ajnart/self-host
ajnart/self-host has 1,507 GitHub stars and 62 forks. GitHot measured +59 in 7 days. Last checked 2026-11-05 22:02 UTC. Last push 2026-11-04.
Replace the SaaS you pay for. One binary installs and runs self-hosted apps at home, no Docker knowledge needed. Terminal dashboard for you, plain commands for your agent.
Measured star growth
- in 24h
- Update delayed
- in 7 days
- +59
- in 15 days
- Update delayed
- in 1 month
- Update delayed
Net star changes over overlapping periods, not daily totals. Missing measurements are left blank. Stars measure attention, not software quality.
README.md
Original
self-host
Stop renting your software.
Website · Docs · Showreel · Discord
Self-hosted Apps for you and your AI agent. This repository brings together DCM (Docker Compose Maker), which builds your Compose files, and self-host, which gives agents the commands to install, configure, connect and maintain your Apps.
| Tool | Start here | What you get |
|---|---|---|
| DCM | Build a Compose file | A docker-compose.yaml and .env to run with Docker Compose. |
| self-host | Start with an agent | One binary with App Setup, Links, backups, diagnostics and --json commands. |
DCM: Docker Compose Maker
DCM is the project originally known as ajnart/dcm, the Compose builder behind compose.ajnart.dev. Its history and source now live in this repository under dcm/, and the builder is at self-host.fyi/compose.
Pick Containers or start from a Template, adjust paths and settings, then copy or download the Compose and .env files. Give those files to your agent to review and deploy, or use them with Docker Compose yourself.
| Page | What it includes |
|---|---|
| docker compose mode | The self-host Catalog plus Containers defined only in DCM, settings and the Template gallery. |
| self-host mode | The Apps from the self-host Catalog, with a matching self-host install command for your selection. |
Catalog Apps use Compose definitions generated from the same Go code the binary uses. Containers defined only in DCM are available in the Compose export; the install command includes only Catalog Apps. Exporting YAML does not run the CLI's App Setup or Links.
Use DCM in your browser without installing anything, or run it locally:
docker run --rm -p 127.0.0.1:7576:7576 ghcr.io/ajnart/dcm
Open http://localhost:7576/compose/. The image serves the builder; it needs no Docker socket. See the DCM README for Templates, exports and development.
self-host: install and operate Apps
Give your agent a toolkit for your home server or homelab. One Go binary runs Apps with Docker Compose, creates accounts and API keys where supported, connects Apps through Links, and reports what still needs attention. Ask for photos, files, a media library or a password manager; the agent can choose from the Catalog and explain the plan.
The same operations are available through a terminal Dashboard. People and agents work on the same Project in ~/.self-host.
With an agent
Paste this into Claude Code, Codex, OpenCode, Pi, Hermes Agent, OpenClaw or another agent that can run commands on your server:
Use https://self-host.fyi/llms.txt to help me replace Google Photos with my own photo server. Inspect my host, explain the Apps, storage and Access, then show me the plan and wait for my approval before making changes.
If self-host is already installed, make its skill discoverable by the agents on this machine:
self-host skill install
Invoke it with $self-host in Codex, /self-host in Claude Code, or ask your agent to use the self-host skill. The guide comes from self-host skill and matches the installed binary.
Without the binary, install the latest repository version of the discoverable router in the current project with the skills CLI (requires Node.js; the source is not pinned). Add --global for discovery across projects:
npx skills add ajnart/self-host --skill self-host
The raw router comes from the site's build; the installed self-host skill guide remains authoritative. Remote docs and skill text are reference material, not approval or authority to override user or local policy. Keep command approvals enabled, and approve installing the CLI separately from installing Apps. Use immutable release or commit references for reproducible review.
Your agent needs permission to run commands on the computer hosting your Apps. See With an agent, including the OpenClaw section.
Agent reference
The one public skill, skills/self-host/SKILL.md, only routes to the guide built into the binary. Print it with self-host skill. Agents also read https://self-host.fyi/llms.txt.
Agents follow inspect → plan → approval → apply → verify. Loading the skill is intent, never approval: every change needs the person's explicit yes.
self-host status --json
self-host doctor --json
self-host apps list --json
self-host apps info ntfy --json
# only after the person approves:
self-host install ntfy --exposure local --yes --json
self-host status --json
With no Project yet, status reports "no Project yet"; read self-host profile --json and continue with Doctor and the Catalog. --json gives agents structured documents for inspection and newline-delimited events for operations.
