Self-hosting is dead, long live self-hosting

Pi-hole, why do things easily when it can be complicated

The only way to bring DNS filtering to your whole network, without relying on 3rd parties for it, is to run your own resolver, recursive or forwarding. Setting up a DNS resolver in the comfort of one's home is a relatively simple task, comparable to setting up a web server. The issue comes when you want to filter tracking/ad domains and more.

Doing so in the browser is as simple as installing an extension and enabling few lists, and here lies the main problem. These lists are usually in the AdGuard filter format that is better for browser consumption, however completely useless for anything else. DNS resolvers use the Zone file format for filtering, which is obviously completely incompatible both with the other usual browser filtering format in the form of a hosts file. And here lies the problem. I expected that I could borrow some piece of code from Pi-hole that generates the RPZ file and make my own resolver-usable lists that way, but that's not how Pi-hole works. That would be too easy.

Pi-hole developers decided that a much better way of handling this issue would be to maintain a fork of dnsmasq called FTL that reads blocks from an SQLite3 database and use another script to generate the database from the multiple list formats. Instead of the obvious solution of generating an RPZ zone file that a resolver could ingest (dnsmasq would have to be replaced since it doesn't support the RPZ format). Why make existing blocklists useful for everyone else not using our own software when we can maintain our own dnsmasq fork.

Another issue that will come up multiple times in this post is the way Pi-hole is distributed and expected to be used. Despite it being only a pile of shell scripts, a web frontend and a dnsmasq fork, it sort-of expects to be ran exclusively on a Raspberry Pi as the OS, or be deployed with Docker, or in a VM. So instead of what should have been a package repo for Debian with a meta package anyone could enable on top of their vanilla Debian install, they have to endlessly fight with Docker (when it inevitably breaks; and it will break), or reserve a whole Pi for the very simple task of resolving DNS requests. This is a terrible way of distributing and installing software, which is very prevalent in the "maker" Pi community.

Home Assistant, why do things easily 2: Electric Boogaloo

Another piece of software that is widely self-hosted and praised by a certain group of smart-home fanatics is Home Assistant (hereby also referred to as HA). The idea on paper sounds very nice, a single place in your home network where all your smart devices talk to without the need for 3rd-party cloud services. And I do agree, software like that can be nice. Except somewhere along the journey something has gone horribly wrong.

Just like Pi-hole, HA wants to takeover your entire machine (or VM) and be the only OS running there. But this time the option of running it in a Docker container doesn't even give you the full HA experience, no. You must run the whole OS to be able to add additional apps (add-ons) to your installation. Meanwhile HA apps are really just additional containers running on the system alongside the main HA container(s). So if you are running it in a virtual machine, you got yourself a nice Matryoshka. Running a VM and inside the VM there are multiple containers running.

This is your computer on HA.

Nextcloud

Another entry in this insanity list is Nextcloud, an old fork of Owncloud that can now probably be on the too big to fail list. Everyone that wants to self-host a cloud productivity and storage suite goes to it by default. Regular people use it, schools use it, companies use it and even some governments use it internally. So what's bad about it?

First and foremost, it grew too big for a PHP codebase. It is slow, resource-heavy and both hard to manage and likely even maintain (from the developer perspective). The usual for a PHP codebase that does more than rendering a templated dynamic page based on a few SQL queries. You might think that I'm some sort of a PHP hater, but if you look at the URL bar, you might notice that this very page (and in fact all pages on this site) is a PHP page. I just know where the limits of PHP as a usable and enjoyable language are, and the limit is around the needing a background job scheduler mark.

The second part comes to maintaining Nextcloud as whole. As is usual so far, it also has the just ship it as a Docker container mentality, but perhaps somewhat surprisingly it also supports bare-metal installation by placing the files into a webserver's root. The latter is even somewhat pleasant to set up, especially when using A-patch-e httpd as the webserver. That said, if you are running on a Linux distro with SELinux, you will soon realize that Nextcloud needs write access to its own files for the builtin self-updater. Self-updaters are the bane of modern user-friendly webdev that trade privilege separation for convenience of maintaining said software.

But guess what sidesteps this whole issue, your system package manager. If Nextcloud shipped packages of itself in their own repos, they wouldn't need to enable the self-updater on every install and have the codebase writeable from the PHP-side. The separate apps could be shipped as packages as well, completely eliminating write permissions to source code from the PHP-side, only requiring them for user content in specific folders. But that is never happening, so now the only safe-ish option of hosting Nextcloud is in a separate LXC container, or Docker, where it can write whatever it wants and not affect the rest of the webserver content.

Considering the timing of this post, you might also be wondering if I'll be talking about the recent PHP RCEs. Yes, later :-)

Raspberry Pi and its community

Now from a different cup of tea (#cofe).

Despite being an avid self-hoster for over half a decade, arguably before it was cool and popularized by channels like LTT and Network Chuck, I never really had a need for a home server. The only other unused computer I have is a mid-2000's Lenovo ThinkCenter with a space-heater of a Pentium D that sounds like a jet engine when doing anything more than sitting on tty1. I did buy a Raspberry Pi 4 with the sole purpose of installing Pi-hole on it 3 years ago to solve an ad-driven shopping spree of useless items from a close family member's family member though, which never fully materialized.

And so it sat there, on my table, doing nothing. As is usual for most Pis. 2 years later it was used as a Pleroma CI builder during the Gitlab-to-Forgejo transition for my testing during the switch to Woodpecker and that was it.
Quite literally, because when I tried to use it few months ago to finally set up a home server, its DRAM failed and it would no longer boot at all. At least the e-commerce site I got it from made no attempts to weasel itself out of the RMA. Which brings me to the experience of using a Pi for home server use.

