Why I Self-Host Everything

I self-host almost everything I use day to day. Media, logins, secrets, monitoring, analytics and the site you're reading this on all run on one Proxmox box in my house. If there's a self-hosted version of something I use, there's a decent chance I'm running it.

People ask why I bother when there are perfectly good cloud services for all of it. Part of it is principle and part of it is plain stubbornness.

What's actually running

Right now it's 59 containers over four VMs, plus a fifth VM for my AI agent setup, whose services run straight on systemd. I split the VMs by what the work needs rather than by app. Everything that faces the internet sits behind Traefik and Authentik on one VM. The download clients sit behind a VPN container on another. Jellyfin has a VM to itself, so a busy evening of streaming doesn't fight with anything else.

Every stack is a folder in a git repo with a compose file and a small deploy file that says where it goes. A push to main fires a webhook, and a deploy script ships only the stacks that changed. This is the whole deploy config for the media automation stack:

yaml
host: <forge-vm>
deploy_path: /opt/stacks/arr
health_check: curl -sf http://localhost:8989/ping
infisical:
  - env: dev
    path: /arr

The infisical part is my favourite bit. The script pulls that folder's secrets out of Infisical and only passes on the variables the compose file actually references, so no stack sees another stack's passwords.

The principle bit

I want to own my data. I'm not worried about anything dramatic. I just want to know where it lives, who can get at it, and what happens if a provider changes their terms or shuts down. When the media is on my own disks and the secrets are in my own Infisical instance, I can answer those questions without reading a privacy policy.

The flip side is that nobody backs it up for me. For a long time that was a weak spot, and it took a NAS scare (I wrote that one up separately) before I sorted it. Now Proxmox snapshots every VM to a local 8TB drive at 02:00. An hour later restic takes the app configs and four Postgres dumps and pushes them to that same drive and to Backblaze B2. Both post a summary to Discord, so I notice when one stops.

The stubborn bit

I like doing it. It scratches the same itch as writing software, and now and then it means staring at logs at 1 AM trying to work out why Authentik just logged everyone out.

It's more work than paying for SaaS, no question. What I get back is that I understand every service I run from one end to the other, so when something breaks I can usually work out why. That's also why I'd say self-hosting isn't for everyone. If you don't enjoy the debugging, all you're left with is the work.

The SSD the VMs boot from was at 85% wear the last time I checked, so I already know what the next weekend project is.