Apps
The curated catalog of apps you can install from Hoserva. Each template is written from the application’s own documentation. To install one, open Apps → Catalog in Hoserva.
Catalog serial 1791376837, built 2026-10-07.
94 apps
- A network-wide DNS server that blocks ads, trackers and malicious domains for every device that uses it as its DNS server, with a web interface for filter lists, custom rules and a query log. On the first start, open the first-run setup port once and run the setup wizard, keeping its ports at their defaults (DNS on 53, the admin interface on 80); afterwards the interface is on the Web UI port. Then set this server's address as the DNS server of your router or of single devices. The DHCP server and encrypted DNS (DNS-over-TLS, -QUIC and -HTTPS) are not set up. Without host networking, queries show the Docker gateway as their client instead of the device that sent them. The default DNS and Web UI ports, 53 and 80, are also Pi-hole's, so to run both, give one of them different ports. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A self-hosted audiobook and podcast server: listen to your audiobooks and podcasts from a browser or the Audiobookshelf mobile apps, with listening progress kept for each user. On the first visit it asks you to create the administrator account; then add libraries from /audiobooks and /podcasts. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A web interface for restic backups: define backup plans for your folders, run them on a schedule, browse the snapshots and restore files, with repositories on a local folder or on remote storage. The folder to back up is mounted read-only at /source and the local backup and restore folder at /backups. With the default folders /backups is also visible inside /source, so exclude it from every plan, or the backup copies itself. On the first visit Backrest asks for an instance ID, which cannot be changed later, and a username and password. Keep a copy of each repository's password away from this server: the backup cannot be restored without it. A backup kept only on this server is lost with the server, so add a remote repository too. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A subtitle manager that works with Sonarr and Radarr: it finds and downloads subtitles for the series and movies in your library from subtitle providers, in the languages you choose. It mounts the same data folder as Sonarr and Radarr, so the library paths they report are the paths Bazarr reads. In Bazarr the series are under /data/media/tv and the movies under /data/media/movies.
- A music library manager that imports your music, corrects its tags from online music databases and organises the files into a tidy folder structure. You use it with commands in the app's container. The image's default configuration keeps the library at /music, which is not mounted here: edit the configuration with docker exec -it -u abc <container> beet config -e and set directory: /data/media/music. Run an import with a path under /data, for example beet import /data/torrents/<folder>. Imports copy files by default; set move: yes or hardlink: yes under import to avoid the copy (with hardlink: yes, also set write: no).
- A self-hosted wiki for organising and storing information: content is arranged in shelves, books, chapters and pages and edited in the browser, for notes, documentation or a family knowledge base. It runs with its MariaDB database in the same stack. Before installing, generate the application key once with the command in that input's help text and keep it as it is afterwards. The first sign-in is admin@admin.com with the password password; change both straight away. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A configuration-driven backup tool for Borg: you describe what to back up in a YAML file, and borgmatic creates, prunes and checks deduplicated, optionally encrypted backups on a schedule. It has no web interface. In the container, run borgmatic config generate -d /etc/borgmatic.d/config.yaml, set source_directories and repositories in that file, then create the repository with borgmatic repo-create --encryption repokey-blake2. The image runs the backup daily at 01:00. The folder to back up is mounted read-only at /source and the local backup and restore folder at /backups; with the default folders /backups is also visible inside /source, so exclude it from the backup. With the repokey encryption above, the repository key is stored in the repository itself, so keep the repository passphrase and an exported copy of the key (run borgmatic key export) away from this server: the backup cannot be restored without the passphrase, or without the key if the repository's copy is damaged.
- The Calibre ebook manager in your browser: add books, convert formats and edit metadata. Calibre's window is streamed to the browser. The library folder is the one the Calibre-Web template serves, so both apps see the same library. In Calibre's first-run wizard keep the default library location. The desktop is served over HTTPS with a self-signed certificate, so the browser asks you to accept it once.
- A web interface for browsing, reading and downloading the ebooks of a Calibre library, with separate user accounts for your family. It serves an existing Calibre library, the folder that holds metadata.db, mounted at /books: on the first setup screen enter /books as the location of the Calibre database. The Calibre template manages the same library; do not edit it from both apps at the same time. The default login is admin with the password admin123; change it right after the first login. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- Visual Studio Code in the browser: a full code editor with a terminal, extensions and git, running on your server so you can work on its files and projects from any device with a browser. The web interface is served over plain HTTP, so the password and everything you open or type, terminal included, cross the network unencrypted. Keep it on your local network, and reach it from outside only through an HTTPS reverse proxy or an SSH tunnel: whoever signs in gets a terminal that can change the workspace folder.