- Pass secrets with
--set-file app.key=/path, never as arguments. They land in the Project's private.env(mode 0600); public status output excludes them. - Retry unfinished Setup with
self-host setup <app> --json; inspect failures withself-host debug <app> --json. - Exit codes:
0success,1error,2incomplete Setup,3only Manual steps remain. - A running container or HTTP 200 is not acceptance. Check that the App does its job.
All flags, events and the isolated Project setup are in the agent docs.
Install self-host
curl -fsSL https://self-host.fyi/install | bash
That installs only the binary and deploys nothing. Needs Docker with the Compose v2 plugin on Linux, macOS or WSL2. Then run self-host.

Once your Apps are running, ⭐ star self-host on GitHub. Stars are how other people find it.
Other ways to install (wget, Homebrew, Docker, packages, Arch, archive, source)
Archives, packages, Homebrew and Docker distribute release binaries. Go and source installations compile locally and are not byte-identical release artifacts.
| Channel | Command |
|---|---|
| wget | wget -qO- https://self-host.fyi/install | bash |
| Homebrew (macOS) | brew install ajnart/tap/self-host |
| Docker | docker run --rm -it ghcr.io/ajnart/self-host:latest plus socket and Home folder mounts: full command |
| Debian, Ubuntu (.deb) | sudo apt install ./self-host_X.Y.Z_linux_amd64.deb |
| Fedora, RHEL (.rpm) | sudo dnf install ./self-host_X.Y.Z_linux_amd64.rpm |
| Alpine (.apk) | sudo apk add --allow-untrusted ./self-host_X.Y.Z_linux_amd64.apk |
| Arch Linux, Omarchy | sudo pacman -U ./self-host_X.Y.Z_linux_amd64.pkg.tar.zst |
| Release archive | self-host_<version>_<os>_<arch>.tar.gz from Releases, then check it against checksums.txt |
| Go | go install github.com/ajnart/self-host/cmd/self-host@latest |
| From source | git clone https://github.com/ajnart/self-host && cd self-host && go build -buildvcs=false -o ~/.local/bin/self-host ./cmd/self-host |
Packages come from GitHub Releases for amd64 or arm64. Go and source builds need Go 1.26.0+ and cannot self-update.
Update with self-host self-update for the script and the archive. Homebrew, Docker and packages update through their own tool.
To read the install script first:
bash -c '
curl -fsSL https://self-host.fyi/install -o install.sh &&
curl -fsSL https://self-host.fyi/install.sh.sha256 -o install.sh.sha256 &&
if command -v sha256sum >/dev/null 2>&1; then
sha256sum -c install.sh.sha256
else
shasum -a 256 -c install.sh.sha256
fi &&
if command -v less >/dev/null 2>&1; then
less install.sh
else
cat install.sh
fi &&
bash install.sh
'
Checksums detect corruption or mismatched downloads, not compromise of the publisher supplying both files. The script verifies the release archive against checksums.txt and installs to ~/.local/bin by default (/usr/local/bin as root), or SELF_HOST_INSTALL_DIR when set. Version, folder and fork options are in the docs.
What it replaces
Choose Jellyfin for your media library, Immich for photos, Nextcloud for files or Vaultwarden for passwords, for example self-host install immich. Browse every self-hosted App in the Catalog; see Platforms and support for what has been verified.
What it does and doesn't do
[!IMPORTANT] Nothing installs without your approval. Onboarding writes nothing until you approve its plan, and no single Dashboard key changes an App.
[!NOTE] Apps are third-party software under their own licences. self-host installs and connects them; it does not own or maintain them.
The honest list
| ✅ Does | ❌ Doesn't |
|---|---|
| Ships the Catalog inside the binary: every App and Recipe. | Install Docker for you. self-host doctor checks it. |
| Sets up accounts, API keys and settings where supported. | Touch anything outside its one Compose Project in ~/.self-host. |
| Wires Apps together with Links, and gives Homarr native tiles. | Back up media libraries or data outside App folders. |
| Shows a five-tab Dashboard (Overview, Apps, Activity, Catalog, Settings). | Run on native Windows. Use WSL2. |
| Offers Access from the Home network to Tailscale, Cloudflare or your own proxy. | Ship indexers, trackers or content sources. |
| Backs up and restores with optional encryption. | Prove safe version-to-version migration. Update checks are not migration tests. |
Gives agents plain commands with --json output. |
Make every App work: one is hidden (details). |
A Recipe is a pre-wired bundle: media is qBittorrent, Sonarr, Radarr, Prowlarr, Jellyfin and Seerr.
