Self-Hosting on Aquasp's blog

Fixing Blank/Grey Screen on Album Pages in Finamp (Jellyfin Music Player)

Mon, 15 Dec 2025 15:02:30 +0000

If you’re using Finamp to stream or download music from your Jellyfin server and encountering a blank (or grey) screen when opening an album page—where no tracks load and you may need to force-close the app—this is a common issue, especially after upgrading Jellyfin to version 10.11.x.

This problem typically occurs due to changes in how Jellyfin handles music metadata in newer versions, causing Finamp to fail loading album tracks properly.

The Fix: Refresh Metadata in Jellyfin (Search for Missing Metadata)

The most reliable workaround is to force Jellyfin to refresh your music library metadata:

Log in to your Jellyfin web dashboard (admin account recommended).
Go to Dashboard > Libraries.
Select your Music library.
Click the three dots (…) menu next to the library name.
Choose Refresh Metadata.
In the refresh options:

Check Search for missing metadata.
Optionally enable other options like “Replace existing images” or “Replace all metadata” if needed.

Click Refresh (or OK) to start the scan.

Note: This process can take several minutes depending on your library size. Once done, restart Finamp and try opening albums again—they should now load tracks normally.

Additional Notes on Jellyfin 10.11.x

The Finamp team and users have reported performance regressions in Jellyfin 10.11.x, particularly with music libraries (slower loading, higher resource usage).
If possible, consider staying on or downgrading to Jellyfin 10.10.x for better performance until fixes are fully rolled out in later 10.11 patches.
For me. I can confirm that even on the latest 10.11.x, the metadata refresh resolves the blank album issue, and overall functionality works well afterward.

Credits

GitHub Issue: https://github.com/jmshrv/finamp/issues/1412

If the issue persists after the scan, check for Finamp updates or report it on the Finamp GitHub repository. Happy listening! :)

How to easily export and import docker volumes

Tue, 09 Dec 2025 01:22:26 +0000

If you’re like me, you prefer to run everything in Docker containers. They’re fast, isolated, and perfect for running multiple apps on one VPS.

But what happens when you want to:

Move a container to a new server?
Backup a database volume (NextCloud, PhotoPrism, Vaultwarden, etc.)?
Restore data after a crash?

Docker doesn’t include a built-in “export volume” button — but there’s a super simple and reliable trick using a temporary Ubuntu container.

Let’s go!

Step 1: List Your Volumes

docker volume ls

Example output:

DRIVER VOLUME NAME
local nextcloud_data
local photoprism_storage
local vaultwarden_data

Pick the one you want to export (e.g., nextcloud_data).

Step 2: Export a Volume → backup.tar.gz

Run this one-line command (replace nextcloud_data with your volume name):

docker run --rm -v nextcloud_data:/data -v "$(pwd)":/backup ubuntu \
 tar -czf /backup/nextcloud-data-backup.tar.gz -C /data ./

What this does:

Mounts your volume to /data inside a temporary container
Mounts your current folder to /backup
Creates a compressed archive of the entire volume

After it finishes, you’ll have a file like: nextcloud-data-backup.tar.gz ← ready to download or move!

Pro tip: Add the date for clarity

docker run --rm -v nextcloud_data:/data -v "$(pwd)":/backup ubuntu \
 tar -czf "/backup/nextcloud-data-$(date +%Y-%m-%d).tar.gz" -C /data ./

Step 3: Import on the New Server

Copy your backup.tar.gz file to the new server (via scp, rsync, etc.)

Then, create the empty volume (important!):

docker volume create nextcloud_data

Run the import command (from the folder containing the backup file):

docker run --rm -v nextcloud_data:/data -v "$(pwd)":/backup ubuntu \
 tar -xzf /backup/nextcloud-data-2025-04-05.tar.gz -C /data

Done! Your volume is now fully restored.

Never let Docker auto-create the volume during import — it can cause permission issues or merge problems.

Bonus: Using External Volumes with Docker Compose

If you’re using docker-compose.yml, tell Docker that the volume is external (already exists):

services:
 nextcloud:
 image: nextcloud:latest
 volumes:
 - nextcloud_data:/var/www/html

volumes:
 nextcloud_data:
 external: true

Indentation matters — use exactly two spaces.

Real-World Use Cases

Migrating NextCloud to a new VPS
Backing up Vaultwarden before upgrading
Moving PhotoPrism library to a bigger server
Disaster recovery

This method is 100% reliable, works with any volume, and requires zero extra tools.

You now have a bulletproof Docker volume backup strategy.

Happy containerizing! 🐳

Thank you for reading!

How to easily self-host at home and put your projects online under CGNAT

Tue, 09 Dec 2025 01:13:41 +0000

Introduction

Want to run heavy services on a powerful server at home, even though your ISP puts you behind CGNAT? This guide shows you exactly how to put them online — the old-school, bulletproof way using SSH reverse tunnels.

No Cloudflare Tunnel. No Ngrok. Just SSH + systemd.

The Downsides (and Why They’re Manageable)

Home internet isn’t datacenter-grade (outages happen)
Most ISPs use CGNAT → you can’t open ports normally

Solution: Use a cheap VPS as a public “jump box”. Your heavy server stays home. The VPS only forwards ports.

How It Works – The Magic of Reverse SSH Tunnels (-R)

Internet → Cheap VPS (public IP) → SSH reverse tunnel → Your home server (behind CGNAT)

Your home server initiates an outbound SSH connection to the VPS and says: “Anything that hits port 8096 on you → send it to my local Jellyfin on 8096”

Zero ports opened on your home router. Zero exposure.