- A dynamic DNS client that keeps a DNS record pointing at your home network's current public IP address, updating your DNS provider whenever the address changes. It supports many providers. It has no web interface and needs no ports. Set it up by editing ddclient.conf in the app's folder: uncomment your provider and fill in the login or token it asks for. ddclient reads the file again when it changes.
- A lightweight BitTorrent client with a web interface and plugins, for downloading and seeding torrents on your server from any browser. The web interface login is the password deluge until you change it: do that first, under Preferences > Interface > WebUI Password. Under Preferences > Downloads set Download to to /data/torrents, and under Preferences > Network untick Use Random Port and set the incoming port to the torrent connection port chosen at install; otherwise Deluge listens on random ports that are not mapped. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A simple wiki that keeps its pages in plain text files, so it needs no database. Use it for notes and documentation, written in a lightweight markup syntax. On the first start, open /install.php on the Web UI port, complete the installer, then restart the app. After that, in Admin, Configuration Settings, set Use nice URLs to .htaccess and tick Use slash as namespace separator in URLs, as the image documentation describes. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A client for the free Duck DNS dynamic DNS service: it keeps your duckdns.org name pointing at your home network's current public IP address, updating it every five minutes. Register the subdomain at duckdns.org first and copy the token shown on that page. It updates the IPv4 address only. It has no web interface and needs no ports.
- A backup client with a web interface: it makes encrypted, incremental backups of your folders to local folders or to cloud and remote storage, on a schedule you set. The folder to back up is mounted read-only at /source and the local backup and restore folder at /backups; pick /backups as a local destination. With the default folders /backups is also visible inside /source, so exclude it from every backup. Duplicati runs as user 99 and group 100, so a file that only another user may read is reported in the backup log. Keep a copy of each backup's passphrase away from this server: the backup cannot be restored without it. Duplicati answers requests to the server's IP address; to open it by host name, set DUPLICATI__WEBSERVICE_ALLOWED_HOSTNAMES as the Duplicati documentation describes. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A media server for your movies, TV shows and music: it organises the library and streams it to apps and browsers on your devices, transcoding video when a device needs a different format. The optional HTTPS port (8920) is not mapped, so add clients by the server's address. Add libraries from /data/media. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A local speech-to-text server for Home Assistant's voice assistant: it turns what you say into text on your own server, so no audio leaves your network. It runs faster-whisper, a fast implementation of OpenAI's Whisper models, behind the Wyoming protocol that Home Assistant speaks. This template uses the CPU image; the image's gpu tag is for NVIDIA GPUs only and is not used here. The model you choose is downloaded the first time it starts, which can take a few minutes, and is kept in the app's folder. To connect it, open Home Assistant, go to Settings, Devices & services, add the Wyoming Protocol integration and enter this server's address and the Wyoming port (10300 by default). Then choose it as the speech-to-text service in your voice assistant. The server has no login, so keep it on your local network.
- The Firefox browser running on your server, streamed to your own browser. Use it to reach pages that are only open on your local network, such as a router, a switch or a printer, from anywhere you can reach the server. The browser is served over HTTPS with a self-signed certificate, so your browser asks you to accept it once. Its bookmarks, logins and settings are kept in the app's folder. Keep it on your local network: the login protects it, but anyone who can sign in controls a browser inside your network.
- A proxy server that loads pages in a Chrome browser to get past the Cloudflare and DDoS-GUARD challenge pages some sites show, so that apps such as Prowlarr can reach indexers behind them. It has no web interface; Prowlarr sends it requests. In Prowlarr, add a FlareSolverr indexer proxy under Settings, Indexer Proxies, with the host http://<server>:<proxy port>, and give the proxy and the indexers that need it the same tag: a proxy without a tag is disabled. Never forward its port on your router: the project warns against exposing it to the internet. Each request starts a browser that uses a lot of memory, so on a server with little memory avoid many requests at once.
- A self-hosted RSS and Atom feed reader that collects the sites you follow in one place, readable from any browser, with support for several users. Open the web UI to run the setup wizard. SQLite, one of the databases FreshRSS supports, needs no further container; the wizard also accepts an external MySQL, MariaDB or PostgreSQL server. Extensions go in www/freshrss/extensions in the app's folder and are active after the app restarts. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A network video recorder for IP cameras with local, real-time object detection: it records your cameras, detects people, cars and other objects, and works with Home Assistant. On its first start Frigate creates a basic configuration and prints the password of the generated admin user in its log: sign in with it, change it under Settings > Users, then add cameras under Settings > Camera management. The web interface uses HTTPS with a self-signed certificate, so the browser warns on the first visit. Continuous recording writes to the recordings folder all the time and keeps its disk spinning, so give it a share on one dedicated disk, so the others can spin down. The RTSP restream has no login unless go2rtc is configured otherwise. A Coral TPU and an NVIDIA GPU are not set up.
