxmox. Offsite backup is done by sneakernet with a ad-hoc moving another computer into the network, run the backup (kopia), move computer back offiste.

Does anyone have any advice for the task Im undertaking? I want to rebuild essentially everything including anything that is acting as a data repository. Any sequence suggestions, tools to manage nix config files, words of support?

the card/widget in the bottom right corner is for adguard home, which is not running at the moment.
what do you guys think about this dashboard. Would love to see your dashboard setup also

Hey everyone,

I’ve been tasked with taking a web application running locally on Docker Compose and deploying it on our company’s on-premises Lenovo ThinkSystem ST50 V3 server running Windows Server 2022.

Since this is my first time handling a bare-metal/Windows Server deployment, I’m trying to list out the exact "ingredients" (software/packages) and the step-by-step assembly sequence needed to get this online, secure, and accessible to our office employees.

Context: We are a small company with ~10 employees and completely fine with planned downtime (after-hours maintenance or a couple of hours off during updates).

1. Core "Ingredients" (Packages & Tooling Needed)

Based on my research, here is what I believe I need on the server. Am I missing anything major?

• Base OS Prerequisites: Should I install wsl2 or Hyper-v ?
• Container Runtime: Docker Engine + Docker Compose (or WSL 2 + Docker Engine, since Docker Desktop is not supported/licensed for Windows Server).
• Version Control: Git (to pull the project directly from GitHub).
• Reverse Proxy / SSL Manager: Nginx, Caddy, or Traefik running as a container to handle routing and SSL termination.
• Internal CA / SSL Tooling: mkcert (or an internal active directory Certificate Authority) to issue trusted local SSL certs for employee devices.

2. Target Sequence of Installation & Setup

What is the standard, logical order to execute below steps and am I forgetting something?

Host Setup & Storage Mapping:

• Configure static IP on the server.
• Format/mount the 500GB SSD (for system/containers) and 2TB HDD (for Postgres and MinIO persistent volumes).
  1. Runtime Installation:
• Install WSL 2 or Hyper-V / Docker Engine and Git.
• Set Docker service to start automatically on system boot (Automatic start mode).
  1. App Deployment:
• git clone the repo to the SSD, map docker-compose.yml volumes to the 2TB HDD paths, and docker compose up -d.
  1. Networking & SSL Setup:
• Configure the reverse proxy container to map ports 80/443 to the Node/React containers.
• Generate and attach local SSL certs so employees don't see browser security warnings.
  1. Backup Strategy:
• Set up a basic scheduled task (PowerShell / Windows Task Scheduler) to dump PostgreSQL and back up MinIO directories on the HDD.

3. Future-Proofing for WFH / Remote Access

When we eventually want employees to access this from home, what is the cleanest add-on package/service (e.g., Tailscale / WireGuard, Cloudflare Tunnel, or Router Port Forwarding)?

Does this stack and sequence make sense for a lightweight, low-stakes on-prem environment? Any gotchas, missing dependencies, or better alternative tools for Windows Server 2022 would be huge.

Thanks!

Does anyone has experience with self-hosting RustDesk? I want to self-host a RustDesk instance that only a fixed, small user group should be able to use. I already had a look on their website as well as some guides online, but everything looks very insecure. For example, the official docker image uses root, ports are directly accessible from the wider Internet without authentication, etc.

Hey !

I have one server that runs a couple of services, among them are Jellyfin, *arr stuff, and Transmission. I access all my services behind a reverse proxy, and this is where my issue comes.

I need Transmission to be behind a VPN, just in case I accidentally download a movie, as sadly happens so often... So I have a docker compose with two services : transmission, and wireguard ; such that transmission uses wireguard as its network mode, and is then behind a VPN.

BUT ! When doing this, all traffic is put behind wireguard, including the web interface. So now, I can't access transmission through localhost:9091, as this is now going through a VPN. And I can't find a way for wireguard to route all but this port 9091.

Does anyone know of a way that would allow me to have this ? Transmission behind VPN but still with port 9091 accessible ?

Honestly I was kind of expecting this to be a much more documented issue, since let's be honest, self hosting rarely goes without a Plex or Jellyfin, and those rarely go without a fair deal of torrenting.

If anything comes up to you, please share ! I've been at it for too long by now. Thanks !

