Initial stack: Caddy, Forgejo, Outline, Vaultwarden, Uptime Kuma, n8n

2026-08-16 19:29:58 +02:00 · 2026-08-16 19:29:58 +02:00 · 06f8e8812e
commit 06f8e8812e
6 changed files with 401 additions and 0 deletions
--- a/README.md
+++ b/README.md
@ -0,0 +1,102 @@
+# ~$ selfhostedops-stack
+
+**The €15/month self-hosted company stack.** Git hosting, wiki, password manager,
+monitoring, automation and VPN — one server, one compose file, no per-seat pricing.
+
+From the video: **[Self-Hosted Company Stack for €15/Month (Full Setup)](https://youtube.com/@selfhostedops)**
+— Series *Self-Hosted Company OS*, Episode 1.
+
+```
+                        ┌──────────────────────────────────────┐
+                        │            caddy  :80/:443           │
+                        │      automatic HTTPS for  *.DOMAIN   │
+                        └──┬─────┬───────┬───────┬──────┬──────┘
+                           │     │       │       │      │
+                git.─────► │  wiki.──►   │ status.──►   │
+                           │     │       │       │      │
+                      ┌────▼─┐ ┌─▼────┐ ┌▼─────┐ ┌▼───┐ ┌▼────┐
+                      │forge │ │outline│ │vault │ │kuma│ │ n8n │
+                      │  jo  │ │+pg+redis│warden│ │    │ │     │
+                      └──────┘ └──────┘ └──────┘ └────┘ └─────┘
+                        also: wg-easy (optional, --profile vpn)
+```
+
+| Service | URL | Replaces | Typical SaaS price |
+|---|---|---|---|
+| [Forgejo](https://forgejo.org) | `git.…` | GitHub Team | $4/user/mo |
+| [Outline](https://www.getoutline.com) | `wiki.…` | Notion | $10/user/mo |
+| [Vaultwarden](https://github.com/dani-garcia/vaultwarden) | `vault.…` | 1Password | $8/user/mo |
+| [Uptime Kuma](https://github.com/louislam/uptime-kuma) | `status.…` | Pingdom & co. | $20+/mo |
+| [n8n](https://n8n.io) | `n8n.…` | Zapier | $30+/mo |
+| [wg-easy](https://github.com/wg-easy/wg-easy) | `vpn.…` | Tailscale | $6/user/mo |
+
+All images are multi-arch (amd64 + arm64) — a €14 ARM cloud box (e.g. Hetzner
+CAX31) runs the whole thing with room to spare.
+
+## Quickstart
+
+```bash
+# 0. A Debian/Ubuntu server with Docker:
+curl -fsSL https://get.docker.com | sh
+
+# 1. DNS: ONE wildcard record  *.ops.example.com -> your server IP (A + AAAA)
+
+# 2. Configure
+git clone https://github.com/selfhostedops/selfhostedops-stack.git
+cd selfhostedops-stack
+cp .env.example .env
+nano .env          # domain, email, 3x openssl rand -hex 32
+
+# 3. Launch
+docker compose up -d
+```
+
+Ninety seconds later: `git.` `wiki.` `vault.` `status.` `n8n.` — all with valid HTTPS.
+
+## First-run order (5 minutes)
+
+1. **Forgejo** (`git.…`): create the admin account on the setup page.
+   Registration is already disabled via env — this is a company server.
+2. **Forgejo → SSO for the wiki:** Site Administration → Applications →
+   Create OAuth2 app. Redirect URI: `https://wiki.<DOMAIN>/auth/oidc.callback`.
+   Put the client id/secret into `.env`, then `docker compose up -d outline`.
+3. **Outline** (`wiki.…`): click "Continue with Forgejo". Your git server is
+   your SSO provider — one account, both tools.
+4. **Vaultwarden** (`vault.…`): create your account, install the Bitwarden
+   apps against `https://vault.<DOMAIN>`. When the team is on board:
+   `VAULTWARDEN_SIGNUPS_ALLOWED=false` and re-up.
+5. **Uptime Kuma** (`status.…`): create admin, add HTTPS monitors for the
+   other five subdomains. Meta, but correct.
+6. **n8n** (`n8n.…`): create the owner account. This thing becomes the brain
+   of the stack in later episodes (AI agents incoming).
+
+## FAQ
+
+**Why no Netbird? You said mesh VPN.**
+Full self-hosted Netbird (management plane, signal, TURN, IdP) deserves its own
+video — that's Episode 5. `wg-easy` gets you a working WireGuard VPN today with
+one env var. Skip both if you don't need remote access yet.
+
+**Backups?**
+`docker compose down`, snapshot/borg the named volumes, `up -d`. A proper
+3-2-1 setup (borgmatic + offsite) is Episode 10. Until then: at minimum enable
+your host provider's snapshot backups.
+
+**Can I run only some services?**
+Yes — comment out what you don't need in `compose.yml` and remove its Caddyfile
+block. Everything is independent except Outline → Forgejo (SSO) and
+Outline → its postgres/redis.
+
+**Is `latest` okay for images?**
+For a homelab: pragmatic. For production: pin versions and read HARDENING.md.
+
+## Hardening
+
+Before you put real company data on this box, read **[HARDENING.md](HARDENING.md)**.
+The short version: SSH keys only, firewall (80/443/2222/51820 only), unattended
+security updates, fail2ban, pinned image tags, offsite backups.
+
+---
+
+MIT — do whatever. If it saved you money, a YouTube subscription is the price:
+**[@selfhostedops](https://youtube.com/@selfhostedops)**