Step-by-Step Setup

1. On Your Home Server (the powerful one)

# Create folder for tunnel configs
sudo mkdir -p /etc/sshtunnels

# Example: expose Jellyfin (port 8096)
sudo nano /etc/sshtunnels/jellyfin.conf

Content of the file:

8096:8096 # remote_port:local_port
443:8443 # optional: HTTPS reverse proxy on VPS → your local 8443
80:8080

One line per service. First number = port on the VPS, second = port on your home server.

2. Generate an SSH Key (if you don’t have one)

ssh-keygen -t ed25519 -C "home-server-tunnel"

Copy the public key to your VPS:

ssh-copy-id user@your-vps-ip

3. Create the Tunnel Manager Script

sudo nano /usr/local/bin/sshtunnel.sh

#!/bin/bash

# === EDIT THESE ===
REMOTE_USER="root" # or your VPS user
REMOTE_HOST="123.45.67.89" # your VPS public IP
SSH_KEY="/home/youruser/.ssh/id_ed25519"
SSH_PORT="22" # change if you use a non-standard port
# ==================

INSTANCE="$1"
CONFIG_FILE="/etc/sshtunnels/${INSTANCE}.conf"

if [[ ! -f "$CONFIG_FILE" ]]; then
 echo "Error: Config file $CONFIG_FILE not found!"
 exit 1
fi

# Build -R arguments
FORWARD_OPTS=""
while IFS=: read -r remote_port local_port; do
 [[ -z "$remote_port" || "$remote_port" =~ ^# ]] && continue
 # Clean any old process using the remote port
 ssh -p "$SSH_PORT" "$REMOTE_USER@$REMOTE_HOST" \
 "lsof -i :$remote_port -t | xargs -r kill -9" 2>/dev/null
 FORWARD_OPTS="$FORWARD_OPTS -R $remote_port:localhost:$local_port"
done < "$CONFIG_FILE"

echo "Starting tunnel $INSTANCE → $REMOTE_HOST ($FORWARD_OPTS)"

exec ssh -o StrictHostKeyChecking=no \
 -o ServerAliveInterval=30 \
 -o ServerAliveCountThreshold=3 \
 -o ExitOnForwardFailure=yes \
 -o GatewayPorts=yes \
 -N -T \
 -i "$SSH_KEY" \
 -p "$SSH_PORT" \
 $FORWARD_OPTS \
 "$REMOTE_USER@$REMOTE_HOST"

Make it executable:

sudo chmod +x /usr/local/bin/sshtunnel.sh

4. Create a Systemd Service (Auto-Start & Auto-Reconnect)

sudo nano /etc/systemd/system/sshtunnel@.service

[Unit]
Description=SSH Reverse Tunnel for %i
After=network-online.target
Wants=network-online.target

[Service]
User=youruser # ← change to your home user (not root!)
Group=youruser
ExecStart=/usr/local/bin/sshtunnel.sh %i
Restart=always
RestartSec=10

[Install]
WantedBy=multi-user.target

Reload and enable:

sudo systemctl daemon-reload

# Start a tunnel (example: jellyfin)
sudo systemctl enable --now sshtunnel@jellyfin.service

Check status:

sudo systemctl status sshtunnel@jellyfin.service

5. On the VPS Side (Optional but Recommended)

Install a tiny web server or Caddy/nginx to terminate TLS and proxy to the forwarded ports.

Example with Caddy (automatic HTTPS):

# On the VPS
apt install caddy

# /etc/caddy/Caddyfile
jellyfin.yourdomain.com {
 reverse_proxy localhost:8096
}

Now jellyfin.yourdomain.com → your home Jellyfin, fully encrypted.

All running on my beast home server behind CGNAT.

Pros of This Setup

Works behind any CGNAT / ISP block
No third-party dependency (no Cloudflare, no Ngrok)
Full encryption possible
Survives reboots (systemd + Restart=always)
Costs almost nothing

Final Words

This is the one really cool way I’ve found to self-host heavy services at home in 2025.

Your powerful hardware stays home. Your $1/month VPS is just a traffic cop.

Thank you for reading — now go build your unstoppable home lab!

How to Automatically Backup Your Self-Hosted Ghost Blog

Tue, 09 Dec 2025 01:05:55 +0000

Introduction

Ghost is an incredibly fast and elegant blogging platform. But unlike WordPress, it doesn’t have built-in one-click backup plugins.

That changes today.

In this guide, you’ll set up a fully automated daily backup system that:

Dumps your MySQL database
Backs up all themes, images, and content
Compresses everything into a single .zip
Uploads it securely to your cloud storage (pCloud, NextCloud, Google Drive, Dropbox, etc.)

All using free tools: rclone + a simple bash script + cron.

Let’s get started.

Step 1: Install Rclone

sudo apt update && sudo apt install -y rclone

Rclone is the Swiss Army knife of cloud storage — it supports over 70 providers.

Full list: https://rclone.org/overview/

Step 2: Configure Rclone (Connect Your Cloud Storage)

Run:

rclone config

Follow the prompts:

n → new remote
Name it something like ghost-backup or pcloud
Choose your provider (e.g., webdav for NextCloud, pcloud, google drive, etc.)
Enter your credentials/URL when asked

Test it works:

rclone ls ghost-backup:

You should see your remote files (or an empty folder if new).

Type q to quit.