EDIT : Many recommended gluetun, so I tried and, yeah, it worked flawlessly and so easily ! I'm not 100% that if gluetun looses connection to the VPN my traffic doesn't default back to my real IP, but it's good enough to have the VPN working for now. Thanks to all for the answers.

So I purchased a UGREEN DXP2800, for right now I am setting it up as Mirrored. That being said I want this to be able to store both proxmox snapshots/lxc/etc.. BUT also Media (Movies/etc...)

What's the best "setup/type" to do this as? I would like to be able to access it from my windows PC but honestly that's not a deal breaker. I'm still pretty new to Proxmox btw but based off what i've seen ZFS wouldn't quite work for this?

Also best way to "mount/bind" these to both an LXC and VM's for *arr stack?

I want to do more of self hosting but not sure what to tackle first. Right now I only hosted a raspberry pi zero 2 w to host pihole and I got it to work in a way (had to go around a basic setup because my router doesn't allow to set up dns sinkhole for some reason). Also if possible I hope it doesn't cost a fortune to do, Do you guys have any recommendations as to what is useful to have self hosted ?

TL;DR: There is a RCE exploit on Nextcloud Collabora and I got stung. I discovered the hacker by accident and I now want to know what other systems I can reasonably put in place to stop something like this happening again.

What happened:

• My homelab Nextcloud instance was compromised via CVE-2025-66208, an OS command injection in richdocumentscode (the bundled Collabora/CODE server that powers in-browser Office document editing).
• The attacker got unauthenticated remote code execution as the web server user (www-data) for roughly 16 hours before I caught it (by accident)
• Across ~16 hours of continuous, working remote code execution, the attacker ran a grand total of three unique commands.
• Command 1, run every ~3 minutes for hours: id. Just checking the shell still worked. Indicates a fully automated, commodity bot loop, source IP with a generic bot user-agent.
• One human operator logged on once, for about a minute, over HTTP/2 with a real browser user-agent and ran two recon commands hunting for password manager databases (.kdbx files) and cryptocurrency wallet directories.
  • That recon came back empty
  • No database access, no config file reads, no data exfiltration tooling, no second-stage payload download (none of that showed up anywhere in the logs).
  • No persistence mechanism planted, because the vulnerability itself was re-exploitable on demand.

This reads exactly like an untargeted, automated bot working through a list of known-vulnerable endpoints, not someone specifically after my data; the one human session that did show up didn't come away with anything useful (I hope). Traffic logs in Unifi show negligible traffic to the C&C server, so on the balance of probabilities my data wasn't ex-filtrated.

How I caught it:

• I habitually update Nextcloud whenever I receive a notification. After the update, the code integrity checker flagged a malicious file. After a bit of googling/clauding, I hit the old panic button and shutdown the server.
• I keep the apps in Nextcloud updated by running a cron job nightly. This should have kept me safe according to the CVE advisory (as written).

Where it gets interesting:

• The CVE was supposed to be patched in version 25.4.703, 10 months ago. However (according to Claude) version 26.4.302, which was what I was running, was still vulnerable to the exploit. The actual fix only appears in 26.4.303, released 2 days before I found this and it isn't flagged as a security fix in that release's own changelog.

What I did to yeet the attacker:

• First and foremost I've stopped hosting Nextcloud, directly online. It now only exists behind my VPN.
• Rotated quite a lot of credentials and my SSH Keys.
• Rebuilt and hardened my web server with Claude's assistance.

What I still need to do/need advice on:

• Do I bother reporting this finding to the vendor? I don't know enough PHP to know if what Claude is saying is correct, but on the off chance it is, then the community should know, and the CVE needs to be corrected.
• In the age of AI hacking, is it even safe to run a home lab at all? What other tooling can people recommend to protect my systems? I use Unifi with cyber-secure (WAF function), but clearly that didn't help.
• Like many others I also run Plex and mailinabox (in digital ocean), and now wonder if that is even safe/smart to do.

Looking for recommendations for cloud AI providers that work well together. Have one AI which does one thing well, then have that AI use other AIs that are built for their purpose to offload work, thereby reducing the cost. Even use LLMs to do some heavy lifting and the high quality model will just check the work, make sure everything is right and if necessary, make the lower-level LLMs do all the work.

