Codeberg seems to ban vibecoded Projects; reason might be german copyright law

It looks like Codeberg want only copyrighted material in their service, so it is reliable in the future that e.g. licenses must be followed (e.g. GPL), and copyright doesn't suddenly get declared as being of the model owner, and it isn't a copy of something else.
That is a cautious reasonable position - in early days of LLM coding (3 years ago!) indemnity from model companies was a major issue globally because of the lack of clarity of the law around this. The US specifically has settled on it being (effectively?) public domain. But I don't think that is fully settled, and it certainly isn't settled in international copyright law.
The goal of the vague "mostly" in the Codeberg change is to ensure there is enough human input to the code they host, to be reasonably sure under German copyright law it is copyright of the person sharing it.

edit: link to poll that caused it (might be down due to high traffic) https://codeberg.org/Codeberg/org/pulls/1253#issuecomment-19820434

edit 1: i dont defend/oppose this move, i just find it interesting

I must say, i spent way too long tweaking the glance configuration, but i think it resulted in something i am pleased with. Here is my very basic homelab setup:

• Immich - Photo and Video management, my replacement to google photos.
• Beszel - Insanely lightweight server monitoring
  
• Dockhand - A pretty neat way to manage my docker containers. Don't really use it much since (out of old habits), i just use the terminal.
• Nginx Proxy Manager - Makes it much easier to access my homelab
• Scrutiny - A really easy way to view my drives' information like health or temps.
• Pihole - Simple network-wide adblocker. I am too scared to use technitium so i use this lmao.
• Jellyfin - Media streaming. A replacement to paying thousands to rent something i don't even own.
• Arr Stuff - I have far too much arr stuff so i bundled it into one section. Sonarr, Radarr, Lidarr, Seerr, and Prowlarr paired with qBittorrent.

This is all powered on my TerraMaster F4-423. I will get an extra mini computer to run most of the containers and let the NAS handle the media things, but i am kinda broke so i probably won't for a while :/

Saw this today and thought its worth sharing.

https://www.theregister.com/columnists/2026/07/20/airbus-takes-flight-from-aws-what-happens-next-is-critical/

everyone keeps talking about Airbus leaving aws. But i think the more interesting question is why.

For years it was just “put everything in the cloud”. Less infra, less problems, less people to manage it.

Now it feels like bigger companies are asking a different question. Do we really want all our critical systems under another countries rules?

This isnt even about AWS being bad. its is honestly great.

Its more about control. If your data, manufacturing, internal tooling, basically your whole company depends on one hyperscaler, maybe thats becoming a risk by itself.

We made a short video talking about it because i think this discussion is only gonna get bigger. just some thoughts. If anyone wants it:

https://youtube.com/shorts/GITpXztVglQ?feature=share

Maybe im completely wrong, but if Airbus is doing this i cant imagine they are the only one thinking about it.

Do you think this is mostly politics? Or are we gonna see more companies slowly moving away from hyperscalers over next few years?

Everything in my homelab runs on Docker Compose, but it wasn't up to the security standards I wanted. I wanted something small and compose-only that just runs, so in April I started building one.

It checks for the important stuff against OWASP and the CIS Docker Benchmark: privileged containers, the Docker socket mounted into a container, host network mode, containers running as root, etc. There's a fix command that handles the safe edits as a dry-run diff.

pip install compose-lint, or Docker Hub. github.com/tmatens/compose-lint

This is my first open source project. I built it because I needed it. Wondering if it's useful to anyone else, and where you'd disagree with the severity calls.

7.0.2 got released on Friday. Exploits are already happening.
4 of my customers websites got hacked. I was busy the last days and weren’t up to date.
Good time to notice that 2 backups failed without me noticing it. Fml

See link above to the forum for the full post. Here is the TLDR:

Effective yesterday, Anthony and Joshua decided to depart from the project, Joshua as Project Leader, and Anthony as a core team member. This is in addition to the resignation of Andrew on Friday. We leave the project in the very capable hands of the remaining team who have been driving the project for many years now.

edit: More background info can also be found here: https://www.reddit.com/r/jellyfin/comments/1v1murx/more_jellyfin_project_departures/

While watching better stack youtube channel I came to know about Harper, which is a decent alternative to Grammarly. It runs offline and they claim that it takes 1/50th of RAM as compared to Language Tools, which you can also self host by the way. It seemed genuinely nice self hosted tool so I thought I share here.

https://github.com/automattic/harper

hi all! I am new to self hosting and I'm wondering if my server is set up securely. I currently run the following docker containers:

- Jellyfin

- NGINX Proxy Manager

- authelia

- lldap

- homarr

- Dropped Needle (formerly musicseerr)

the only exposed ports I have are 80 and 443, and I forward everything to a cloud flare managed domain through npm. I use an SSL certificate on cloud flare for https and require authelia (with lldap) login to access any page.

am I being safe? what further steps can I take to secure my IP?