Step 3: Get Your Ghost Database Credentials

su - yourghostuser
cd /var/www/ghost # or wherever you installed Ghost
cat config.production.json

Look for the database section. You’ll see something like:

"database": {
 "client": "mysql",
 "connection": {
 "host": "localhost",
 "user": "ghost_db_user",
 "password": "yoursecretpassword",
 "database": "ghost_prod"
 }
}

Write down:

Database name (ghost_prod)
Username (ghost_db_user)
Password

Step 4: Create the Backup Script

Create the script as root:

nano /root/backup-ghost.sh

Paste this (then edit the variables below):

#!/bin/bash

# === EDIT THESE VALUES ===
GHOST_USER="yourghostuser" # e.g. ghost
GHOST_PATH="/var/www/ghost" # path to your Ghost install
DB_NAME="ghost_prod" # from config.production.json
DB_USER="ghost_db_user" # from config.production.json
DB_PASS="yoursecretpassword" # from config.production.json
BACKUP_NAME="theselfhostingart-blog" # name for your backup zip
RCLONE_REMOTE="ghost-backup" # name you gave in rclone config
RCLONE_PATH="/" # folder in your cloud (use / for root)
# =========================

DATE=$(date +'%Y-%m-%d_%H-%M')
BACKUP_DIR="/home/$GHOST_USER/backups/$DATE"
ZIP_FILE="$BACKUP_DIR/$BACKUP_NAME-$DATE.zip"

echo "Starting Ghost backup: $DATE"

# Create backup directory
mkdir -p "$BACKUP_DIR"

# Backup database
echo "Backing up database..."
mysqldump -u "$DB_USER" -p"$DB_PASS" --add-drop-table "$DB_NAME" | gzip > "$BACKUP_DIR/db.sql.gz"

# Backup content folder (themes, images, etc.)
echo "Backing up content folder..."
rsync -av --exclude='logs' --exclude='cache' "$GHOST_PATH/content/" "$BACKUP_DIR/content/"

# Compress everything
echo "Compressing backup..."
zip -r "$ZIP_FILE" "$BACKUP_DIR/content" "$BACKUP_DIR/db.sql.gz" > /dev/null

# Upload to cloud
echo "Uploading to cloud storage..."
rclone copy "$ZIP_FILE" "$RCLONE_REMOTE:$RCLONE_PATH"

# Cleanup: remove local backups older than 1 day (optional but recommended)
echo "Cleaning up old local backups..."
find /home/$GHOST_USER/backups -type d -mtime +1 -exec rm -rf {} +

echo "Backup complete: $ZIP_FILE → $RCLONE_REMOTE:$RCLONE_PATH"

Make it executable:

chmod +x /root/backup-ghost.sh

Test it manually first:

/root/backup-ghost.sh

Check your cloud storage — you should see a file like: theselfhostingart-blog-2025-04-05_03-22.zip

Step 5: Automate with Cron (Daily Backups)

crontab -e

Add this line for daily backup at 2:00 AM:

cron0 2 * * * /usr/bin/bash /root/backup-ghost.sh >> /var/log/ghost-backup.log 2>&1

Save and exit.

Your Ghost blog is now automatically backed up every day.

What’s Included in the Backup?

Full database (posts, users, settings)
All uploaded images
Custom themes
Everything needed to restore or migrate

You can even send this .zip to Ghost(Pro) support — they can import it directly.

Bonus: Restore in Case of Disaster

To restore:

Install fresh Ghost
Unzip backup
Import DB: gunzip < db.sql.gz | mysql -u user -p dbname
Replace content/ folder
Run ghost restart

Credits & Thanks

This method is inspired and improved from this excellent post: How to Automatically Backup Ghost Blogs – Kenton Vizdos

Thank you, Kenton!

Your self-hosted blog now sleeps better at night. 😴💾

Thank you for reading!

How to install NextCloud with OpenLiteSpeed (LOMP stack)

Tue, 09 Dec 2025 00:59:45 +0000

Introduction

Today I’ll show you how to build what I genuinely believe is the fastest NextCloud stack available in 2025:

OpenLiteSpeed – the fastest web server with built-in cache
LSPHP 8.1/8.2 – LiteSpeed’s ultra-fast PHP implementation
Redis + APCu – for blazing-fast caching and locking
Runs completely non-root, under its own user
Hardened with proper security headers, HSTS, and isolated data folder

Even if NextCloud gets compromised, the attacker still can’t touch the rest of your server.

Let’s go!

Step 1: Secure Your VPS First

Before anything, harden your server. Follow my full guide here: How to Make Your VPS Secure

Step 2: Install OpenLiteSpeed, LSPHP, Redis & Tools

Run as root:

# Update system
apt update && apt upgrade -y

# Add OpenLiteSpeed repository
wget -O - https://repo.litespeed.sh | bash

# Install essentials
apt install -y curl gnupg2 imagemagick ffmpeg redis openlitespeed lsphp81* lsphp82* zip unzip mariadb-server mariadb-client

Note: On Ubuntu 22.04+, the ImageMagick package might be libmagickwand-dev + imagemagick. The above works on most recent Debian/Ubuntu.

Enable and restart Redis:

systemctl enable --now redis-server

Step 3: Create a Dedicated System User for NextCloud

adduser --shell /bin/bash files
usermod -aG redis files # Allow access to Redis socket

Step 4: Download & Extract NextCloud as the “files” User

su - files
mkdir -p ~/public_html
cd ~/public_html

wget https://download.nextcloud.com/server/releases/latest.zip
unzip latest.zip
rsync -av nextcloud/ ./
rm -rf nextcloud latest.zip .htaccess .user.ini
exit

Step 5: Configure OpenLiteSpeed Web Admin (Port 7080)

Set an admin password:

/usr/local/lsws/admin/misc/admpass.sh

Now visit: https://your-vps-ip:7080 and log in.

