I run a small personal cloud off a single VPS. One Ubuntu box, a couple dozen containers, and a stubborn preference for owning my own data. This site sits on it too, but honestly the site is the least interesting tenant. The interesting part is everything around it.
Here's roughly what's on the box and how it fits together.
Caddy does the boring part well
Every service binds to a localhost port and nothing else. Caddy sits in front, terminates TLS, and reverse-proxies each hostname to the right port. Auto-HTTPS means I have never once thought about certificates. One Caddyfile, one place to add the next thing.
What I actually run
The stuff I use most days:
- Karakeep for bookmarks, with its own search. The /bookmarks page on this very site pulls straight from it over the API, so that graph is my actual saved links.
- FreshRSS and RSSHub for reading the web on my terms. RSSHub turns sites that dropped their feeds back into feeds.
- CryptPad and PrivateBin for the quick shared doc or the throwaway paste I'd rather not hand to someone else's server.
- Stirling-PDF for the endless little "merge these, rotate that, compress this" PDF chores.
- n8n for the automations I'd otherwise forget to run by hand.
The stuff that watches the box:
- Uptime Kuma pings everything and yells when something is down.
- Beszel and Portainer for the health of the host and the containers.
And a few odd ones, like TeslaMate quietly logging my car's trips to its own database.
Keeping it private
Almost none of this is meant for the public internet. Tailscale puts the whole box on a private mesh, so I reach the admin dashboards from my laptop or phone without opening a single port to the world. The handful of things that do face out sit behind authentik, so they share one SSO instead of a dozen passwords.
Scale to zero
Some of these I touch once a month. Leaving them running full-time is wasteful, so the rarely-used ones sit behind Sablier: it spins the container down when nobody is using it and back up on the next request. A couple of seconds of cold start in exchange for a quieter, cooler box. Good trade.
Backups, the part everyone skips
A couple of systemd timers do the unglamorous work every night: a database dump with two weeks of history, and a snapshot of the whole box. Neither has ever saved me. That is the point. I would much rather have them sitting there unused than find out the hard way. I even test that they restore, which is more than most backups ever get.
Why bother?
The honest answer is that I like it. Every service here is something I could get for free somewhere else, usually with a nicer UI and zero maintenance. But I like knowing exactly where my bookmarks, my reading, my notes, and my files actually live. I like that adding a new tool is a few lines in a Caddyfile instead of a signup form and a subscription. And on a slow evening, tinkering with the box is a genuinely good time.
One box to run, and one box to lose, which is exactly why the backups aren't optional and Tailscale isn't a luxury. Everything in its place, all of it mine.