- A lightweight self-hosted Git service: host repositories, review code with pull requests, track issues and collaborate, from a web interface or over SSH. In the first-run wizard keep the SQLite database and set the base URL to the address you open Gitea at, with the web port. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A dashboard and visualisation tool: connect data sources such as Prometheus and build dashboards and alerts from your metrics and logs. No data source or dashboard is set up. Sign in as admin with the administrator password from the install form, which Grafana applies only on its first start, so change it afterwards in Grafana. Add Prometheus or another data source with an address that the app can reach, for example http://<host>:9090. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A self-hosted household manager: stock levels with best-before dates, shopping lists, recipes, meal plans, chores, tasks and more, all in one web app. Sign in with the default account, admin with the password admin, and change the password straight away. After every update, open the Grocy start page (the logo at the top left) once: that runs the database migrations. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A monitor for cron jobs and other scheduled tasks: each job pings a unique URL when it runs, and Healthchecks alerts you when a ping does not arrive on time. Open Healthchecks at exactly the address entered as the site address: it answers only requests to that host name and builds the ping URLs from it. The administrator account is created on the first start from the email address and password you give. Healthchecks can only send email alerts when a mail server is set. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- An application dashboard: a start page of tiles that link to your self-hosted apps and websites, with live status information for some of them. A fresh install asks for no login. To require one, give the user a password on the Users page and turn off Allow public access to front there. The HTTPS address uses a certificate the image generates itself, so a browser warns about it. The default ports 80 and 443 are also those of Nginx Proxy Manager and SWAG; change them to run these together.
- An open-source home automation hub that connects smart devices from many brands in one place, with dashboards, automations and local control. It runs on the host's network, which Home Assistant needs to discover devices on your network, so its web interface is on port 8123 of the server and the port cannot be changed here. USB devices such as a Zigbee adapter and Bluetooth are not set up by this template. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A customisable dashboard for your server: a start page with links to your apps and services and widgets showing their status, configured with YAML files. Homepage answers only on the addresses you list as allowed: enter the address you open it at, with the port, exactly as the browser shows it. If the page shows a host validation error, the log names the host to add. It creates example configuration files in the app's folder; edit services.yaml, widgets.yaml and the others there. The page has no login, and the optional Docker integration is not set up.
- A self-hosted photo and video library: back up from your phone with the mobile apps, browse a timeline, search, share albums and find people and objects, with the recognition running on your own server. The stack has four services: the server, machine learning (the CPU variant), a cache and a PostgreSQL database. The database stays in the app's folder on the cache, never on the pool; only the uploaded library goes on the pool. The server and machine learning run the same release, so they are updated together. The first account you register becomes the administrator. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- An indexer proxy: it translates the searches of apps such as Sonarr and Radarr into requests to many torrent trackers and indexers and sends the results back in a form those apps understand. Add your trackers and the connections to other apps in the web interface. The blackhole folder is only used if you set /downloads as the blackhole directory in Jackett's settings.
- A free, open-source media server for your movies, TV shows and music: it organises the library and streams it to apps and browsers on your devices. The optional client discovery (port 7359 over UDP), DLNA (port 1900 over UDP) and HTTPS port are not mapped, so add clients by the server's address. Add libraries from /data/media. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A self-hosted reading server for comics, manga and ebooks: browse and read your library in the browser, with reading progress and user accounts. On the first visit follow Kavita's setup wizard, then add libraries from /data, for example /data/comics, /data/manga and /data/ebooks. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A media server for comics, manga and ebooks: browse and read your collection in the browser, and open it from compatible reader apps through its OPDS feed. Add libraries from /data in Komga, for example /data/comics and /data/manga. Komga's Java process is limited to about 1 GB of memory by default; if the logs show OutOfMemory errors, add JAVA_TOOL_OPTIONS (for example -Xmx4g) to the app's environment. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A backup tool with a web interface: it takes encrypted, deduplicated snapshots of your folders and keeps them in a local folder or on cloud and remote storage. The folder to back up is mounted read-only at /source and the local backup and restore folder at /backups. With the default folders /backups is also visible inside /source, so exclude it from every snapshot. The web interface is served over plain HTTP, so use it on your local network or behind an HTTPS reverse proxy; sign in with the web UI username and password. When you create or connect the repository in the web interface, enter the repository password from the install form (it is in the stack's .env file), and keep a copy of it away from this server: the backup cannot be restored without it. Mounting a snapshot is not available; restore files instead.
- A book and audiobook library manager: it tracks the authors you follow, finds their new books, sends them to your download client and sorts the finished downloads into your library. One data folder holds the downloads and the library, so moves can be hardlinks. In LazyLibrarian's settings, under Processing, set the book destination folder to /data/media/books and the audiobook destination folder to /data/media/audiobooks; under Downloaders, use the paths under /data/torrents or /data/usenet that your download client reports. Calibre import and audiobook conversion are not set up.