Virtual Host Setup

Delete the default “Example” virtual host
Add new Virtual Host:

Virtual Host Name: yourdomain.com
Virtual Host Root: /home/files/
Config File: $SERVER_ROOT/conf/vhosts/$VH_NAME/vhconf.conf
Document Root: $VH_ROOT/public_html

Script Handler → Add:

Suffix: php
Handler Type: LiteSpeed LVE
Handler: lsphp81 (or lsphp82 if you prefer PHP 8.2)

Rewrite Rules (force HTTPS):

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L]

Security Headers (Context → Static → Add new context /):

Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
Content-Security-Policy "upgrade-insecure-requests"

External App → LSPHP → Edit:

Run as User/Group: files
PHP_LSAPI_CHILDREN = 100
LSAPI_AVOID_FORK = 0

Listeners:

Delete default listeners
Add HTTP → port 80
Add HTTPS → port 443 (Secure = Yes)
Map your domain to both listeners

Graceful restart → OpenLiteSpeed → Graceful Restart

Step 6: Issue Let’s Encrypt SSL

apt install -y certbot
certbot certonly --webroot -w /home/files/public_html -d yourdomain.com

Note the paths (you’ll need them):

Fullchain: /etc/letsencrypt/live/yourdomain.com/fullchain.pem
Privkey: /etc/letsencrypt/live/yourdomain.com/privkey.pem

Add them in:

Virtual Host → SSL tab
Listener HTTPS → SSL tab
Chained Certificate = Yes

Graceful restart again.

Step 7: Auto-Renew SSL

crontab -e

Add:

cron0 3 * * * /usr/bin/certbot renew --quiet

Step 8: Install & Secure MariaDB/MySQL

mysql_secure_installation

Then create database & user:

mysql -u root -p
CREATE DATABASE nextcloud CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
CREATE USER 'ncuser'@'localhost' IDENTIFIED BY 'strong-password-here';
GRANT ALL PRIVILEGES ON nextcloud.* TO 'ncuser'@'localhost';
FLUSH PRIVILEGES;
EXIT;

Step 9: Optimize PHP & Enable OPCache + APCu

# Edit the correct php.ini (adjust path if using lsphp82)
sed -i '/usr/local/lsws/lsphp81/etc/php/8.1/litespeed/php.ini' \
 -e 's/memory_limit = .*/memory_limit = 1024M/' \
 -e 's/upload_max_filesize = .*/upload_max_filesize = 10G/' \
 -e 's/post_max_size = .*/post_max_size = 10G/' \
 -e 's/max_execution_time = .*/max_execution_time = 3600/' \
 -e 's/opcache.enable=.*/opcache.enable=1/' \
 -e 's/;opcache.memory_consumption=.*/opcache.memory_consumption=512/' \
 -e 's/;opcache.interned_strings_buffer=.*/opcache.interned_strings_buffer=64/' \
 -e 's/;opcache.max_accelerated_files=.*/opcache.max_accelerated_files=20000/'

# Enable APCu CLI
echo "apc.enable_cli = 1" >> /usr/local/lsws/lsphp81/etc/php/8.1/litespeed/php.ini

pkill -f lsphp
systemctl restart lsws

Step 10: Configure Redis as Unix Socket

sed -i 's/port 6379/port 0/' /etc/redis/redis.conf
sed -i 's|# unixsocket /var/run/redis/redis-server.sock|unixsocket /var/run/redis/redis-server.sock|' /etc/redis/redis.conf
sed -i 's/# unixsocketperm 700/unixsocketperm 770/' /etc/redis/redis.conf
sed -i 's/# maxmemory .*/maxmemory 1gb/' /etc/redis/redis.conf

systemctl restart redis-server

Step 11: Final NextCloud Configuration

Move Data Folder Outside Web Root (Critical!)

During setup, set data directory to: /home/files/data

su - files
nano /home/files/public_html/config/config.php

Add right after ‘installed’ => true,:

'memcache.local' => '\\OC\\Memcache\\APCu',
 'memcache.distributed' => '\\OC\\Memcache\\Redis',
 'memcache.locking' => '\\OC\\Memcache\\Redis',
 'redis' => [
 'host' => '/var/run/redis/redis-server.sock',
 'port' => 0,
 ],

Set Up Background Jobs (Cron)

su - files
crontab -e

Add:

cron*/5 * * * * /usr/local/lsws/lsphp81/bin/php -f /home/files/public_html/cron.php

Then in NextCloud Admin → Basic Settings → Background jobs → Select Cron (recommended).

Bonus: Make occ Easy to Use Forever

su - files
echo "alias occ='/usr/local/lsws/lsphp81/bin/php /home/files/public_html/occ'" >> ~/.bashrc
source ~/.bashrc

Now from anywhere in ~/public_html:

cd ~/public_html
occ status
occ maintenance:repair
occ db:add-missing-indices

You’re Done!

You now have:

The fastest NextCloud stack (OpenLiteSpeed + Redis + APCu)
Fully non-root and isolated
Automatic SSL renewal
Hardened security headers
Proper data folder protection

Enjoy your blazing-fast, private cloud!

Thank you for reading! 🚀

How to run your own monero node

Tue, 09 Dec 2025 00:07:50 +0000

Introduction

Monero is one of the most important cryptocurrencies in my opinion. It does not have the same market share as Bitcoin, but it is quite unique in one aspect: privacy. Monero is just like cash — no one needs to know how much Monero was sent or who sent it. It’s the opposite of Bitcoin in this regard. In fact, Bitcoin is worse than fiat money when it comes to privacy.

You can read more details here: https://lukesmith.xyz/articles/monero-maximalism-or-how-bitcoin-is-a-coin/

Obs: I’m NOT recommending anyone invest in Monero. Monero is supposed to be a currency, but since crypto is still extremely volatile, many people treat it as an investment. Do your own research — I’m not responsible for any investments you make.

1. Choose a VPS or set it up at home

First things first, you will need a server. You can use your own home PC if you prefer, or a VPS. A VPS is easier because it stays online 24/7 and you can always open the required ports.

At home, many ISPs block incoming ports, so your node wouldn’t be public (it would still help the network, but you couldn’t easily connect to it from outside without something like ngrok).

