~$ selfhostedops-stack

The €15/month self-hosted company stack. Git hosting, wiki, password manager, monitoring, automation and VPN — one server, one compose file, no per-seat pricing.

From the video: Self-Hosted Company Stack for €15/Month (Full Setup) — Series Self-Hosted Company OS, Episode 1.

                        ┌──────────────────────────────────────┐
                        │            caddy  :80/:443           │
                        │      automatic HTTPS for  *.DOMAIN   │
                        └──┬─────┬───────┬───────┬──────┬──────┘
                           │     │       │       │      │
                git.─────► │  wiki.──►   │ status.──►   │
                           │     │       │       │      │
                      ┌────▼─┐ ┌─▼────┐ ┌▼─────┐ ┌▼───┐ ┌▼────┐
                      │forge │ │outline│ │vault │ │kuma│ │ n8n │
                      │  jo  │ │+pg+redis│warden│ │    │ │     │
                      └──────┘ └──────┘ └──────┘ └────┘ └─────┘
                        also: wg-easy (optional, --profile vpn)

Service	URL	Replaces	Typical SaaS price
Forgejo	git.…	GitHub Team	$4/user/mo
Outline	wiki.…	Notion	$10/user/mo
Vaultwarden	vault.…	1Password	$8/user/mo
Uptime Kuma	status.…	Pingdom & co.	$20+/mo
n8n	n8n.…	Zapier	$30+/mo
wg-easy	vpn.…	Tailscale	$6/user/mo

All images are multi-arch (amd64 + arm64) — a €14 ARM cloud box (e.g. Hetzner CAX31) runs the whole thing with room to spare.

Quickstart

# 0. A Debian/Ubuntu server with Docker:
curl -fsSL https://get.docker.com | sh

# 1. DNS: ONE wildcard record  *.ops.example.com -> your server IP (A + AAAA)

# 2. Configure
git clone https://github.com/selfhostedops/selfhostedops-stack.git
cd selfhostedops-stack
cp .env.example .env
nano .env          # domain, email, 3x openssl rand -hex 32

# 3. Launch
docker compose up -d

Ninety seconds later: git. wiki. vault. status. n8n. — all with valid HTTPS.

First-run order (5 minutes)

1. Forgejo (git.…): create the admin account on the setup page. Registration is already disabled via env — this is a company server.
2. Forgejo → SSO for the wiki: Site Administration → Applications → Create OAuth2 app. Redirect URI: https://wiki.<DOMAIN>/auth/oidc.callback. Put the client id/secret into .env, then docker compose up -d outline.
3. Outline (wiki.…): click "Continue with Forgejo". Your git server is your SSO provider — one account, both tools.
4. Vaultwarden (vault.…): create your account, install the Bitwarden apps against https://vault.<DOMAIN>. When the team is on board: VAULTWARDEN_SIGNUPS_ALLOWED=false and re-up.
5. Uptime Kuma (status.…): create admin, add HTTPS monitors for the other five subdomains. Meta, but correct.
6. n8n (n8n.…): create the owner account. This thing becomes the brain of the stack in later episodes (AI agents incoming).

FAQ

Why no Netbird? You said mesh VPN. Full self-hosted Netbird (management plane, signal, TURN, IdP) deserves its own video — that's Episode 5. wg-easy gets you a working WireGuard VPN today with one env var. Skip both if you don't need remote access yet.

Backups? docker compose down, snapshot/borg the named volumes, up -d. A proper 3-2-1 setup (borgmatic + offsite) is Episode 10. Until then: at minimum enable your host provider's snapshot backups.

Can I run only some services? Yes — comment out what you don't need in compose.yml and remove its Caddyfile block. Everything is independent except Outline → Forgejo (SSO) and Outline → its postgres/redis.

Is latest okay for images? For a homelab: pragmatic. For production: pin versions and read HARDENING.md.

CI: your own runners (Episode 2)

Forgejo ships Actions. Turn it on, give it a runner, and you have GitHub Actions with no minute counter.

# 1. Enable it (already set in compose.yml)
#    FORGEJO__actions__ENABLED and repo.actions in DEFAULT_REPO_UNITS.
#    Without repo.actions in the default units, the Actions tab stays hidden
#    and it looks like the feature is broken. Existing repos: flip it per repo.