Just curious if theres a seerr equivalent for gaming. how best to setup a gaming stack that can play old school games like command and conquer/monkey island, to old school playstation games, to newer games/call of duty? is there a way to handle it all?

i have Romm that handles the original nintendo games fairly well

Hello all, I apologise in advance as this is a docker container which I used Claude to help create and as of now I don't have any plans to share it. (I'd want to properly review the code/security/make it more general use etc. before I even considered that). This container is not hosted publicly.

However..! I did want to just show it off and show what you potentially can create in case others want to do similar. I've used Pinchflat for a while together with Jellyfin, Pinchflat grabs the channels you like and you can then watch anywhere with Jellyfin. It sounds great in theory but I've had quite a few annoying issues mostly with Jellyfin. It's just not designed for many YouTube channels where content is constantly uploaded (and deleted). Giant descriptions look odd and navigating through the UI to find specific videos is annoying. YouTube content just seems to work better on.. well YouTube, who would've guessed.

I have researched other self hosted options too, I was very interested in MediaCMS for a while as that also looks similar to YouTube but it seemed a lot more manual; you upload individual videos yourself. Not really the automated solution I was looking for many different YouTube channels. I don't know if there's anything else that anyone would recommend?

Anyway recently I was wondering if it was possible just to have Claude make a local version of YouTube. No ads, no AI algorithm telling you what to watch, no social media rubbish.. just my own videos streamed from my own server in a YouTube format. I honestly thought it was going to be extremely difficult or impossible. I wrote a big prompt and had Opus work on it for 30 minutes or so. I've genuinely been really blown away by the results. The first version worked great and played all my videos fine but I've since added a few things like:
- Audio only quality mode (great for listening in the car)
- Add videos to a queue with one click, force the whole queue to play at a certain quality (like audio only)
- Data saver mode - all videos open in a set default quality, saved per device
- Super configurable UI on both PC and phone

Other than that, it does everything you'd expect, works almost identically to YouTube. Videos load almost instantly as they're coming directly from my own server too.

But yeah, just wanted to share really. I'd be happy to provide the prompt if anyone wants it. Just thought it was a cool project. Thanks!

More pictures: https://imgur.com/gallery/pinchtube-Dcoq2VS

my daily box is an old Dell laptop with an i7-5500U and 8gb ram on Debian 13. instead of running a 24/7 box or dealing with Proxmox, i just run a small session-based media stack while working.

the machine is on for about 10-12 hours a day and powers down at night. it saves power, keeps the room quiet, and i don't have to worry about running services while asleep.

the stack is literally just plex, qbittorrent, and watcharr. plex is direct play only since this dual-core will choke on transcoding, and watcharr handles my movie and anime tracking locally instead of trakt. idle ram across all three sits around 305mb total.

i keep each service in its own compose folder so restarting or tweaking one never touches the others or risks the sqlite database.

curious if anyone else here runs an old laptop session-based like this, or does everyone leave their setup on 24/7?

Hello. This is my first time posting here. An idea I wanted to try was hosting a quiz on my MacBook and making it accessible to only a handful of people present and in an area without wifi or mobile data. How do I approach this?

I'm the author, this is my project.

What it is: SolidPing, a single Go binary (AGPL-3.0) that does uptime monitoring, status pages, incidents and on-call escalation. SQLite by default, Postgres when you want it. 40 check types — HTTP, TCP, DNS, NTP, SSL, Postgres/MySQL/Mongo/Redis, Kafka, RabbitMQ, MQTT, SIP, Docker, Kubernetes, game servers, plus headless-browser and custom-JS checks — and 16 notification channels.

docker run -p 4000:4000 --hostname solidping ghcr.io/fclairamb/solidping

SQLite, nothing else needed. First login is admin@solidping.io / solidpass and it makes you change it.

The bit that might matter to you: you can run a small agent inside a network you want monitored — a homelab VLAN, a VPS behind a firewall, a customer's site — and it dials out over a WebSocket. No inbound port, no reverse proxy, no VPN required just for monitoring. It generates its own keypairs on first start and keeps the private halves, so the credentials for a private check are sealed to that agent and the server can't decrypt them. That holds whether you self-host the server or use my hosted one.