I personally recommend Contabo for running a Monero node because they offer excellent prices on storage VPS plans. Check their pricing here: Contabo Storage VPS

The Storage VPS S is more than enough. The Monero blockchain currently uses about 175 GB, less than 2 GB of RAM, and barely any CPU once fully synced (~3 % usage).

2. Securing the VPS

First of all, disable password login.

Then install and configure UFW (if it’s not already set up):

sudo apt install ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow 18080
sudo ufw allow 18089
sudo ufw enable

3. Creating a dedicated user

For security reasons, never run Monero as root. Create a normal user instead:

adduser monerouser

Set a password and press Enter through the rest of the prompts.

4. Changing settings and syncing the node

Switch to the new user:

su monerouser
cd ~

Download the official Monero CLI binaries (Linux 64-bit):

wget -c https://downloads.getmonero.org/cli/monero-linux-x64-v0.18.3.4.tar.bz2
mkdir monero
tar -xjvf monero-linux-x64-v0.18.3.4.tar.bz2 -C monero --strip-components=1

(Replace the version in the URL/filename with the latest one from https://getmonero.org if needed.)

Enter the folder and start monerod once just to create the config files (stop it after a few seconds with Ctrl+C):

cd monero
./monerod

Now edit the configuration file:

nano ~/.bitmonero/bitmonero.conf

Paste the following recommended settings:

# P2P full node
public-node=true # Advertises the RPC-restricted port over p2p

# RPC settings
rpc-restricted-bind-ip=0.0.0.0
rpc-restricted-bind-port=18089

# Node settings
enforce-dns-checkpointing=true
db-sync-mode=safe # Slow but reliable db writes
enable-dns-blocklist=true # Block known-malicious nodes
no-igd=true # Disable UPnP
no-zmq=true

# Bandwidth settings (much faster sync + better contribution)
out-peers=32
in-peers=32
limit-rate-up=1048576 # 1 GB/s upload
limit-rate-down=1048576 # 1 GB/s download

Save with Ctrl+O → Enter → Ctrl+X.

Start the node in detached mode:

./monerod --detach

You’re done! Now just wait for it to fully sync.

Check sync status anytime with:

./monerod status

The initial sync usually takes a few hours depending on your connection and VPS speed.

Once it’s fully synced, you can connect any Monero wallet (Cake Wallet, Monero GUI, Feather, etc.) to your own node using your VPS IP and port 18089.

Conclusion & Credits

That’s it! Running your own full node is strongly encouraged by the Monero community. It makes the network more decentralized and gives you maximum privacy.

This guide wouldn’t have been possible without these excellent resources:

Thank you for reading! 🙂

How to Self Host your own Piped Instance

Mon, 08 Dec 2025 23:58:10 +0000

Introduction

Piped is a privacy-first, open-source alternative YouTube front-end. No Google tracking, no ads (even on videos that normally have unskippable ones), and it works perfectly with SponsorBlock and dearrow.

Self-hosting your own instance is incredibly easy with Docker and takes less than 20 minutes.

Requirements

A domain (or subdomain)
A cheap KVM VPS with Docker support (avoid OpenVZ — old kernel)
~$3–6/month is more than enough (1 CPU, 1–2 GB RAM)

Great cheap providers in 2025:

RackNerd
Hostinger (my affiliate if you want to support https://hostinger.com.br?REFERRALCODE=waterdownfall)
Cloudcone, Hetzner Cloud, BuyVM, etc.

Step 1: Secure & Prepare Your VPS

(SSH keys only, firewall, etc. — do this first!)

Then install Docker (Ubuntu/Debian example):

apt update && apt upgrade -y
apt install -y ca-certificates curl gnupg lsb-release

# Add Docker repo
sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" > /etc/apt/sources.list.d/docker.list

apt update
apt install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin

Step 2: Deploy Piped with the Official Docker Setup

cd /opt
git clone https://github.com/TeamPiped/Piped-Docker
cd Piped-Docker
./configure-instance.sh

During the script:

Choose Caddy as reverse proxy (easiest + automatic SSL)
Enter your domain and subdomains:
- Frontend → piped.yourdomain.com
- Backend API → pipedapi.yourdomain.com
- Proxy → pipedproxy.yourdomain.com

Step 3: Point DNS to Your VPS

Create three A records at your DNS provider:

piped.yourdomain.com → VPS_IP
pipedapi.yourdomain.com → VPS_IP
pipedproxy.yourdomain.com → VPS_IP

Step 4: Launch Everything

docker compose up -d

That’s it! After DNS propagates (usually < 10 minutes), your private YouTube will be live at:

https://piped.yourdomain.com

Caddy automatically handles free Let’s Encrypt SSL — no manual certbot needed.

Step 5: (Optional) Check Logs

Bash

# See what Caddy is doing
docker logs -f caddy

# Or any other container
docker logs -f piped-frontend

Bonus Tips

Want to make it public? Just share the URL — anyone can use your instance.
Want it private? Block it with Cloudflare firewall rules or basic auth in Caddy.
Pair it with the LibreTube (Android) app for the full de-Googled experience.

You now have your own ad-free, tracking-free, SponsorBlock-enabled YouTube — fully under your control.

Thanks for reading!

How to setup WordPress on LEMP with Redis and WP CLI on Debian 11

Mon, 08 Dec 2025 23:47:36 +0000

Introduction

This is the fastest, most secure, and most resource-efficient way to self-host WordPress in 2025. We’ll use a proper LEMP stack (Linux + Nginx + MySQL/MariaDB + PHP-FPM) with per-site PHP isolation, Redis object caching, automatic SSL, and WP-CLI — everything tuned for speed and security.

Let’s go.