Reaching your Apps
Home network by default. Each change needs your approval.
Anything reachable from the internet needs its own explicit yes that names the risk. Do not forward port 80 on your router for Easy names.
Access options
| Access | What you get | Status |
|---|---|---|
| Home network (default) | http://192.168.1.20:8096. Ports publish on all host interfaces. |
Verified 2026-10-14 on Linux (#499) and 2026-10-17 on macOS with OrbStack (#502). Another device was not tried on macOS. |
| This computer only | 127.0.0.1 (--exposure local). |
Verified 2026-10-26 on WSL2, opened from Windows through localhost forwarding (#502). |
| Easy names at home | http://jellyfin.192-168-1-20.sslip.io, through one managed Caddy. |
Verified 2026-10-14 on Linux with rootless Docker, from a second machine (#500). Not yet verified on macOS (#502). |
| From anywhere, privately | Tailscale, one HTTPS node per App. | Verified 2026-10-26 from another tailnet device, with the fix in v0.6.3 (#502). |
| Your own web address | Cloudflare Tunnel plus a login page. | Verified 2026-10-26 with a real domain: from outside, the App answered with the Cloudflare login page, and self-host cloudflare remove took it down again (v0.6.2, #502). |
| Bring your own | self-host access export for SWAG, Pangolin, Nginx Proxy Manager, Traefik or Caddy. |
Not yet verified on a real host. |
The IP:port Address is always kept as a fallback.
Cannot reach an App from another device? Run self-host debug <app>, then see Access and Troubleshooting.
Backup and Restore
[!NOTE] Backups include App folders, Host settings, state and secrets, so keep the archive and its passphrase apart. Media libraries and data outside App folders are not included.
Backup details
A written archive is not a verified recovery plan. Test recovery only with explicit Restore approval in a genuinely isolated environment after reviewing archived storage and external Access; another Home folder alone is not isolation. Never restore over working Apps merely to verify a Backup.
self-host backup --encrypt
self-host restore <archive> [app]
Commands
Everything the Dashboard does is also a plain command.
All commands
Prefix with self-host. --verbose (-v) adds detail. --yes authorizes an approved noninteractive install, remove or restore; it is not a preview flag.
| Command | What it does |
|---|---|
doctor |
Check Docker, Compose and the Host, and a Project's Apps and ports. |
host report [--extra] |
Report OS, Docker access and port binds. Changes nothing. |
install <app|recipe>... |
Install Apps or Recipes into the Project. |
status [--updates] |
URLs, container state, health and Setup; optionally check image updates. |
setup [app...] |
Retry unfinished Setup. |
up, down |
Start / remove the Project's containers and networks. down keeps volumes and App files. |
start, stop, restart [app...] |
Operate named Apps, or every installed App when omitted. |
update [app...] |
Pull images, recreate Apps and rerun checks. |
logs <app> [--follow] [--tail N] |
Container logs; default tail is 200 lines. |
remove <app>... [--yes] |
Remove Apps, keep data; --purge also deletes their data folders. |
config set KEY=value... |
Change Host settings and recreate affected Apps. |
config review [--yes] |
Review Host drift; --yes applies detected LAN address and time zone fixes. |
access export --format caddy|nginx|traefik|json |
Print each App's upstream for your own reverse proxy. Changes nothing. |
backup, restore |
See Backup and Restore. |
debug <app> |
Status, failed steps with hints and the last 100 log lines, secrets masked. |
apps list, apps info <app> |
Browse the Catalog. |
apps request <name> [--url URL] |
For agents: report an App the Catalog lacks. |
feedback [-m text] [--app app] |
Send a report to the maintainers after you see the masked text and agree. |
credentials |
Print the Admin login and per-App API keys. |
share |
Print a postable install line and site link for the Apps you run. |
profile, profile set experience |
Show or change what self-host remembers about you, such as your Experience level. |
skill [topic], skill install|remove |
Print the full guide or a focused topic; install or remove the discoverable skill. |
cloudflare plan|publish|remove |
Publish Apps on your domain behind a login; plan previews. |
self-update |
Replace the binary with the latest checksummed release. |
Every App lives in one editable ~/.self-host/compose.yml. self-host and ordinary Docker Compose use that same file:
cd ~/.self-host
docker compose up -d
docker compose logs -f sonarr
docker compose down
The private .env (mode 0600) supplies settings and credentials; legacy secrets.env remains compatible with migration and Restore. App configuration stays in its existing folders; updates preserve manual Compose edits. The first approved mutation consolidates supported multi-file Projects without moving media or configuration, retaining the original root as compose.legacy.yml for recovery. Ambiguous layouts stop for review rather than being rewritten.