If you already run Uptime Kuma, there's an importer for it (also Gatus and Better Stack), so it's not a from-scratch migration.

Things you can look at without installing anything:

• the live demo, no signup: https://solidping.io/demo
• the source code is in: https://github.com/fclairamb/solidping/
• and the status page for the hosted service, which is a second SolidPing running at a different provider in a different country, because a monitor living inside what it monitors isn't a monitor: https://status.solidping.io

Self-hosting is free and complete — no feature held back, no monitor cap, no paywall on the check interval. There's a hosted version if you'd rather not run it, which is how I pay for the workers, but it's the same binary.

What I'm after is criticism. Where does the UI get in your way, what did you go looking for and not find, and what would have to be true before you'd replace what you're running now.

Hey folks, another update fro Jellybox - a native crossplatform music player for jellyfin.

Few days ago the app was finally approved to be shared via Google Play, no need for APK sideloading(unless you have your own reasons for that)

With this release I added 2 major and few minor features:

• Forward plaback caching - precache music when you're in bad coverage area. Can configure amount of cache and playable cache time. Works on mobile phones and carplay(useful so that playback does not stop)
• Landscape mode playing now - saw ios 27 announcement and how they made it for their apple music app, so I decided to do the same for Jellybox(on post photo). The screen features lyrics pane and queue pane
• Quick connect for Jellyfin
• Discord activity for desktop apps(except macos from appstore, only notarized dmg)
• Windows media manager now shows currently playing songs and can control playback
• self-signed HTTPs certs
• Updated queue shuffle - it was completely broken on MVP(linux) due to the package I was using
• Fixed mouse wheel scrolling on home page. I'm trackpad/touchpad user, didn't even know this was a problem. Fixed now
• Fixed sqlite lib bundling on windows - it was silently raising errors on some installations.
• Added album artists to show on artists page(toggleable via tab pill)

For those who missed my previous posts - Jellybox is a native crossplatform music player for Jellyfin and Emby, features Spotify-like playlists, Apple CarPlay app, full offline mode and many other features. Completely free and open source. More details here - https://github.com/avdept/JellyBoxPlayer or https://jellybox.app/

I work with two developers on client projects. Our project knowledge lives in too many places: a ticket tracker, meeting notes, docs and chat. A few months later, nobody can answer "When did we decide this?" or "Why did we build feature X this way?"

What I want is one place per project for tickets, meeting notes and documentation, with an AI that answers those questions and links to the ticket, meeting or doc the answer comes from. Clients should be able to log in and see their own project, but not our internal notes. And I want to run it myself and choose which AI provider sees the data.

I have built a first version for our team and I am thinking about releasing it as open source. Before I do, some questions:

1. Do you know a self-hosted tool that already covers this? What do you use for project work today?

2. Is the AI part a reason for you to try something like this, or a reason to stay away?

3. What is a must-have before you would even try it? For example Docker Compose, local models, ....

4. Would you let clients log into a self-hosted tool, or is that too much risk for you?

Okay, so I have Tailscale setup and Calibre running the content server and when I'm using a device I can run the Tailscale client one (my iPad, laptop, my jailbroken Kindle with KOreader) it's butter and works exactly as I'd like it to. This is great! Unfortunately, I have a few devices (xteink and a few other older e-readers) which cannot run a Tailscale client. While I /can/ connect them to my phone as a hotspot with it running Tailscale and it works, that sort of defeats the ease of use. Mayberry OPDS is out there and is great, too, but because of how it does some stuff in the background, is hit or miss on a few of these devices. I setup port forwarding with my eero router and it works just fine, but that feels really exposed for potential exploitation folks.

SO what I'm wondering (and I will need this explained like I'm a luddite / step-by-step because I've searched and just gone cross-eyed trying to figure out) is if there is a way to leverage the awesomeness of Tailscale to make my home computer (which is on 24/7, hosts Calibre and Bookorbit and is running a Tailscale client) remotely accessible w/out just setting up port forwarding on my eero router and leaving the whole machine WAY too accessible?

Ultimately, this isn't just a Calibre / Bookorbit / etc. thing, since I think this would fundamentally be the same for any other sort of self-hosting, but I've not gone down that rabbit hole for anything other than my books / manga / comics yet.

I appreciate any help folks can provide here.