Step 0: Secure & Update Your VPS

(If you haven’t already, follow a VPS hardening guide first — SSH keys only, firewall, fail2ban, etc.)

apt update && apt upgrade -y
apt autoremove --purge
reboot

Step 1: Install the Core Stack

# Nginx
apt install nginx -y
systemctl enable nginx

# MariaDB (better than MySQL on Debian)
apt install mariadb-server -y
systemctl enable mariadb

# PHP 8.3 + all needed extensions (using ondrej/sury repo)
apt install ca-certificates apt-transport-https lsb-release -y
wget -qO- https://packages.sury.org/php/apt.gpg | gpg --dearmor > /usr/share/keyrings/sury-php.gpg
echo "deb [signed-by=/usr/share/keyrings/sury-php.gpg] https://packages.sury.org/php/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/sury-php.list
apt update
apt install php8.3-fpm php8.3-mysql php8.3-curl php8.3-gd php8.3-mbstring php8.3-xml php8.3-zip php8.3-intl php8.3-imagick php8.3-redis -y
systemctl enable php8.3-fpm

# Redis
curl -fsSL https://packages.redis.io/gpg | gpg --dearmor -o /usr/share/keyrings/redis-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/redis-archive-keyring.gpg] https://packages.redis.io/deb $(lsb_release -cs) main" > /etc/apt/sources.list.d/redis.list
apt update && apt install redis-server -y
systemctl enable redis-server

# Certbot + WP-CLI
apt install python3-certbot-nginx -y
curl -O https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
chmod +x wp-cli.phar && mv wp-cli.phar /usr/local/bin/wp

Step 2: Secure MariaDB & Create Database

mysql_secure_installation

mysql -u root -p
CREATE DATABASE wp_yoursite;
CREATE USER 'wp_yoursite'@'localhost' IDENTIFIED BY 'strongpassword';
GRANT ALL ON wp_yoursite.* TO 'wp_yoursite'@'localhost';
FLUSH PRIVILEGES;
EXIT;

Step 3: Isolate PHP-FPM Per Site (Security + Stability)

cd /etc/php/8.3/fpm/pool.d/
cp www.conf yoursite.conf
nano yoursite.conf

Replace:

[www] → [yoursite]
user = www-data → user = yoursiteuser (we’ll create this user soon)
group = www-data → group = yoursiteuser
listen = /run/php/php8.3-fpm.sock → listen = /run/php/php8.3-fpm-yoursite.sock
Change process manager from dynamic → ondemand (saves RAM)

systemctl restart php8.3-fpm

(It will fail until the user exists — that’s fine.)

Step 4: Optimize PHP & Enable OPcache

sed -i "s/memory_limit = .*/memory_limit = 1024M/" /etc/php/8.3/fpm/php.ini
sed -i "s/upload_max_filesize = .*/upload_max_filesize = 10240M/" /etc/php/8.3/fpm/php.ini
sed -i "s/post_max_size = .*/post_max_size = 10240M/" /etc/php/8.3/fpm/php.ini
sed -i "s/max_execution_time = .*/max_execution_time = 600/" /etc/php/8.3/fpm/php.ini
sed -i "s/;opcache.enable=1/opcache.enable=1/" /etc/php/8.3/fpm/php.ini
sed -i "s/;opcache.memory_consumption=.*/opcache.memory_consumption=512/" /etc/php/8.3/fpm/php.ini
sed -i "s/;opcache.max_accelerated_files=.*/opcache.max_accelerated_files=20000/" /etc/php/8.3/fpm/php.ini
sed -i "s/;cgi.fix_pathinfo=1/cgi.fix_pathinfo=0/" /etc/php/8.3/fpm/php.ini

Step 5: Create System User & Site Directory

adduser yoursiteuser --shell /bin/bash
su yoursiteuser
mkdir ~/public_html && cd ~/public_html
echo "cd ~/public_html" >> ~/.bashrc
exit

Step 6: Nginx Config (Fast & Secure)

nano /etc/nginx/sites-available/yoursite.conf

upstream php-yoursite {
 server unix:/run/php/php8.3-fpm-yoursite.sock;
}

server {
 listen 80;
 listen [::]:80;
 server_name yourdomain.com www.yourdomain.com;
 root /home/yoursiteuser/public_html;
 index index.php index.html;

 client_max_body_size 10G;

 location / {
 try_files $uri $uri/ /index.php?$args;
 }

 location ~ \.php$ {
 include fastcgi_params;
 fastcgi_pass php-yoursite;
 fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
 }

 location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff2?|ttf|eot)$ {
 expires max;
 log_not_found off;
 }
}

ln -s /etc/nginx/sites-available/yoursite.conf /etc/nginx/sites-enabled/
nginx -t && systemctl reload nginx

Step 7: Install WordPress via WP-CLI (as the site user)

su yoursiteuser
cd ~/public_html

wp core download
wp config create --dbname=wp_yoursite --dbuser=wp_yoursite --dbpass='strongpassword' --locale=en_US
wp core install --url=https://yourdomain.com --title="Your Site" --admin_user=admin --admin_password='strongpass' --admin_email=you@domain.com

Step 8: SSL with Let’s Encrypt (Auto-renew)

certbot --nginx -d yourdomain.com -d www.yourdomain.com
# Choose redirect to HTTPS when asked

Add auto-renew cron:

crontab -e
# Add:
0 0 * * 0 certbot renew --quiet

Step 9: Enable Redis Object Cache

# As root
usermod -aG redis yoursiteuser
chmod 770 /var/run/redis/redis-server.sock

# Optimize Redis config
sed -i 's/port 6379/port 0/' /etc/redis/redis.conf
sed -i 's|# unixsocket /run/redis/redis-server.sock|unixsocket /var/run/redis/redis-server.sock|' /etc/redis/redis.conf
sed -i 's/# unixsocketperm 700/unixsocketperm 770/' /etc/redis/redis.conf
sed -i 's/# maxmemory .*/maxmemory 1024mb/' /etc/redis/redis.conf
systemctl restart redis-server

# As yoursiteuser
cd ~/public_html
wp plugin install redis-cache --activate
wp config set WP_REDIS_SCHEME unix
wp config set WP_REDIS_PATH '/var/run/redis/redis-server.sock'
wp redis enable

Done!