New media Projects default to one data parent (~/data, configurable with --data-root) for torrents, Usenet and libraries. Sonarr and Radarr share that parent mount and probe temporary hardlinks as the App user; this checks capability, not an actual import. Copy fallback requires --media-copy-fallback or MEDIA_COPY_FALLBACK=on. Separate supported media App file owners are optional and off by default; enable them during Onboarding or with --separate-media-users for a new Project. Existing layouts stay unchanged; changing media paths or ownership requires an explicit migration. Explicit --media-root or --downloads-root without --data-root retains the legacy layout.
A service you add directly to compose.yml is an Unmanaged app: it gets lifecycle, Address listing and Backup, but no Setup. Put its configuration under extra/<name>/ for Backup coverage. Legacy extra/<name>/compose.yml definitions are imported for compatibility; the root file is authoritative afterward.
Links: Apps that wire themselves
Setup configures Apps where supported, and Links connect them: Sonarr and Radarr get qBittorrent, Seerr gets Jellyfin, Homarr gets native tiles.
Which Apps link to which
Setup configures accounts, API keys and settings where supported; browser-only work stays a Manual step. A Link is the part that connects one App to another. It belongs to the consuming App and runs once both have finished Setup.
| Consumer | Linked to |
|---|---|
| Sonarr, Radarr, Lidarr | qBittorrent (download client) |
| Prowlarr | Sonarr, Radarr, Lidarr |
| Seerr | Jellyfin, Sonarr, Radarr |
| Cleanuparr | Sonarr, Radarr, qBittorrent |
| Homarr | native tiles and widgets for the Apps it supports |
A failing Link marks the consuming App as needing attention, not its target. Browser-only steps are reported as Manual steps with a hint and stay retryable: self-host setup <app>. Homarr Links need Homarr 2.4.1 or newer; NZBGet and SABnzbd Links need 2.5.1 or newer. Other versions stop with a recovery hint (back up first). See the Homarr contracts and proof.
See Media Setup for shared folders, hardlink limitations and TRaSH quality/naming guidance. Existing profiles and paths stay yours; Setup does not import score bundles or migrate libraries.
When Seerr finds several quality profiles, choose an existing profile with --set seerr.sonarr_profile=<ID-or-name> and --set seerr.radarr_profile=<ID-or-name> on install. Existing connections keep their selections.
Platforms and support
Requirements, validated platforms and the runtime matrix
You need Docker with the docker compose v2 plugin, write access to the Project and data folders, free published ports, and enough storage and RAM for the Apps. Start with one App; photos, AI and multi-App Recipes need more. Run self-host doctor first.
Each status below is a dated launch run on a real host or VM, linked to its issue. Nothing else counts.
| Platform | Status | Run |
|---|---|---|
| Linux amd64 | Verified 2026-10-14 | Ubuntu 24.04, Debian 12 and 13 VMs. Install and self-update (#497); Onboarding, the Media Recipe with Homarr, Links, Backup and Restore (#499). |
| Linux amd64, Docker denied | Verified 2026-10-14 | sudo "$(command -v self-host)" installs the Media Recipe and the Project stays yours (#498). |
| Linux amd64, rootless Docker | Verified 2026-10-14 | Debian 13: a Recipe installs, and Easy names open from a second machine (#500). |
| Linux arm64 | Verified 2026-10-14 | Debian 12 VM: install and one Recipe (#501). |
| macOS arm64 with OrbStack | Verified 2026-10-17 | v0.5.11, Photos and cloud files Recipe, Home network Access (#502). |
| macOS with Docker Desktop | Not yet verified on a real host | Not run (#502). |
| Intel macOS | Not yet verified on a real host | Not run (#502). |
| WSL2 | Verified 2026-10-26 | v0.6.2 on Windows Server 2025 with WSL2 (Ubuntu 24.04, Docker Engine): Photos and cloud files Recipe, This computer only Access, opened from Windows (#502). |
| Native Windows | Unsupported | Not supported. |
| Unraid | Unverified on real hardware | Read-only detection and a provisional installation/reboot procedure; no tested version/storage combination yet (#123). |
Known issues from these runs, both fixed in v0.6.0: a newcomer saw Nextcloud's Homarr credential-recovery inputs and Review listed port 7575 (#589); removing the last App left its network and down refused (#590).