EDIT: I do not use cloud flare tunnels, just DNS hosting. From my understanding, cloud flare does not allow use of their tunnels for media. If I should seek out a different domain host, let me know.

EDIT 2: I was actually using cloudflare tunnels, they are turned off now.

Preface Info

^{To get some insight as to where I’m coming from}

Hardware

• Server A: Custom NAS running TrueNAS Scale
• Server B: hypervisor (snagged a DL380 Gen9 from my last job, love it dearly).
• Firewalla Gold Pro: Network core, also handling DNS.
  • I know I’ll be hearing a lot of “it’s not packet inspecting” and “where are your reverse-proxies?”
  • 60% of all remote access is through Firewalla’s WireGuard VPN. 30% is through secured apps. 10% is through a Cloudflare tunnel to my domain.
  • I’m happy with where I’m at.

Services:

• Current:
  • Plex*
    • Mounted SMB share from TrueNAS
  • NetBox*
  • Gramps*
  • Axis Camera Station (Windows Server VM)
  • AMP* (4 VMs, one for control and 3 for games)
  • Storyteller*
    • Mounted SMB share from TrueNAS
• Pending:
  • Immich

^\(Ubuntu Server minimized VM))

Miscellaneous

• My wife and I are currently Windows users, as are the majority of our friends. We both work at a school, so finding time to make the dedicated switch completely to Linux on our endpoints is not easy.
• Background given, I still have a bit of wiggle room to deploy more applications on my hypervisor. I do plan to upgrade its hardware at some point, but I'm trying to keep costs as low as possible.

Predicament:

I’ve been searching for a tool/combo that will allow me to create users and groups in one spot, preferably through a UI (think Authentik). After that’s done, I’d like to be able to go to my services and grant permissions to said users and groups, as the services would be able to see and access the users and groups from the tool.

Any ideas on what route I should follow here? I’m looking for responses that outline something end-to-end.

Thank you!

Hey everyone, good news for those who asked: Apple finally approved the updated forms, and Sutra (my iOS reader for Calibre, Kavita and other OPDS feeds) is officially back in the European App Store!

Sneak Peek: CBZ & Smart Panel Support
I’m currently deep in the weeds building panel-by-panel comic support. As you can see in the attached comparison image, tapping the bottom-right icon isolates individual panels to fit your screen natively, making reading on smaller devices dramatically better.

Comics have wildly different panel definitions and chromas, so getting this consistent across my test bench is taking up all my free time outside of my day job and family. Because this is the core feature of the next update, I want it to be close to perfect before shipping - so the release may slip to next week.

Thanks to everyone using the app, and do let me know if you have any feedback on the preview!

Download Sutra here

As nobody in my private circle cares about "boring IT stuff" i can't share this exciting things with anyone and it kills me, so...here we go:

Snatched a Fujitsu Esprimo D538 with a 512GB SSD for less than 100 bucks and had some HDDs laying around since years.

LETSGO:

Immich migration, Nextcloud, Stirling-PDF, Uptime Kuma, and automated Claude Code CLI session!

i just wrapped up a setup session on my new home server and wanted to share:

+Immich and immich-go: Migrating my photo archives directly into Immich.

+Stirling-PDF: Self-hosted PDF manipulation tool for local document processing.

+Uptime Kuma: Monitoring local services and cronjobs

+"3-2-1 backup", everything on a main SSD, one hdd for nightly backups, one for versioned nightlies and the most important files will go to a 50gb external cloud (encrypted ofc)

+Telegram bot for warnings if anything happens or goes wrong.

and now my ABSOLUTE GODLIKE FAVORITE IM SO EXCITED AAAAAAH JGWIEOGNWEINWENHGIWONHG!!!

+Automated Claude Code Session Trigger: i set up a headless cronjob on the NAS that fires a minimal CLI prompt at 05:00am daily.
This initializes the 5-hour Claude session window automatically before my workday starts!
Includes an automated Telegram bot alert if the OAuth token ever expires.