- A self-hosted network speed test that runs in the browser: it measures download and upload speed, ping and jitter between a device and your server. The test page is open to anyone who can reach the port. The results are kept in the app's folder and shown at /results/stats.php, which asks for the results password. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A music collection manager: add the artists you follow, and it watches for new albums, sends them to your download client and organises the downloaded files in your music library. In Lidarr set the root folder to /data/media/music and, in the download client settings, use the paths under /data/torrents. It needs a download client and indexers, for example through Prowlarr. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A MariaDB database server, compatible with MySQL clients, for apps in other stacks and your own projects. The administrator is root, with the root password from the install form (it is in the stack's .env file); the image applies it only when it creates the database on the first start. Create a separate user and database for each app instead of sharing root. The database port is published so that apps in other stacks and programs outside Docker can connect; 3306 is the usual MySQL port, so change it if something on this server already uses it.
- Mastodon is a self-hosted social network that takes part in the fediverse, so your account can follow and be followed by people on other servers. This template runs it with PostgreSQL and Redis; use it for yourself, your family or a small community. Before installing you need a public domain name, with HTTPS served by a reverse proxy: other servers reach yours by that name, and it cannot be changed later. The app serves HTTPS with a self-signed certificate on the Web UI port; point the proxy at that port over https and let it skip checking the certificate. You also generate the push notification (VAPID) keys once with the command in the input's help text. The other secrets are generated for you. Email (SMTP) is optional, but without it Mastodon cannot send sign-up confirmations or notifications; the first account is created from the command line, as the template's comments explain.
- A self-hosted recipe manager and meal planner: import recipes from web pages, organise them, plan meals and build shopping lists. Sign in with the default account, changeme@example.com with the password MyPassword, and change both straight away. Sign-up without an invitation is off, and email is not set up, so invitations and password resets by email are not available. Mealie makes backups in the app's folder; copy them somewhere off this server. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A web front end for yt-dlp: paste a video or playlist link from YouTube or another site yt-dlp supports, and MeTube downloads it as video or audio into a folder on your server. Downloads go to the download folder, which defaults to a folder of the media library so that Jellyfin or Plex can show them once you add it as a library. On every start the image makes user 99 and group 100 the owner of everything in that folder. Sites change often and MeTube publishes a new image for every yt-dlp release, so keep the app updated.
- An MQTT message broker: the lightweight publish and subscribe hub that smart home devices and apps such as Home Assistant and Zigbee2MQTT use to exchange messages. On the first start the template writes a configuration with password authentication (no anonymous clients), an MQTT listener on port 1883 and an MQTT over WebSockets listener on port 9001; clients connect to the server's address with the MQTT user name and password. No TLS is set up, so use it on your home network. The configuration file in the app's folder is never overwritten: edit it to change the listeners.
- A workflow automation tool: connect apps and services by building workflows in a visual editor, with triggers such as schedules and webhooks and code steps where you need them. On the first visit n8n asks you to create the owner account. It keeps the encryption key for stored credentials in the app's folder: keep that folder, or the credentials cannot be decrypted. Code steps run in a separate task runner in the same stack. The web interface is served over plain HTTP, so keep it on your home network or put an HTTPS reverse proxy in front. Webhooks that outside services call need the public https address set at install.
- A music streaming server for your own collection: browse and play it from a browser or from any Subsonic-compatible app on your phone or computer. The first visit asks you to create the administrator account. Navidrome reads the music folder and never changes it. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A tool for documenting your network: keep IP addresses and prefixes, devices, racks, cables and VLANs in one place, with a web interface and an API. It runs with its PostgreSQL database and Redis in the same stack. Sign in as admin with the admin password from the install form; the account is created on the first start. The image writes its configuration file on the first start only: to change the allowed host or the database or Redis connection later, edit configuration.py in the app's folder. A password you set yourself should contain only letters and digits. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A self-hosted file sync and sharing platform: keep your files, calendars and contacts on your own server and reach them from the web, desktop and mobile apps. It is the official Nextcloud image with PostgreSQL and Redis in the same stack. On the first visit Nextcloud asks for the administrator account; the database is already set up. The web port is plain HTTP, meant for the local network or a reverse proxy; to open it under another host name, add that name to NEXTCLOUD_TRUSTED_DOMAINS as the image documentation describes. No background-jobs (cron) container is included. Nextcloud can only be upgraded one major version at a time and cannot be downgraded, so back up the app's folder and the data folder before applying an update.