To give praise where it is due, in the recent years OS support for Pis has improved a lot for people that hate Debian with a burning passion (me). You now have choice of all major BSDs (although somewhat janky sometimes), the usual Raspbian, Armbian, Fedora and even RHEL (and derivatives). And at least for Almalinux (a RHEL downstream), they even have a specific Raspberry Pi repo with firmware and Raspberry-specific utilities. Same however cannot be said about most other SBC vendors, where it is still mostly a gamble whether the vendor will ever release updates for their own Debian fork. And maybe making F2FS as the root filesystem to lessen the SD card wear would be nice for all of the mentioned distros, none to my knowledge do this.

Non-installable by default software

This is a thing I touched on multiple times in this rant, but it deserves its own section as well. A lot of the projects that advertise themselves as self-hosted alternatives to Big Tech services are only installable via Docker. Usually Docker is the only documented way of deploying this software and managing it (so-called Docker slop). This not only has the side-effect of usually allowing the project to become nearly impossible to build separately and therefore maintain/contribute to it. But another side-effect of this is that the user has learned nothing in the process, and at least to me self-hosting also is about learning about the setup (or at least was when I entered this hobby).

The user is treated as a drone that should just paste a couple lines from a web page and treat the whole setup as some magic blackbox that as Todd Howard would say just works. Well, the problem is that it usually just doesn't work, and even if it does, at some point Docker will throw the user a curveball that they will have no idea how to solve or properly describe. It should be no surprise that most of these Docker-only projects are really bad from the UX standpoint as well. If the developers didn't bother making their lives easier by making a non-clusterfuck codebase, it sort of extends to making the UX horrible as well. I'm even gonna go as far as making the argument that using these easy install options is also detrimental to the project maintainers, because they now have to figure out what is broken from user's that have no idea how anything in the system works.

If a user goes through a well documented manual install option, they learn about the setup in the process. (This is what the community is mostly missing at this point.) And by restricting the project to well documented manual installs, it also forces the project to be more sustainable and easy to install over time. Not to glaze myself, but I think the Pleroma guides I wrote and maintain are well written and easy to follow, while still being technical enough that the user learns at least something during the installation process. Making each took 2-4 evenings of writing and testing, so not something particularly time intensive either. You can check them here and here. If there is anything wrong with them, let me know :-).

There's also the paradox of documentation where the lower the required user knowledge bar is set by the documentation, the more questions that have already been answered in the documentation the maintainers will receive. For those the documentation is specifically written, simply won't even attempt to read it. So there is some sweet-spot that for me is purely based on vibes.

And as a bonus of making the software installable by itself, without Docker overheard or requiring a whole OS, the now very expensive Pi can do much more than just host HA, or a DNS resolver. For example mine does monitoring for all my servers, Syncthing, DNS resolving, BitTorrent and a VPN to my home network. By using the Pi-hole OS image, or running HA as it is meant to be, this would be impossible to do properly on a single Pi 4 2GB board.

This rant summarized so far

The burden of maintenance

The effort it now takes to maintain a self-hosted service is far more than it used to be even a couple years ago. There is now a real danger of mass exploitation literal hours after some vulnerability is disclosed. Even somewhat computer-savvy people simply cannot be expected to be able to navigate this space at this point. And most of the software being a pain-in-the-ass to install and manage doesn't help at all in this case. Just self-host your own software on your LAN, or in a private mesh at this point. If you don't know what you are doing (probably not), don't attempt to host anything on the Internet, or ask someone to guide you through it and co-maintain it.

While writing this, the Internet is still recovering from PHP's CVE-2026-109618 and CVE-2026-109619 RCEs. Firstly, some retard on Hacker News leaks these two CVEs and their almost correct CVSS score to the whole world during an embargo, then tries to save face by saying he didn't know there was an embargo while literally talking about an upcoming high-profile security release. I was thankfully alerted to this on IRC (yeah, I still use that thing), because I don't read techbro reddit. This made me immediately shutdown every public-facing PHP service I had, because it was already late at night at that point and I expected the release to be a total shitshow after the eMudhra CA compromise. What I woke up to 9 hours later was exactly what I expected, some other retards on Xitter leaked what the issues were (presumably by LLMing the codebase from some clues) and made a slopsite for clout (you never hate skids enough). This lead to me anger-posting a lot on the Fediverse. I checked my logs the day I'm writing this and guess what, there were likely attempts to breach my other PHP-powered site while I was asleep before the fixes were even released along with mitigations.

Another thing that made my blood boil was the eMudhra CA compromise. The compromise itself was relatively small part of it, what made me upset were the plethora of retards on Fediverse that were posting the key factors for everyone to see, or outright posting scripts on how to bruteforce them and forge certs. An amazing idea to give everyone on the Internet the power to masquerade as another site before even most distros patched their CA store, pure genius at display. At least people MiTMing their IoT devices was a fun thing to see.

Perfect description of Infosec people, including those above

Elitism and gate-keeping knowledge

I know this one is very rich after reading this whole rant, but let me explain. There is this notion of hating on people that use LLMs to ask questions when they could have asked others. This is a reasonable opinion (except the hate part), but the core issue with it is that those people complaining about it, are the first to tell you to fuck off the moment they don't like something about you (even excluding LLM usage). The kind of people to ban others from an issue tracker of the project when they find out you host a Fedi instance they don't like, despite only helping people in the issue tracker.

This is effectively gate-keeping knowledge behind a you must act how I want you to act, or you are out of luck. No wonder people rather ask a bot.

Then the other part are those that laugh the moment someone comes to them asking for help, for their lack of knowledge (prior LLM usage not required). At this point it is the how could this be happening to me meme.

On one hand they want more people in this space, but on the other they witch hunt all of the interested ones away.