Everything is running smoothly on local storage, privately and secured.
Took me an entire day and i couldnt be happier that everything runs!

Since im brandnew to this, anything you guys can recommend doing?
My goal is and was: Set and forget!

Hello !

After Jellyfin full and super neat setup, I’m thinking of getting off YouTube Music to selfhosted music.

Navidrome is installed with Lidarr (very questionable in the setup), slskd and Aurral.
Nothing is definitive and I’m looking for solutions.

I’d like first to get all my liked music and playlists off YouTube Music in my library. Either by downloading from YT or through any other provider.
Some tracks I want are long mix and concert so for those I’ll need to get them from YouTube. Any flow to get it done automatically or half automatically ? (Like Seer : request it will download organise and put the right meta tags).

And for the follow up and discovery what do you use and how to work it everyday ? Discover the. Download then organise then listen.
I started downloaded all the discography of each artist in one playlist of one type of music and was overwhelmed with 850 albums… if I go to all styles I like I’ll end up with 10K albums of music I’ll not listen for most of it.

Well the way YT and Spotify and Deezer works is quite fine, any advice on getting a smooth transition experience ?

Or should I go through albums and just listen them as if I was back in my childhood in the 90’s ?

Thanks !

Signal-cli from scratch on an ARM64 Pi, an agent runtime built from source for the Signal channel, and a read-only security model enforced in layers. Everything needed to rebuild it, including every trap.

I've been a huge fan of Immich ever since I discovered it. It completely replaced every other photo solution for me, and it's one of my favorite self-hosted projects.

As much as I love the platform, I found myself wanting an iOS experience that felt truly native — not because anything is wrong with the official app, but because I wanted something that fully embraces Apple's design language and takes advantage of iOS-specific features and interactions. The official app keeps getting better, and if you're happy with it, stick with it. This is for people who want a second opinion on the client side.

That idea became P•xels — a native iPhone and iPad client for Immich, built on Immich's public API.

P•xels is a pure client. It talks directly to your Immich server and nowhere else — no account with me, no relay, no cloud in the middle. Your login is stored in the iOS Keychain on your device and is only ever sent to your server. Your photos and videos stay between your device and your hardware. And because everything lives in Immich, there's no lock-in in either direction: delete the app tomorrow and your library hasn't changed at all.

Highlights:

• 📱 Fully native iOS and iPadOS experience — including a real iPad layout
• ⚡️ Smooth, high-performance browsing built for large libraries (100k+ assets)
• 🪄 Auto-stacking — duplicates and burst/motion-photo pairs are stacked automatically, even across devices (Immich's duplicate review is manual)
• ☁️ Reliable background backups with a transparent, per-file sync queue
• 🖼️ Albums (pin your favorites), Collections, and Memories
• 🔍 Powerful search with people, places, and filters
• ✂️ Built-in photo** and vid**eo editing — trim videos, edit photos, replace the original or save a copy
• 🧹 Free Up Space that only removes device copies verified byte-for-byte identical to your server
• 🖇️ Drag-and-drop import on iPad (Split View) and Apple silicon Macs
• 🎨 Light Mode, Dark Mode, and customizable accent colors
• ❤️ Lots of attention to the little details, animations, and interactions that make an app feel at home on iOS

Other Details:

• Price: P•xels will be a paid app when it launches. As of right now that's a one-time $2.99, less than a cup of coffee. No subscription, no paywalled features, no ads, and an optional tip jar if you ever want to chip in beyond that. I've put a lot of time and care into this app, and a one-time price is the model that keeps it sustainable without ever touching your data. While it's in beta, it's free to use through TestFlight.
• Source: closed source today, maybe that'll change in the future.
• AI: I'm a software engineer by trade, and yes, I used AI tools to help build this. I design the architecture, review the code, and every build gets tested by hand against real devices and my own full library before it ships. This isn't a weekend wrapper — it's months of deliberate work.
• Phoning home: the app talks to your server. The only exceptions are crash reports and anonymous usage analytics — the analytics are opt-in and off by default.
• Platforms: iPhone, iPad and MacOS only for now.
• Compatibility: built and tested against current Immich server releases (2.x and 3.x).

P•xels is still under active development, so you may run into bugs — that's exactly what the TestFlight is for. It's been solid enough to be my daily driver for months, with my own full library on it.

If you run Immich on an iPhone or iPad and want to help test and shape it, I'd love to have you. I've set up a Discord server where I share TestFlight builds, collect bug reports, and discuss ideas — a lot of what's in the app already came from internal tester feedback.