# 2. One shared secret for declarative registration
SECRET=$(openssl rand -hex 20)
UUID=$(python3 -c 'import uuid,sys;print(uuid.UUID(bytes=sys.argv[1][:16].encode()))' "$SECRET")
printf 'RUNNER_SECRET=%s\nRUNNER_UUID=%s\n' "$SECRET" "$UUID" >> .env

# 3. Tell Forgejo about it
docker compose exec -u git forgejo forgejo forgejo-cli actions register \
  --name box-runner --labels docker --secret "$SECRET"

# 4. Fill in the runner config and start the CI profile
cp runner-config.example.yml runner-config.yml
sed -i "s|https://git.example.com|https://git.$DOMAIN|; s|\${RUNNER_UUID}|$UUID|; s|\${RUNNER_SECRET}|$SECRET|" runner-config.yml
docker compose --profile ci up -d

Then check Site Administration → Runners: the runner should be online with the label docker.

Four things that cost people an evening:

• A registration token from the web UI is not a shared secret. The declarative path above only accepts the secret you generated. Feed it the web token and the runner connects and never receives a job, with no error anywhere.
• The connections: block lives under a top-level server: key in runner 13.x. Older examples put it under runner:, which fails with 0 server connections configured.
• An empty labels: list means every job waits forever. No error, just a queued job and a healthy-looking runner.
• The image behind a label must contain node — Forgejo actions are JavaScript. Pointing docker at a docker-cli image gives you node: executable file not found. Use a node image and let the build job fetch a static docker client (see examples/ci.yml).

examples/ci.yml is a complete pipeline: test, build a container, push it to Forgejo's built-in registry, and deploy it over an SSH key that can only run one command (examples/deploy-hello-ops.sh). Read the CI section of HARDENING.md before you wire the deploy step — there are two comfortable ways to hand your whole server to anyone who can push a branch.

One login for the vault (Episode 4)

Your Forgejo already knows your team. Let it log them into the password manager too, so offboarding is one switch instead of a checklist.

# 1. Create the OAuth2 app in Forgejo
#    Site Administration -> Applications -> OAuth2 Application
#    Name:         Vaultwarden
#    Redirect URI: https://vault.<DOMAIN>/identity/connect/oidc-signin
#    Confidential client: yes
#
#    That redirect path is not documented anywhere in the UI, and a wrong one
#    only fails AFTER the Forgejo login. Copy it character for character.

# 2. Put the client id and secret in .env
VAULTWARDEN_SSO_CLIENT_ID=...
VAULTWARDEN_SSO_CLIENT_SECRET=...

# 3. Restart just that container
docker compose up -d vaultwarden

# 4. Log in: https://vault.<DOMAIN>
#    Type your work mail, hit "Use single sign-on", authorize once in Forgejo.

Vaultwarden will then ask you to set a master password. That is not a bug. Forgejo proved who you are; nothing so far produced the key that decrypts your vault. Your master password never leaves your browser, and the server stores blobs it cannot read. Two different jobs, two different mechanisms.

Debugging notes, all of them learned the hard way:

• Vaultwarden logs nothing about SSO at startup. It builds the OIDC client on the first login attempt, not before. Watch docker compose logs -f vaultwarden while you log in instead: you will see a prevalidate call and then the oidc-signin callback coming back with a code.
• /identity/connect/authorize and the callback both answer 404 when called without query parameters. That is route matching, not a wrong path.
• curl -I on Forgejo's /.well-known/openid-configuration returns 404 because there is no HEAD route. Use curl -s and it is a normal 200.
• Turn on SSO_SIGNUPS_MATCH_EMAIL before anyone logs in, or you get duplicate accounts instead of linked ones.

Then make it a team vault: create an organization, add collections, invite people. Note that joining is three steps, not two: you invite, they log in, and then an owner has to confirm them. Until that confirmation, a member sees no shared items at all.

Hardening

Before you put real company data on this box, read HARDENING.md. The short version: SSH keys only, firewall (80/443/2222/51820 only), unattended security updates, fail2ban, pinned image tags, offsite backups.

---

MIT — do whatever. If it saved you money, a YouTube subscription is the price: @selfhostedops