- A reverse proxy with a web interface: give your apps host names, serve them over HTTPS with free Let's Encrypt certificates and manage all of it from one place, without editing Nginx files by hand. Open the admin web UI port to set it up. It uses ports 80 and 443 by default, the same as SWAG and Heimdall, so they cannot run together unless one of them gets different ports; forward ports 80 and 443 of your router to it to serve sites from the internet, but not the admin port. Ports for TCP and UDP stream forwarding are not published. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A Usenet downloader with a web interface: it fetches the files an NZB describes from your Usenet provider. Sonarr, Radarr and Lidarr can send their downloads to it. Downloads are saved under /data/usenet in the shared data folder, so those apps can import a finished download with an instant move. After install, in NZBGet's Settings > Paths set DestDir to /data/usenet/completed and InterDir to /data/usenet/intermediate, and under Categories give tv, movies and music a destination below /data/usenet. The web interface login is the one you set at install. NZBGet is given it again at every start, so a username or password changed in its settings does not last. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A note-taking app that keeps your notes as Markdown files in folders called vaults and links them together. Its desktop app runs on your server and is streamed to your browser. In Obsidian choose Open folder as vault and pick /vaults. The app is served over HTTPS with a self-signed certificate, so the browser asks you to accept it once. It includes a terminal with passwordless sudo inside the container, so keep the login set and never expose the port to the internet.
- Runs large language models on your own server and serves them through an API that other apps use. It has no web interface of its own; Open WebUI is one app that talks to it. After install, pull and run a model with docker exec -it <container> ollama run llama3.2, or from an app such as Open WebUI. Models are several gigabytes each. The API has no login: anyone who can reach its port can run, pull and delete models. Keep it on your home network and never forward it from your router. Without a GPU, models run on the CPU.
- A request tool for the people who use your media server: they search for movies and TV shows and ask for them, and Ombi passes each request on to Sonarr or Radarr. The first visit starts a setup wizard. Afterwards connect your media server (Plex, Jellyfin or Emby) and Sonarr and Radarr. Each of those runs in its own stack, so enter them by the server's address, for example http://<server>:8989 for Sonarr. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A web interface for chatting with AI language models, with your chats, documents and users kept on your own server. It works with Ollama and with other model providers. It has no models of its own: install the Ollama app, or add another provider under Settings > Admin > Connections. The first account you create becomes the administrator, and sign-up then turns itself off; let others join under Settings > Admin > Authentication. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- An SSH and SFTP server that gives one user a sandboxed login: they reach the shared folder, the app's own settings folder and the processes inside the container, not the rest of the server. Connect with, for example, sftp -P 2222 <user>@<server> and open /data, the shared folder. Sudo access is not enabled. Public keys given at install are added to the user's authorized keys when the app starts, and removing the value later does not remove them.
- A way to send files and text between devices in a web browser: devices that open the same address on the same network see each other and send directly, like AirDrop. It keeps nothing on disk. If you make it reachable from outside your home network, put it behind a reverse proxy that serves HTTPS and sets the X-Forwarded-For header correctly, otherwise every client sees every other client.
- A document management system: it imports your scanned and digital documents, makes their text searchable with OCR, and lets you tag and file them in one archive. This app runs the web server together with its own PostgreSQL database and a Valkey broker; the optional Tika and Gotenberg services for office documents are not included. On the first visit Paperless-ngx asks you to create the superuser account. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A network-wide ad and tracker blocker that works as your network's DNS server: by default, devices that use it get an address that leads nowhere for the domains it blocks. To use it, set this server as the DNS server in your router or on individual devices. Pi-hole's own DHCP server, NTP and HTTPS are not set up here. Because it runs on Docker's bridge network, its query log shows the Docker gateway as the client of each query. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A self-hosted app that downloads videos from YouTube channels and playlists you choose, using yt-dlp, and keeps checking for new ones. The files are saved to a folder, ready for a media server. The download folder defaults to a youtube folder in the media library. To have Jellyfin or Plex pick the videos up, create a Media Profile with the Media Center preset in Pinchflat and add the folder as a TV show library in the media server.
- A web photo gallery: upload your photos, sort them into albums and tags, and let family and friends browse them. It runs with its own MariaDB database. On the first visit the installation page asks for it: enter db as the host, piwigo as the user name and the database name, and the database password from the stack's .env file; then create the administrator account. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A media server that organises your movies, TV shows, music and photos and streams them to Plex apps on your TV, phone and computer. This app uses bridge networking, so only port 32400 is published. Discovery of the server on the local network, DLNA and the companion port are not available; players find the server through your Plex account or by its address.
- A PostgreSQL relational database server for the apps that need one and for your own projects. The PostgreSQL project supports a major version for five years after its first release. PostgreSQL 15 was first released on October 13, 2022, and its final release is scheduled for November 11, 2027. Choose a newer major version for a new install; use this one for apps that need 15 or to keep an existing 15 database running until it is migrated. Each major version is its own template, and this one only ever moves within PostgreSQL 15. Moving to a newer major version is PostgreSQL's own upgrade, with pg_upgrade or a dump and restore.