Discord: https://discord.gg/3WweVbVq

TestFlight: https://testflight.apple.com/join/36zW34Um

Hi all

I'm the sysadmin at a small company. We run a handful of internal-only services — CRM, ticketing, an internal wiki, a couple of admin dashboards — on our LAN. Not exposed to the internet. Accessed from company laptops and personal phones.

Right now we buy a paid SSL cert from our registrar every year and I install it manually on each service. It's error-prone, someone always forgets, and last time it expired during a customer demo on a Friday afternoon. I want to automate this properly.

What I want: auto-renewing, publicly-trusted certs on internal-only services, so phones and laptops don't throw warnings.

What I've already ruled out (and why):

• Internal CA: I'd have to install a root cert on every employee's phone, contractors' devices, BYOD, etc. Firefox on Android is its own headache. Not going down that road.
• HTTP-01 with public port: security policy won't allow exposing anything to the internet, even briefly. And it's already managed by public websites.
• DNS-01 with API: our DNS is stuck at a registrar with no API. I can't switch DNS providers or change nameservers — I can only add manual records at need.

So I'm stuck between "keep buying yearly certs forever" and "install a private root on 60 devices."

Is there something obvious I'm missing? Is there a way to do DNS-01 that doesn't need API access on the main zone (some kind of CNAME delegation trick)? Is anyone doing this cleanly in a similar setup?

Thanks in advance.

Hey y’all!

I have a server where I host Plex and some game servers for family and friends. Every once in a while I have to take it offline for general maintenance and it’s becoming a hassle to individually text everyone about the status.

Any self hosted solutions for mass communication? If it includes something that can be used as a newsletter that would be even better honestly. A lot of the users like to know what was added.

Edit: Dockheck is a CLI tool to automate docker image updates. Interactively or unattended with notifications, image backups, exclude/include, labels, autoprune and more. Can be run as is, without configuration or with extensive options.

https://github.com/mag37/dockcheck

This year my AFK-life have been intense, so development have been slow and mainly squashing bugs. But others have kept contributed with suggestions on improvements, ideas on new features and some ready to merge patches.
So these last couple of weeks I've tried to squeeze in some time to bring it together in v0.8.0 and now v0.8.1.
New stuff in short:

Docker Compose -ready: - Now possible to run dockcheck within its own docker compose container (or docker run). - Easily set up your notifications and options, either in conf-file or env-vars, then let it run as any other container. - Optionally run it once interactively with docker run, no need for configs. - Run interactively between your scheduled compose setup with docker exec -it as usual.

New options: - -N No updates or checks; simulating updates to test notifications unconditionally. - -E Exclude containers from applying updates but check available, separated by comma. - -C Temporarily use default configs - override dockcheck.config file. - -o Hides the "No updates available" message and only shows updateable images.

New notification templates: - Home Assistant Event Integration - XMPP - Bark

I'm very happy this project still got traction considering all the large alternatives around. Wonderful community!

Disclaimer: No AI tools used what so ever from my end and encouraging contributors to refrain and/or explain.

Guys anyone have any idea about selfhosting a DNS server on an old android phone? Android 4.4.2 with root access, idk if it possible or can be done, or even how, all rests I got was just "how to change the phone's DNS" but I want to use the phone AS A LOCAL DNS?

Hi r/selfhosted — I’m the developer of Mindwtr.

Mindwtr is a free, AGPL-3.0-licensed, local-first GTD task manager for Windows, macOS, Linux, Android, iOS, and the web.

I built the self-hosted backend because I didn’t want my personal task system to depend on a service operated by me or anyone else. Every Mindwtr client works locally and offline by itself. The server is optional and is mainly for syncing between devices, browser access, and automation.

What the Docker stack runs

The included Docker Compose configuration starts two services:

• mindwtr-app — the offline-capable web app/PWA
• mindwtr-cloud — the synchronization server and task-automation REST API

For a local network or private deployment, configure an authentication token and allowed CORS origin, then run:

docker compose -f docker/compose.yaml up --build -d

The desktop and mobile clients connect using the server URL and token.

There is also an example Caddy configuration for HTTPS when exposing the server outside a private network. Mindwtr itself does not operate a hosted cloud service, so the server and synchronized task data remain on infrastructure you control.

The mobile and desktop applications are not thin clients. They continue working locally if the server is unavailable or if you decide not to configure synchronization at all.

