Servers & Self-Hosting

Official install page for the Pi-hole network-wide ad blocker, offering a one-line installer, a clone-and-review route, or Docker. The page itself notes that piping a script to bash is controversial, so the download-and-read option is there if you want to inspect it first.

A poster shares his single compose file running Pi-hole and Unbound as two containers on one bridge network, with Pi-hole's upstream pointed at Unbound and the listening mode set to all. Replies note there is no official Unbound image, that container names can replace fixed IPs, and that the web password can be set through an environment variable. Check it against current Pi-hole v6 settings.

A home-server design thread about where to keep media for Plex/Jellyfin on Proxmox. Responders suggest mirroring the NVMe with ZFS, running Docker apps in a VM (or apps in LXCs), sharing storage to them by NFS or virtio-fs, a separate VM or container for SMB, and putting any VPN on a pfSense or OPNsense gateway. Opinions differ, so treat it as discussion rather than a single recipe.

An older ServeTheHome thread where the poster plans three Proxmox nodes backed by shared NAS storage. Replies recommend skipping hardware RAID, letting the Proxmox installer build a ZFS mirror for the boot disks, and using small enterprise SSDs instead of old 15K SAS drives. Hardware advice dates from the thread's era, so check current parts.

A quick fix for a NAS share that Windows refuses to open: stale saved credentials. The answer deletes the NAS entries from Credential Manager and reconnects. One commenter says it fixed things in seconds, while another reports it did not work for them.

Microsoft's reference for checking and changing SMB protocol versions on clients and servers. It says SMBv1 has serious security flaws and is not installed by default in Windows 11 or Server 2019 and later, so old NAS boxes should be updated rather than re-enabling it. It also warns that SMB signing is required by default on Windows 11 24H2 and Server 2025, which can block connections to some third-party servers.

SambaWiki guide to running Samba on a Linux box that is not in a domain, with one guest share and one password-protected share. It covers creating smb.conf, Samba users, groups, share permissions with setgid, validating with testparm and testing with smbclient. Guest shares are flagged as a security risk, and recent Windows clients may refuse guest access over SMB2/3.

A thread about a legacy NAS that stopped mapping after the September 2025 Windows cumulative updates. The answer explains the client now rejects SMB1 negotiation, offers re-enabling the SMB1 client as a not-recommended workaround, and advises updating the NAS firmware to SMB2/3. A second reply says Microsoft has begun blocking even manual re-enabling, and the original poster's NAS had no newer firmware, so replacing it may be the only fix.

A Windows 11 client could not reach an SMB share and net view returned error 53. The most-endorsed answer adds the share's address and credentials to Windows Credential Manager so Windows authenticates correctly.

A 2017 community how-to that installs Proxmox VE, builds a RAIDZ2 ZFS pool, creates datasets, shares them with Samba and maps the share from Windows. It is dated (Proxmox 5, Ubuntu 16.04) and the examples use weak sample passwords and wide-open 0777 Samba masks, so tighten those. Pool creation and the installer can wipe disks, so double-check device IDs.

A hands-on tutorial that builds a small Flask app with a Redis counter and runs it with a compose.yaml. It covers health checks, Compose Watch for live updates, persisting data in a named volume, splitting config files and inspecting a running stack with logs and exec.

Official install guide using Docker's apt repository, which installs the engine, CLI, containerd, buildx and compose plugins. It warns that with ufw or firewalld, published container ports bypass your firewall rules, and that Docker only supports iptables-nft and iptables-legacy.

A discussion of how to update a container when its image changes. Answers say to stop the old container first if ports are exposed, manage containers with Compose, rebuild with --no-cache --pull for evergreen tags, and that reusing the same tag breaks image immutability, so explicit version tags are preferred.

Docs on persisting container data with volumes, which Docker calls the preferred mechanism, versus bind mounts that tie you to the host's folder layout. Mentions read-only mounts, subdirectory mounts, volume drivers for NFS/CIFS, and the gotcha that mounting over a non-empty directory hides its existing files. Volumes are not removed automatically when a container is deleted.

Explains how Docker's iptables rules interact with host firewalls. Published ports are handled in the nat table before ufw's chains see the traffic, so a port you publish can be reachable even if ufw seems to block it. The page advises against editing Docker's rules or turning off its iptables management. Treat any published port as exposed to your network.

Clear walkthrough for creating an Ed25519 SSH key pair, protecting it with a passphrase and loading it into ssh-agent on Linux, macOS and Windows. It is written for GitHub, but the key generation and agent steps apply to logging in to your own servers with keys instead of passwords.

Shows how to create a private tailnet by installing the Tailscale client on two devices and signing in with the same identity account, then points to follow-ups like MagicDNS, exit nodes, subnet routers and access policies. A VPN-style overlay like this is a safer way to reach home services than opening ports on your router.

Microsoft's steps for changing the RDP listening port from the default 3389 using PowerShell or the Registry Editor. Moving the port is a configuration tweak, not real protection, so still keep RDP off the public internet and reach it through a VPN such as WireGuard or Tailscale.