- A PostgreSQL relational database server for the apps that need one and for your own projects. The PostgreSQL project supports a major version for five years after its first release. PostgreSQL 16 was first released on September 14, 2023, and its final release is scheduled for November 9, 2028. Each major version is its own template, and this one only ever moves within PostgreSQL 16. Moving to a newer major version is PostgreSQL's own upgrade, with pg_upgrade or a dump and restore.
- A PostgreSQL relational database server for the apps that need one and for your own projects. The PostgreSQL project supports a major version for five years after its first release. PostgreSQL 17 was first released on September 26, 2024, and its final release is scheduled for November 8, 2029. Each major version is its own template, and this one only ever moves within PostgreSQL 17. Moving to a newer major version is PostgreSQL's own upgrade, with pg_upgrade or a dump and restore.
- A PostgreSQL relational database server for the apps that need one and for your own projects. The PostgreSQL project supports a major version for five years after its first release. PostgreSQL 18 was first released on September 25, 2025, and its final release is scheduled for November 14, 2030. Each major version is its own template, and this one only ever moves within PostgreSQL 18. Moving to a newer major version is PostgreSQL's own upgrade, with pg_upgrade or a dump and restore.
- A monitoring system that collects numeric metrics from your services and stores them as time series you can query and graph. As installed it collects metrics only from itself. To collect from other targets, bind-mount a prometheus.yml with a scrape_configs entry for each of them at /etc/prometheus/prometheus.yml by adding it to the volumes of the app. Its web page has no login, so keep it on your home network. The stored metrics must be on a local disk: the project does not support network file systems such as NFS for them.
- An indexer manager for the Sonarr, Radarr and similar apps: you add your torrent trackers and Usenet indexers once, and Prowlarr keeps them in step with those apps. After install add Sonarr, Radarr and your other apps under Settings > Apps, using the server's address and each app's API key. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A download manager with a web interface that fetches files from one-click hosters and other sources, with plugins for many sites. The web interface login is pyload with the password pyload until you change it: do that first. Finished downloads go to the download folder you choose, a plain download folder rather than part of a media library. Click'n'Load, which lets a browser extension send links on port 9666, is not published. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A BitTorrent client with a web interface, used to download and seed torrents. Sonarr, Radarr and similar apps can send their downloads to it. The web interface user is admin. A temporary password is printed to the container log on the first start, and a new one at every start until you set your own in the settings. In the settings set the default save path to /data/torrents, so hardlinks and instant moves work for the apps that import the downloads. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A movie collection manager: it watches your indexers for the movies you want, sends them to your download client, and renames and files them in your library. One data folder holds both downloads and library, so imports are hardlinks or instant moves. In Radarr set the root folder to /data/media/movies, and in the download client use the paths under /data/torrents. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A tool for copying files to and from cloud storage and other remote locations, here with its web interface for adding remotes and starting transfers. The folder to back up is mounted read-only at /source, so rclone cannot change or delete what it copies; restore only into /backups. rclone copies when you start a transfer and has no schedule of its own. With the default folders, /source/backups is the backup folder itself: exclude it from every copy, and exclude /source/appdata if the pool has an appdata share. A copy kept on this server does not survive losing it, so copy to a remote or a USB disk as well. Anyone signed in to the web interface can run commands and read every file and stored credential rclone can reach, so keep it on your home network. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS. On its first start rclone downloads the web interface from GitHub.
- A command-line tool that keeps the quality profiles, custom formats and naming settings of Sonarr and Radarr in line with a configuration file, including the settings the TRaSH Guides recommend. It has no web interface and syncs on the schedule you set. Nothing is synced until you write the configuration: Recyclarr creates recyclarr.yml in the app's folder on the first start; edit it, or create one from a template with docker exec <container> recyclarr config create --template <name>. In it, refer to the address and API key inputs with !env_var SONARR_URL and !env_var SONARR_API_KEY, and the same with RADARR for Radarr.
- An in-memory data store that apps use as a cache, a queue or a fast database, and that you can use in your own projects. Connect to the server's address on the Redis port with the password, for example redis://:<password>@<host>:<port>. The password is set on Redis's command line, so anyone who can inspect the container can read it. Data is saved to the app's folder with snapshots and an append-only file.