You now have:

Fully isolated PHP-FPM pool (1 user = 1 site = no cross-site damage)
Redis object caching over Unix socket
OPcache + huge upload limits
Automatic SSL renewal
Fastest possible Nginx routing
WP-CLI ready

Your wp-admin will feel instant, and the site will handle traffic like a champ — even on a $5/month VPS.

Next steps:

Install a page cache plugin (any free one is ok)
Set up Cloudflare (optional but recommended)
Regular backups

Enjoy your blazing-fast, private WordPress setup!

Thanks for reading! 😊

How to setup your own email server

Mon, 08 Dec 2025 23:35:02 +0000

Introduction

Want your own ultra-private email like name@yourdomain.com with a beautiful webmail interface? This guide walks you through setting up a full mail server in under an hour using Luke Smith’s legendary EmailWiz script + Roundcube webmail — all on a $2–3/month VPS.

Everything is free, open-source, and 100% under your control.

Step 0: Grab a Cheap VPS

Good providers with frequent sales:

Contabo
LowEndTalk “Offers” section
Hostinger (my affiliate if you want to support me -> https://hostinger.com.br?REFERRALCODE=waterdownfall)

Requirements:

Any location (USA works fine)
Debian 10 or 11 (we’ll use Debian 10 in this guide)
At least 1 GB RAM (2 GB+ recommended)
Set hostname during signup to your domain (e.g., sobremail.com)

Wait for deployment → grab root password from email → SSH in.

Step 1: Basic VPS Hardening

ssh root@your-vps-ip
apt update && apt upgrade -y

Change root password:

passwd

Create and upload an SSH key (do this from your local machine):

ssh-copy-id root@your-vps-ip

Now disable password login:

nano /etc/ssh/sshd_config

Change:

PasswordAuthentication no
UsePAM no

Then:

systemctl restart sshd

Only your SSH key works now — much safer.

Step 2: Install EmailWiz (the magic script)

apt install curl nginx python3-certbot-nginx -y

Point these DNS records to your VPS IP:

yourdomain.com → VPS IP (A record)
mail.yourdomain.com → VPS IP (A record)

Run Luke’s script:

curl -LO lukesmith.xyz/emailwiz.sh
sh emailwiz.sh

Follow the prompts:

Say Yes/Y to everything
When asked for “System mail name” → enter ONLY yourdomain.com (NOT mail.yourdomain.com!)

Wait ~5–10 minutes. When it finishes, it gives you three DNS records to add:

DKIM TXT record (mail._domainkey.yourdomain.com)
DMARC TXT record (_dmarc.yourdomain.com)
SPF TXT record (root domain)

Add them at your DNS provider (Cloudflare, Namecheap, etc.).

Step 3: Set Up Reverse DNS (Critical for Deliverability!)

In Cloudcone panel → Networking → rDNS → set to yourdomain.com Do NOT enable IPv6 (Cloudcone doesn’t support IPv6 rDNS yet — it will hurt deliverability).

Step 4: Create Your First Mailbox

useradd -G mail -m yourusername
passwd yourusername

Your email is now: yourusername@yourdomain.com

Test in Thunderbird/IMAP client:

IMAP: mail.yourdomain.com (port 993, SSL/TLS)
SMTP: mail.yourdomain.com (port 465, SSL/TLS)

Step 5: Install Roundcube Webmail

Add backports + PHP 8.x repo:

apt install -y lsb-release ca-certificates apt-transport-https software-properties-common gnupg2
echo "deb https://packages.sury.org/php/ $(lsb_release -sc) main" | tee /etc/apt/sources.list.d/sury-php.list
wget -qO - https://packages.sury.org/php/apt.gpg | apt-key add -
apt update
apt install -y php8.0-fpm php8.0-common php8.0-gd php8.0-imap php8.0-mysql php8.0-curl php8.0-zip php8.0-xml php8.0-mbstring php8.0-intl mariadb-server

Secure MySQL:

mysql_secure_installation

Create Roundcube database:

mysql -u root -p
CREATE DATABASE roundcube;
CREATE USER 'roundcubeuser'@'localhost' IDENTIFIED BY 'strongpassword';
GRANT ALL ON roundcube.* TO 'roundcubeuser'@'localhost';
FLUSH PRIVILEGES;
EXIT;

Download & extract Roundcube (latest complete version):

cd /var/www
wget https://github.com/roundcube/roundcubemail/releases/download/1.6.9/roundcubemail-1.6.9-complete.tar.gz
tar xvf roundcubemail-1.6.9-complete.tar.gz
mv roundcubemail-1.6.9 roundcube
rm roundcubemail-1.6.9-complete.tar.gz
chown -R www-data:www-data /var/www/roundcube/temp /var/www/roundcube/logs
mysql roundcube < /var/www/roundcube/SQL/mysql.initial.sql

Nginx config for Roundcube (/etc/nginx/sites-enabled/roundcube):

server {
 listen 80;
 listen [::]:80;
 server_name yourdomain.com;
 root /var/www/roundcube;
 index index.php;

 location / {
 try_files $uri $uri/ /index.php;
 }

 location ~ \.php$ {
 include fastcgi_params;
 fastcgi_pass unix:/run/php/php8.0-fpm.sock;
 fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
 }

 location ~* \.(jpg|jpeg|gif|png|webp|svg|woff|woff2|ttf|css|js|ico|xml)$ {
 expires 360d;
 access_log off;
 }
}

Test & reload Nginx, then get SSL:

nginx -t && systemctl reload nginx
certbot --nginx -d yourdomain.com

Visit https://yourdomain.com/installer → follow the wizard:

Database: roundcube, user roundcubeuser, password you set
IMAP host: localhost
SMTP host: localhost
Default host: mail.yourdomain.com

Enable all plugins except Enigma (it breaks identities in older versions).