Explains how one Tailscale device can advertise a whole LAN so you can reach printers, cameras or a NAS that cannot run the client. You need IP forwarding on the router device, approval of the routes in the admin console, and access rules that permit the traffic. Approving a route does not grant access by itself.

The poster moves Pi-hole onto its own Tailscale node by sharing the Tailscale container's network (network_mode: service:tailscale) and tagging it. The caveat reported is that query logs then show all requests from localhost instead of the real clients, and the thread is an open question rather than a settled solution.

The project's own quick start: generate a private and public key pair with the wg tool, create a wg0 interface, assign an address, configure a peer, bring it up and verify with wg show. Keep the private key file readable only by you.

Wiki page covering the Proxmox VE installer: boot the installer, pick a target disk and filesystem (ext4, xfs, ZFS, or btrfs as a tech preview), set the root password and network, then manage it at https://<ip>:8006. The install wipes the selected drives, and ZFS on top of hardware RAID is not supported.

How to install UTM, the virtual machine app for Mac. The Mac App Store version gets automatic updates, while the GitHub DMG is the same build you update by hand. Your VMs are kept when you update, and macOS 11 users are limited to v4.7.5.

Describes VirtualBox network modes: NAT (default, outbound only unless you add port forwarding), bridged, internal, host-only and NAT network. Pick bridged when the VM must be a full peer on your LAN, and NAT when it only needs internet access.

A step-by-step NVIDIA passthrough write-up on Proxmox VE 8.4.9 using Intel VT-d: update BIOS, enable IOMMU in GRUB, create a q35/OVMF VM, blacklist nouveau and nvidia on the host, bind the GPU to vfio and add a hostpci line to the VM. Comments add that vfio_virqfd can be omitted on current releases and that Secure Boot can interfere with guest driver installs.

A tutorial for pulling single files out of a Proxmox VM backup without restoring the whole VM: decompress the .vma.zst, extract the VMA to a raw image, map its partitions with kpartx, mount one and copy files out. The author skipped installing the vma tool on a non-Proxmox machine because its pve-qemu-kvm package has too many dependencies, so run that step on a PVE host.

A solved thread on giving an unprivileged LXC write access to a host folder. The author maps GID 1000 straight through with lxc.idmap, allows it in /etc/subgid, creates a matching datauser group in the container and finally adds root to that group, which was the missing piece.

An iSpyConnect camera-database page that doubles as a short guide to adding an IP camera to Agent DVR using the IP Camera Wizard or an ONVIF scan, then choosing an RTSP URL (port 554 here). The URLs are crowdsourced and may be out of date, and the site says your camera credentials stay on your machine.

Advice on configuring cameras for Frigate: prefer H.264 video with AAC audio, use a low-resolution sub stream for detection and a high-resolution main stream for recording, keep the same aspect ratio on both, and set frame rates in the camera rather than in Frigate.

How to run Jellyfin in Docker with persistent config and cache folders, media bind mounts (optionally read-only), ports 8096/TCP and 7359/UDP, and a restart policy. Host networking is only needed for DLNA. Containers are only supported on Linux hosts; Windows and macOS users are told to install natively.

On an Intel N100, VA-API worked in the Jellyfin container but Quick Sync did not. The fix (from moderator TheDreadPirate, confirmed by the poster) was to find the host's render group ID and add it under group_add in the compose file, with the /dev/dri device mappings left in place; another reply advised against chmod on the devices because it resets on reboot.

Install guide for the Frigate NVR, which runs as a Docker container and works best on a bare-metal Debian-based host. It covers storage paths, ports, a shared-memory size that is too small by default (Docker's 64 MB), and warns that LXC is not officially supported and that port 5000 is unauthenticated, so reverse proxies should use 8971.

Guide to enabling Quick Sync or VA-API transcoding on Intel iGPUs and Arc cards, including the Docker route of passing the render group and /dev/dri device into the container and verifying with vainfo. QSV is not available on Windows Docker or WSL, and older chips are losing QSV support on Linux.

ssh-keygen -p changes the passphrase on an existing key without generating a new one, so servers that already trust the key keep working. Use -f to choose a key file other than the default.

SSH refuses config and key files that other users could read or write. The answer sets the config to 600, checks the files belong to you, and includes a table of the correct permissions for the .ssh folder (700), private keys (600) and other files.

Explains RFC 1918, which reserves address blocks (10.x, 172.16-31.x and 192.168.x) for private networks, and how NAT on your router lets every home reuse them. Includes the history of why it works this way.

A detailed explanation of how multi-access-point Wi-Fi works: give every AP the same network name, security type and password, connect them all to the same wired network, and let devices pick the strongest one. It covers the settings that must match and how channels should differ.

A step-by-step guide to installing Proxmox from Home Tech Automation.

TechWorld with Nana covers Docker Compose as part of her Docker tutorial series.

Christian Lempa explains the Docker network types.

Pi My Life Up shows a WireGuard VPN setup using Docker and WG-Easy.

Tailscale's own video on getting started with Docker and Tailscale.

Tailscale shows how to install Tailscale in an LXC container on Proxmox.