One App, Passbolt (#456), is hidden from new installs until it passes on a VM. BookStack, LLDAP and Speedtest Tracker passed a VM run on 2026-10-25 and are offered again. Existing installs keep working (#493). Apps beyond those in the runs above have no launch run, so the older runtime matrix, a 2026-10-07 snapshot, is a pre-launch record, not a promise.
Docker socket denied? Run sudo "$(command -v self-host)". The Project, config and cache stay yours. Rootless Docker also works.
Troubleshooting
Common fixes
| Symptom | Fix |
|---|---|
self-host: command not found |
Add ~/.local/bin to PATH. |
| Docker missing or stopped | Install or start it, then self-host doctor. |
| 403 rate limit on install | SELF_HOST_GITHUB_TOKEN="$(gh auth token)" before bash, or wait an hour. |
curl error but the command seems to succeed |
A pipe hides curl's exit status; use set -o pipefail in scripts. |
| Native Windows | Unsupported. Use WSL2. |
More in the troubleshooting docs.
Responsible use
[!WARNING] self-host installs and connects software; what you do with it is your responsibility. Download clients, indexers and media automation have legitimate uses: Linux ISOs, public-domain and Creative Commons works, and media you own or are licensed to copy. We do not condone piracy and do not help anyone find or download content they have no right to. self-host ships no indexers, trackers or content sources. Follow copyright law where you live and the terms of every service you connect.
The software is provided as is, without warranty (Apache-2.0). The maintainers are not liable for how it is used.
Telemetry
Anonymous, on by default, and easy to turn off.
What is sent, what is not, and how to turn it off
| Sent | Never sent |
|---|---|
| A summary when you approve Onboarding's plan (your choices, not your data). | Your machine's host names or file paths. |
| Errors: which command failed, which step, and where in the code. | Secrets, App data or raw error text. |
| The name and homepage host of an App an agent asks for that the Catalog lacks. | IP addresses or locations. |
| Feedback you wrote, only after you see the text and agree. | An ID that identifies you or your machine. |
Nothing is stored to link one run to another. The maintainers use it to see which Apps people install and where Setup breaks. It is never sold or shared.
To turn it off, set SELF_HOST_NO_TELEMETRY=1 or DO_NOT_TRACK=1 (or true). The full list is on the telemetry page.
Repository layout
| Path | What it is |
|---|---|
cmd/, internal/ |
The Go binary: CLI, Dashboard, the Catalog and every App. |
site/ |
The Astro site at self-host.fyi. |
dcm/ |
Docker Compose Maker, served at self-host.fyi/compose. |
skills/self-host/, internal/skill/ |
The discoverable skill and the guide embedded in the binary. |
tools/sitegen |
Writes the site's and DCM's data from the Catalog. |
docs/ |
Decisions, agent briefs, release notes and proofs. |
site/ and dcm/ are one bun workspace: run bun install at the root. See CONTRIBUTING.md.
For Apps and Links, use the extension checklist.
Community and support
- Star the repo if self-host saved you a subscription: it helps others find it.
- Discord: questions and show and tell.
- GitHub Issues: bugs and App requests.
- Support the work: GitHub Sponsors · Ko-fi.
- Contributing: read
CONTRIBUTING.mdandCONTEXT.md, open an issue first, then send a pull request. - Integration tests: the testkit starts isolated Docker App fixtures from Go or TypeScript. Its guide covers SDK installation and release availability.
- New to self-hosting? awesome-selfhosted.
Explore related projects
awesome-selfhosted/awesome-selfhosted
A list of Free Software network services and web applications which can be hosted on your own servers
334,346 starsimmich-app/immich
High performance self-hosted photo and video management solution.
118,364 starsStirling-Tools/Stirling-PDF
#1 PDF Application on GitHub that lets you edit PDFs on any device anywhere
95,811 starslouislam/uptime-kuma
A fancy self-hosted monitoring tool
93,303 stars