After finishing, delete the installer:

rm -rf /var/www/roundcube/installer

Step 6: Quality-of-Life Tweaks

Edit /var/www/roundcube/config/config.inc.php:

// Login with just username (no need to type @domain.com)
$config['username_domain'] = 'yourdomain.com';

// Stay logged in for 6 months
$config['session_lifetime'] = 259200;

// Disable Enigma if you enabled it
// Remove 'enigma' from $config['plugins'] array

Increase attachment size:

nano /etc/php/8.0/fpm/php.ini

upload_max_filesize = 50M
post_max_size = 50M

Then:

systemctl restart php8.0-fpm

Step 7: Brute-Force Protection with Fail2Ban

apt install fail2ban -y
cd /var/www/roundcube/plugins
wget https://github.com/texxasrulez/roundcube_fail2ban/archive/refs/tags/1.4.zip
unzip 1.4.zip
mv roundcube_fail2ban-1.4 fail2ban
rm 1.4.zip

Enable in Roundcube config (config.inc.php):

$config['plugins'][] = 'fail2ban';

Add jail (/etc/fail2ban/jail.local – create if missing):

[roundcube]
enabled = true
port = http,https
filter = roundcube
action = iptables-multiport[name=roundcube, port="http,https"]
logpath = /var/www/roundcube/logs/errors.log
maxretry = 5
bantime = 3600

Create filter (/etc/fail2ban/filter.d/roundcube.conf):

[Definition]
failregex = IMAP Error: Login failed for .* from <HOST>
ignoreregex =

Restart:

systemctl restart fail2ban php8.0-fpm

Done! Your webmail is now protected.

Final Result

You now have:

Full email server with DKIM, SPF, DMARC
Beautiful, fast Roundcube webmail
Zero Google/Microsoft involvement
Login once every 6 months
Brute-force protection
All for ~$50/year

Welcome to real email freedom.

Thanks for reading! 😊

Self-Hosting on Aquasp's blog

Fixing Blank/Grey Screen on Album Pages in Finamp (Jellyfin Music Player)

The Fix: Refresh Metadata in Jellyfin (Search for Missing Metadata)

Additional Notes on Jellyfin 10.11.x

Credits

How to easily export and import docker volumes

Step 1: List Your Volumes

Step 2: Export a Volume → backup.tar.gz

Step 3: Import on the New Server

Bonus: Using External Volumes with Docker Compose

Real-World Use Cases

How to easily self-host at home and put your projects online under CGNAT

Introduction

The Downsides (and Why They’re Manageable)

How It Works – The Magic of Reverse SSH Tunnels (-R)

Step-by-Step Setup

1. On Your Home Server (the powerful one)

2. Generate an SSH Key (if you don’t have one)

3. Create the Tunnel Manager Script

4. Create a Systemd Service (Auto-Start & Auto-Reconnect)

5. On the VPS Side (Optional but Recommended)

Pros of This Setup

Final Words

How to Automatically Backup Your Self-Hosted Ghost Blog

Introduction

Step 1: Install Rclone

Step 2: Configure Rclone (Connect Your Cloud Storage)

Step 3: Get Your Ghost Database Credentials

Step 4: Create the Backup Script

Step 5: Automate with Cron (Daily Backups)

What’s Included in the Backup?

Bonus: Restore in Case of Disaster

Credits & Thanks

How to install NextCloud with OpenLiteSpeed (LOMP stack)

Introduction

Step 1: Secure Your VPS First

Step 2: Install OpenLiteSpeed, LSPHP, Redis & Tools

Step 3: Create a Dedicated System User for NextCloud

Step 4: Download & Extract NextCloud as the “files” User

Step 5: Configure OpenLiteSpeed Web Admin (Port 7080)

Virtual Host Setup

Step 6: Issue Let’s Encrypt SSL

Step 7: Auto-Renew SSL

Step 8: Install & Secure MariaDB/MySQL

Step 9: Optimize PHP & Enable OPCache + APCu

Step 10: Configure Redis as Unix Socket

Step 11: Final NextCloud Configuration

Move Data Folder Outside Web Root (Critical!)

Edit config.php (after first login)

Set Up Background Jobs (Cron)

Bonus: Make occ Easy to Use Forever

You’re Done!

How to run your own monero node

Introduction

1. Choose a VPS or set it up at home

2. Securing the VPS

3. Creating a dedicated user

4. Changing settings and syncing the node

Conclusion & Credits

How to Self Host your own Piped Instance

Introduction

Requirements

Step 1: Secure & Prepare Your VPS

Step 2: Deploy Piped with the Official Docker Setup

Step 3: Point DNS to Your VPS

Step 4: Launch Everything

Step 5: (Optional) Check Logs

Bonus Tips

How to setup WordPress on LEMP with Redis and WP CLI on Debian 11

Introduction

Step 0: Secure & Update Your VPS

Step 1: Install the Core Stack

Step 2: Secure MariaDB & Create Database

Step 3: Isolate PHP-FPM Per Site (Security + Stability)

Step 4: Optimize PHP & Enable OPcache

Step 5: Create System User & Site Directory

Step 6: Nginx Config (Fast & Secure)

Step 7: Install WordPress via WP-CLI (as the site user)

Step 8: SSL with Let’s Encrypt (Auto-renew)

Step 9: Enable Redis Object Cache