# ~$ selfhostedops-stack

**The €15/month self-hosted company stack.** Git hosting, wiki, password manager,
monitoring, automation and VPN — one server, one compose file, no per-seat pricing.

From the video: **[Self-Hosted Company Stack for €15/Month (Full Setup)](https://youtube.com/@selfhostedops)**
— Series *Self-Hosted Company OS*, Episode 1.

```
                        ┌──────────────────────────────────────┐
                        │            caddy  :80/:443           │
                        │      automatic HTTPS for  *.DOMAIN   │
                        └──┬─────┬───────┬───────┬──────┬──────┘
                           │     │       │       │      │
                git.─────► │  wiki.──►   │ status.──►   │
                           │     │       │       │      │
                      ┌────▼─┐ ┌─▼────┐ ┌▼─────┐ ┌▼───┐ ┌▼────┐
                      │forge │ │outline│ │vault │ │kuma│ │ n8n │
                      │  jo  │ │+pg+redis│warden│ │    │ │     │
                      └──────┘ └──────┘ └──────┘ └────┘ └─────┘
                        also: wg-easy (optional, --profile vpn)
```

| Service | URL | Replaces | Typical SaaS price |
|---|---|---|---|
| [Forgejo](https://forgejo.org) | `git.…` | GitHub Team | $4/user/mo |
| [Outline](https://www.getoutline.com) | `wiki.…` | Notion | $10/user/mo |
| [Vaultwarden](https://github.com/dani-garcia/vaultwarden) | `vault.…` | 1Password | $8/user/mo |
| [Uptime Kuma](https://github.com/louislam/uptime-kuma) | `status.…` | Pingdom & co. | $20+/mo |
| [n8n](https://n8n.io) | `n8n.…` | Zapier | $30+/mo |
| [wg-easy](https://github.com/wg-easy/wg-easy) | `vpn.…` | Tailscale | $6/user/mo |

All images are multi-arch (amd64 + arm64) — a €14 ARM cloud box (e.g. Hetzner
CAX31) runs the whole thing with room to spare.

## Quickstart

```bash
# 0. A Debian/Ubuntu server with Docker:
curl -fsSL https://get.docker.com | sh

# 1. DNS: ONE wildcard record  *.ops.example.com -> your server IP (A + AAAA)

# 2. Configure
git clone https://github.com/selfhostedops/selfhostedops-stack.git
cd selfhostedops-stack
cp .env.example .env
nano .env          # domain, email, 3x openssl rand -hex 32

# 3. Launch
docker compose up -d
```

Ninety seconds later: `git.` `wiki.` `vault.` `status.` `n8n.` — all with valid HTTPS.

## First-run order (5 minutes)

1. **Forgejo** (`git.…`): create the admin account on the setup page.
   Registration is already disabled via env — this is a company server.
2. **Forgejo → SSO for the wiki:** Site Administration → Applications →
   Create OAuth2 app. Redirect URI: `https://wiki.<DOMAIN>/auth/oidc.callback`.
   Put the client id/secret into `.env`, then `docker compose up -d outline`.
3. **Outline** (`wiki.…`): click "Continue with Forgejo". Your git server is
   your SSO provider — one account, both tools.
4. **Vaultwarden** (`vault.…`): create your account, install the Bitwarden
   apps against `https://vault.<DOMAIN>`. When the team is on board:
   `VAULTWARDEN_SIGNUPS_ALLOWED=false` and re-up.
5. **Uptime Kuma** (`status.…`): create admin, add HTTPS monitors for the
   other five subdomains. Meta, but correct.
6. **n8n** (`n8n.…`): create the owner account. This thing becomes the brain
   of the stack in later episodes (AI agents incoming).

## FAQ

**Why no Netbird? You said mesh VPN.**
Full self-hosted Netbird (management plane, signal, TURN, IdP) deserves its own
video — that's Episode 5. `wg-easy` gets you a working WireGuard VPN today with
one env var. Skip both if you don't need remote access yet.

**Backups?**
`docker compose down`, snapshot/borg the named volumes, `up -d`. A proper
3-2-1 setup (borgmatic + offsite) is Episode 10. Until then: at minimum enable
your host provider's snapshot backups.

**Can I run only some services?**
Yes — comment out what you don't need in `compose.yml` and remove its Caddyfile
block. Everything is independent except Outline → Forgejo (SSO) and
Outline → its postgres/redis.

**Is `latest` okay for images?**
For a homelab: pragmatic. For production: pin versions and read HARDENING.md.

## Hardening

Before you put real company data on this box, read **[HARDENING.md](HARDENING.md)**.
The short version: SSH keys only, firewall (80/443/2222/51820 only), unattended
security updates, fail2ban, pinned image tags, offsite backups.

---

MIT — do whatever. If it saved you money, a YouTube subscription is the price:
**[@selfhostedops](https://youtube.com/@selfhostedops)**