- Peer-to-peer file synchronisation between your devices without a cloud service: the folders you add stay in step across the computers, phones and servers that run Resilio Sync. Open the web interface to create the account and configure it; there is no preset login. Add the folders to sync under /sync, the sync folder. The sync port is the one Resilio Sync uses to connect to other devices, over TCP and UDP. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A Usenet downloader with a web interface: it fetches the files an NZB describes from your Usenet provider, then checks and unpacks them. Sonarr, Radarr and similar apps can send their downloads to it. In the setup wizard or under Config > Folders set the temporary download folder to /data/usenet/incomplete and the completed download folder to /data/usenet, so categories sort downloads into /data/usenet/tv and so on. SABnzbd only answers to addresses it knows: open it by the server's IP address, add the server's name to host_whitelist under Config > Special, or set a username and password under Config > General.
- A request manager for your media library: people search for movies and TV shows and ask for them, and Seerr sends the requests to Sonarr or Radarr. It works with Jellyfin, Plex and Emby. On the first visit a setup wizard connects Seerr to your media server and then to Sonarr and Radarr. Each of those runs in its own stack, so enter them by the server's address, for example http://<server>:8989 for Sonarr. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A network latency monitor: it pings the hosts you choose at regular intervals and draws graphs of the delay and packet loss over time. The page is at /smokeping/smokeping.cgi on the web UI port. To choose what it measures, edit the Targets file in the config folder (smokeping/config in the app's folder), restart the app, and wait about ten minutes for the first graphs. The default Targets file holds examples, some of which may not work on your network.
- A TV series collection manager: it watches your indexers for new episodes of the shows you follow, sends them to your download client, and renames and files them in your library. One data folder holds both downloads and library, so imports are hardlinks or instant moves. In Sonarr set the root folder to /data/media/tv, and in the download client use the paths under /data/torrents. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A tool that runs internet speed tests on a schedule and keeps the results, so you can see how your connection's speed changes over time. Each test runs Ookla's Speedtest against the internet and uses your connection's bandwidth. The application key must be entered by hand in the format the install form shows: keep a copy of it away from this server, since data encrypted with a lost key cannot be read. The administrator account is created on the first start from the email address and password given at install; changing those inputs later has no effect, so change them in Speedtest Tracker. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A self-hosted web app that organises and serves a collection of videos and images: it gathers information about them from the internet, lets you tag and sort them, and plays them in your browser. In the setup wizard keep the suggested folders, and choose /blobs if it asks where to store blobs. Generated previews, sprites and transcodes can grow large; they stay in the app's folder on the cache. The official image has no hardware acceleration, and Stash shows times in UTC.
- An Nginx web server and reverse proxy that gets and renews free certificates for your own domain (Let's Encrypt or ZeroSSL) and blocks repeated bad requests with fail2ban, so you can reach your apps from the internet over HTTPS. It needs ports 80 and 443, the same ports Nginx Proxy Manager uses, so the two cannot run together on one server. Fail2ban needs the NET_ADMIN capability, which the install summary shows.
- Continuous file synchronisation between your devices: the folders you pair stay in step directly between the devices, without a cloud service or a central server. Add folders to sync in Syncthing under /data1, the sync folder. This app uses Docker's default network mode, in which Syncthing sees only the container's internal address, and its own notes recommend host networking: enter the other device's address by hand when connecting devices on your local network. Set a username and password for the web interface under Actions > Settings, because it listens on every address. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A monitoring, statistics and notification tool for Plex Media Server: see who is watching what, browse the watch history, and get alerts for streams and newly added media. On the first visit a setup wizard signs in to Plex and asks for the Plex server. Plex runs in its own stack or on another machine, so enter it by the server's address and port, for example <server>:32400. Plex's log folder is not mounted; to use Tautulli's built-in Plex log viewer, add a read-only mount of Plex's Logs folder and set it under Settings > Plex Media Server.
- A tool that transcodes the files in your media library automatically and checks their health, using the rules and plugins you set up, so your videos end up in the formats you choose. Tdarr replaces files in the library with their transcoded versions, so keep a copy of anything you cannot replace. A library scan walks the whole library folder and wakes the pool's disks. The cache where each file is written while it is processed is in the app's folder on the cache. The server port for separate nodes is not published, so a node on another machine cannot join.
- A BitTorrent client with a web interface, used to download and seed torrents. Sonarr, Radarr and similar apps can send their downloads to it. The image presets download folders inside the container, outside the data folder. To keep hardlinks and instant moves working, stop the app after install, open settings.json in the app's folder, set download-dir to /data/torrents and incomplete-dir to /data/torrents/incomplete, and start it again; Transmission writes the file back when it stops. The web interface login is the one you set at install, written into settings.json at every start. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A TV streaming server and recorder: it takes live TV from sources such as DVB tuner cards and IPTV, and streams and records it for apps such as Kodi. This app uses bridge networking. IPTV, SAT>IP and HDHomeRun need host networking, so for those change the network mode of the app's Compose file to host and remove its ports. No tuner device is mapped: for a DVB card add /dev/dvb:/dev/dvb to the Compose file, only on a server that has a card, since Docker refuses to start a container whose device is missing. On the first login the setup wizard under Configuration > General > Base guides the basic setup.