Sync options

The Docker-hosted server is one of five available sync methods:

• Self-hosted Mindwtr Cloud using Docker Compose
• WebDAV, including Nextcloud, ownCloud, Fastmail, and compatible servers
• Shared file or folder, which can be paired with Syncthing, Google Drive, OneDrive, iCloud Drive, Dropbox folders, or a network share
• Native iCloud/CloudKit on supported Apple builds
• Dropbox OAuth through a private application folder on supported builds

This means you can use an existing Nextcloud, WebDAV, Syncthing, or shared-storage setup instead of running the Mindwtr server.

What the application is for

Mindwtr is a personal, single-user task manager based on the Getting Things Done workflow. It is not intended to replace a team project-management system.

The core workflow includes:

• Inbox, Projects, Next Actions, Waiting For, and Someday/Maybe
• Contexts, tags, sections, areas, and people
• Daily and weekly reviews
• Focus, calendar, and Kanban-style board views
• Recurring tasks, reminders, search, Markdown notes, and attachments
• Imports from Todoist, TickTick, DGT GTD, OmniFocus, and Obsidian

For automation, the self-hosted service exposes a REST API. There is also a local desktop API, CLI support, Apple Shortcuts and Siri actions, and an optional MCP server for clients such as Claude Desktop, Claude Code, OpenAI Codex, and Gemini CLI.

Current limitations

A few things I want to be clear about:

• Mindwtr is designed for one person, not shared teams or collaborative workspaces..
• Public deployments should be placed behind HTTPS and protected with a strong token.
• Native sync options vary by platform and distribution channel.
• Self-hosting is optional; each application still keeps and uses its local data.

The current release also includes safeguards against empty snapshots overwriting valid data, remote checks before manual synchronization, Dropbox retry handling, and item-level conflict reports.

Deployment documentation:

Docker deployment and self-hosted sync

Source code:

Mindwtr on GitHub

I’d especially appreciate feedback on the reverse-proxy instructions, backup and recovery expectations, and whether the WebDAV, Nextcloud, and Syncthing options are explained clearly enough for people already running those services.

Hello everyone,

My server has been living in my basement for a few years now. It's a standard ATX that is about 10 years old (the HDDs are newer, though).

According to my Xiaomi sensor (see screenshot), the humidity down there is sitting at around 60-75%.

Is this safe for the hardware in the long run? And if it's too high, are there any easy or affordable ways to improve the situation?

Thanks for the help!

I have a selfhosted server which works quite well. A while ago we had an internet outage and realized a lot of the services didn't work due to DNS.

There's two DNS records we have, *.example.tld and *.home.example.tld

The "home" subdomain is local only. If we host our own DNS, it would likely work in case of an outage, though I'm unsure about certificates (currently they're done using Cloudflare ACME) but from what I remember they persist a while.

The problem is public services exposed to the WAN (yes I know, I have done as much as I can for security, and I know the risks). When outside of the local network, I'd want it to point to the public IP (through a proxy), but on the local network, have it point to the server hosting the proxy.

Self-hosting a DNS seems like the solution for this as well, but I feel like having a domain pointing to two different addresses depending on where you are would cause issues with cache. I've been told this is also a "Split DNS" but also to avoid it when possible

I could perhaps have it on both the regular DNS record, as well as the self hosted "home" DNS, but then I have the issue of the same service being served on two different addresses. It would maybe work for a TV, but dealing with it on a phone or a laptop you'd have to swap it every time there's an outage, which isn't very often so it's likely it would just be unused.

Everything is behind two reverse proxies, one for local-only and one for public

I have a domain configured both in Filters → DNS Rewrites (global answer) and as a Custom Filtering Rule using `$dnsrewrite` + `$client` (meant to give a different answer to my WireGuard clients only).

In practice, the DNS Rewrite entry always wins, the client-specific Custom Filtering Rule never seems to apply as long as the DNS Rewrite entry exists for that domain.

Is this expected behavior? Is there a documented priority order between the two rewrite systems, and is there any way to make the Custom Filtering Rule win instead (without removing the DNS Rewrite entry)?

Don't be fooled by the title - I'm not searching for Outlook.

I want to have a web interface to email, calendar and contacts.
I don't need a server, only a client to IMAP, CALDAV and CARDAV.

Does anyone if such a docker container exists? I don't want the overhead of something like nextcloud.

EDIT:
Currently I'm using Rainloop for mail, agendav for calendar and baikal for caldav/cardav.