selfhostedops/selfhostedops-stack
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
selfhostedops-stack/README.md

7.2 KiB
Raw Blame History

~$ selfhostedops-stack

The €15/month self-hosted company stack. Git hosting, wiki, password manager, monitoring, automation and VPN — one server, one compose file, no per-seat pricing.

From the video: Self-Hosted Company Stack for €15/Month (Full Setup) — Series Self-Hosted Company OS, Episode 1.

                        ┌──────────────────────────────────────┐
                        │            caddy  :80/:443           │
                        │      automatic HTTPS for  *.DOMAIN   │
                        └──┬─────┬───────┬───────┬──────┬──────┘
                           │     │       │       │      │
                git.─────► │  wiki.──►   │ status.──►   │
                           │     │       │       │      │
                      ┌────▼─┐ ┌─▼────┐ ┌▼─────┐ ┌▼───┐ ┌▼────┐
                      │forge │ │outline│ │vault │ │kuma│ │ n8n │
                      │  jo  │ │+pg+redis│warden│ │    │ │     │
                      └──────┘ └──────┘ └──────┘ └────┘ └─────┘
                        also: wg-easy (optional, --profile vpn)
Service URL Replaces Typical SaaS price
Forgejo git.… GitHub Team $4/user/mo
Outline wiki.… Notion $10/user/mo
Vaultwarden vault.… 1Password $8/user/mo
Uptime Kuma status.… Pingdom & co. $20+/mo
n8n n8n.… Zapier $30+/mo
wg-easy vpn.… Tailscale $6/user/mo

All images are multi-arch (amd64 + arm64) — a €14 ARM cloud box (e.g. Hetzner CAX31) runs the whole thing with room to spare.

Quickstart

# 0. A Debian/Ubuntu server with Docker:
curl -fsSL https://get.docker.com | sh

# 1. DNS: ONE wildcard record  *.ops.example.com -> your server IP (A + AAAA)

# 2. Configure
git clone https://github.com/selfhostedops/selfhostedops-stack.git
cd selfhostedops-stack
cp .env.example .env
nano .env          # domain, email, 3x openssl rand -hex 32

# 3. Launch
docker compose up -d

Ninety seconds later: git. wiki. vault. status. n8n. — all with valid HTTPS.

First-run order (5 minutes)

  1. Forgejo (git.…): create the admin account on the setup page. Registration is already disabled via env — this is a company server.
  2. Forgejo → SSO for the wiki: Site Administration → Applications → Create OAuth2 app. Redirect URI: https://wiki.<DOMAIN>/auth/oidc.callback. Put the client id/secret into .env, then docker compose up -d outline.
  3. Outline (wiki.…): click "Continue with Forgejo". Your git server is your SSO provider — one account, both tools.
  4. Vaultwarden (vault.…): create your account, install the Bitwarden apps against https://vault.<DOMAIN>. When the team is on board: VAULTWARDEN_SIGNUPS_ALLOWED=false and re-up.
  5. Uptime Kuma (status.…): create admin, add HTTPS monitors for the other five subdomains. Meta, but correct.
  6. n8n (n8n.…): create the owner account. This thing becomes the brain of the stack in later episodes (AI agents incoming).

FAQ

Why no Netbird? You said mesh VPN. Full self-hosted Netbird (management plane, signal, TURN, IdP) deserves its own video — that's Episode 5. wg-easy gets you a working WireGuard VPN today with one env var. Skip both if you don't need remote access yet.

Backups? docker compose down, snapshot/borg the named volumes, up -d. A proper 3-2-1 setup (borgmatic + offsite) is Episode 10. Until then: at minimum enable your host provider's snapshot backups.

Can I run only some services? Yes — comment out what you don't need in compose.yml and remove its Caddyfile block. Everything is independent except Outline → Forgejo (SSO) and Outline → its postgres/redis.

Is latest okay for images? For a homelab: pragmatic. For production: pin versions and read HARDENING.md.

CI: your own runners (Episode 2)

Forgejo ships Actions. Turn it on, give it a runner, and you have GitHub Actions with no minute counter.

# 1. Enable it (already set in compose.yml)
#    FORGEJO__actions__ENABLED and repo.actions in DEFAULT_REPO_UNITS.
#    Without repo.actions in the default units, the Actions tab stays hidden
#    and it looks like the feature is broken. Existing repos: flip it per repo.

# 2. One shared secret for declarative registration
SECRET=$(openssl rand -hex 20)
UUID=$(python3 -c 'import uuid,sys;print(uuid.UUID(bytes=sys.argv[1][:16].encode()))' "$SECRET")
printf 'RUNNER_SECRET=%s\nRUNNER_UUID=%s\n' "$SECRET" "$UUID" >> .env

# 3. Tell Forgejo about it
docker compose exec -u git forgejo forgejo forgejo-cli actions register \
  --name box-runner --labels docker --secret "$SECRET"

# 4. Fill in the runner config and start the CI profile
cp runner-config.example.yml runner-config.yml
sed -i "s|https://git.example.com|https://git.$DOMAIN|; s|\${RUNNER_UUID}|$UUID|; s|\${RUNNER_SECRET}|$SECRET|" runner-config.yml
docker compose --profile ci up -d

Then check Site Administration → Runners: the runner should be online with the label docker.

Four things that cost people an evening:

  • A registration token from the web UI is not a shared secret. The declarative path above only accepts the secret you generated. Feed it the web token and the runner connects and never receives a job, with no error anywhere.
  • The connections: block lives under a top-level server: key in runner 13.x. Older examples put it under runner:, which fails with 0 server connections configured.
  • An empty labels: list means every job waits forever. No error, just a queued job and a healthy-looking runner.
  • The image behind a label must contain node — Forgejo actions are JavaScript. Pointing docker at a docker-cli image gives you node: executable file not found. Use a node image and let the build job fetch a static docker client (see examples/ci.yml).

examples/ci.yml is a complete pipeline: test, build a container, push it to Forgejo's built-in registry, and deploy it over an SSH key that can only run one command (examples/deploy-hello-ops.sh). Read the CI section of HARDENING.md before you wire the deploy step — there are two comfortable ways to hand your whole server to anyone who can push a branch.

Hardening

Before you put real company data on this box, read HARDENING.md. The short version: SSH keys only, firewall (80/443/2222/51820 only), unattended security updates, fail2ban, pinned image tags, offsite backups.

MIT — do whatever. If it saved you money, a YouTube subscription is the price: @selfhostedops