- A home server for your comics and ebooks. Read them from a browser, tablet, phone or e-reader, at home or from anywhere you can reach your server. Ubooquity is free for non-commercial use. It has two web addresses. The library, on the Library port, is where you and your family read; the admin page, on the Admin port at /ubooquity/admin, is where you set the administrator password on first use, add the folders to share and create user accounts. Add the folders /books, /comics and /files in the admin page under Library, then press Save and restart. The pages are served over plain HTTP, so use them on your home network or behind a reverse proxy that serves HTTPS.
- Management software for UniFi network devices such as access points, switches and gateways: adopt, configure and monitor them from a web interface. It runs with its own MongoDB database. The web interface is at https://<server>:<web UI port> with a self-signed certificate, and its first-run wizard sets the application up or restores a backup. Devices are told to contact the controller at the container's own address, which they cannot reach: in the application turn on Inform Host Override and enter this server's address (search for Inform if you cannot find it). The device inform port 8080, the STUN port 3478/udp and the discovery port 10001/udp are fixed. Port 8080 cannot be remapped, because devices are told it, so if another app on this server uses 8080, give that app another port. The optional ports (local controller discovery, guest portal redirects, mobile speed test, remote syslog) are not published.
- A background service that extracts the archives in finished torrent downloads so Sonarr, Radarr, Lidarr and Whisparr can import them, then deletes the extracted files after the import. It has no web interface. Fill in the address and API key of each app you use; an app left empty is skipped. An API key shorter than 32 characters stops Unpackerr from starting, so check its log. It looks for downloads under /data/torrents and leaves usenet downloads alone, because the download client extracts those itself.
- A self-hosted monitoring tool that checks whether your websites, services and servers are up, shows their status on a dashboard, and alerts you when one goes down. On the first visit you create the administrator account. The data folder holds an SQLite database, so it must be on a local disk and not on a network share. The Docker socket that monitoring containers needs is not mounted. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A password manager server that works with the Bitwarden apps, browser extensions and web vault, so you can store and sync your passwords on your own server. The web vault needs HTTPS in most browsers, so put a reverse proxy that serves HTTPS in front of it and enter that address as the public address. Sign-up is open so you can create the first account: after creating it, change SIGNUPS_ALLOWED to false in the app's Compose file so no one else can register. The admin page is disabled.
- A full Linux desktop in the browser: the XFCE desktop on Alpine, streamed to any modern web browser. Use it for the odd graphical tool on the server without leaving the browser. This template pins the image's default flavour, XFCE on Alpine. The desktop is served over HTTPS with a self-signed certificate, so the browser asks you to accept it once. It includes a terminal with passwordless sudo, so anyone who can sign in has root inside the container: keep it on your local network.
- A collection manager for adult movies and scenes for Usenet and BitTorrent users: it watches your indexers, sends downloads to your download client, and sorts and renames the results in your library. This app runs Whisparr v3, which covers scenes and movies. One data folder holds both downloads and library, so imports are hardlinks or instant moves. In Whisparr set the root folder to a folder of its own under the library, for example /data/media/whisparr, and in the download client use the paths under /data/torrents or /data/usenet. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A wiki engine for writing and organising pages in your browser, with Markdown and visual editors and access control through user groups. It uses its built-in SQLite database, so no database service is needed. All pages are in the app's folder, so back that folder up. On the first visit Wiki.js asks you to create the administrator account. The web interface is served over plain HTTP, so use it on your home network or behind a reverse proxy that serves HTTPS.
- A WireGuard VPN server: it creates a configuration and QR code for each of your devices, so they can reach your server and home network securely from anywhere. Forward the VPN port (UDP) of your router to this server. Each device's configuration file and QR code image are saved in the app's folder under wireguard/peer1, peer2 and so on, or wireguard/peer_<name> for named devices. To add devices later, raise the number of devices or add names, and recreate the app. By default all of a device's traffic, IPv4 and IPv6, goes through the VPN. WireGuard needs the NET_ADMIN capability, which the install summary shows.
- A bridge between your Zigbee devices and MQTT: it controls Zigbee lights, sensors and switches through a USB adapter and publishes them to an MQTT broker, without the vendors' own hubs. It needs an MQTT broker, such as the Mosquitto app, and a Zigbee USB adapter in the server; adapters on the network (tcp://) are not covered. On the first start the web interface shows an onboarding page filled in with the settings from install: pick the adapter type (zstack, ember, deconz, zigate or zboss) and submit, and Zigbee2MQTT then starts with its frontend at the same address. The frontend has no login unless you set an auth token in its settings, so keep it on your home network.
