Actual Budget - Excellent budgeting app. It can be automatically synced with your bank (SimpleFIN Bridge for US banks, $15/year), but I have found that to be unstable
- There used to be an official app but it has been discontinued - I added the website to my phone's home screen and it works quite well
AudioBookShelf - Audiobook server
- The official mobile client works great
Calibre Web - Ebook management
Gitea - Git server - in the process of replacing my GitHub account
Grocy - Household management (Am I out of milk? Do I have AAA batteries? What can I make for dinner?)
- iOS Client
Homepage - My default new tab page - has info and stats about all my services plus links
Immich - Photo and video management
- Their official mobile apps are quite good
Jellyfin - Media server for movies, TV shows, and music
- Feishin - Desktop music client (soon to be replaced by audioling)
- Finamp - Mobile music client
- For other devices (desktop, mobile, Roku/Android TV) I use either the web app or the official Jellyfin client
Joplin - Notes (Obsidian alternative)
Kiwix - Offline wiki hosting - I have Wikipedia, the Arch Linux wiki, and several others downloaded
LinkStack - Self-hosted LinkTree alternative (azpsen.com) - more for content creators, definitely overkill for what I need. I'll probably replace it with a simple static site at some point
Miniflux - Minimalist RSS feed reader
- NetNewsWire - Wonderful all-purpose iOS RSS client
Paperless-ngx - Document management system for legal documents, IDs, bank statements, etc.
- Swift Paperless - iOS client
Tandoor - Recipe management, so I always know which zucchine muffin recipe is the good one
- Untare - Mobile client (discontinued but it still works for now)
- Yomu for iOS is nice and minimal and supports OPDS for use with Calibre Web
vaultwarden - Password manager
- Bitwarden clients

Monitoring

Dozzle - Docker logs all in one place
Glances - System monitor - I mostly have this for dashboard widgets but it can be useful by itself
Scrutiny - HDD SMART monitoring, so I know when to prepare for a drive failure
Speedtest Tracker - Runs scheduled internet speedtests and creates pretty graphs to keep my ISP honest

Networking

AdGuard Home - DNS filtering - I use this with tailscale to block ads on my phone
cloudflared - CloudFlare tunnel client for easy and secure external service access
gluetun - Docker VPN client and kill-switch. Very useful, allows for per-container VPN connectivity.

Note that I run tailscale on bare metal so it is not listed here, but it is very useful for remote access to services I don't want visible on the open internet as well as SSH access.

Downloading

Bazarr - Automated subtitle fetching (I also use the OpenSubtitles plugin within Jellyfin when needed, but this works hands-off most of the time)
Prowlarr - Torrent indexer that interfaces with the other *arrs
Radarr - Automated movie fetching
qBittorrent - The only torrent client I'll ever use
Sonarr - Automated TV show fetching

I use LunaSea as a mobile client for Radarr and Sonarr.

Environment

This configuration uses .env files to separate secrets from public information and keep the main docker-compose.yml a little shorter. It is set up to look for these files in /docker/env, with each service having its own <service>.env file.

Below are the variables that need to be set in the .env file for each service. Empty variables should be replaced with your values.

A Note on Email

Several of these env files include SMTP settings, which are completely optional. Automated email sending is very useful for user signups, 2FA, account recovery, and notifications, but email is notoriously difficult to self-host. The solution I've found works very well and generally gets past spam filters.

I use SendGrid with CloudFlare's email routing for email. I have a catch-all rule in CloudFlare that forwards all emails to a dedicated Gmail address, and that address uses a Send Mail As address set up with SendGrid's SMTP for sending emails by hand.

By default, emails sent this way will show a little via sendgrid.net notice. To remove this, verify your domain with SendGrid.

Also, link tracking is enabled by default and should be disabled in SendGrid's tracking settings.

SMTP Settings:

Host: smtp.sendgrid.net

Port: 587

Security: tls (or equivalent, e.g. starttls for vaultwarden)

Username: apikey

Password: API Key generated in SendGrid

From: <mailer-name>@<your-domain> - For each custom sender (mailer-name), there needs to be a verified sender in SendGrid.

cloudflared

Docs

# cloudflared.env

# Available in the cloudflare zero-trust tunnel dashboard, under `install and run a connector`
TUNNEL_TOKEN=

gluetun

Docs

The values below are specific to Mullvad VPN (gluetun docs). Other providers need different values, refer to the corresponding gluetun documentation.

# gluetun.env

VPN_SERVICE_PROVIDER=mullvad
VPN_TYPE=wireguard
WIREGUARD_PRIVATE_KEY=
WIREGUARD_ADDRESSESS=
SERVER_CITIES=

The values for WIREGUARD_PRIVATE_KEY and WIREGUARD_ADDRESSES should be available in the WireGuard configuration file generated by Mullvad. SERVER_CITIES should be set to the city of your configuration's selected exit node.

Immich

Docs

My current Immich docker setup has a lot of repetition - when I want to update, I have to change the version in 3 places. I have plans to improve this, but for now this is what works. Also note that the way I set the upload location is not recommended by the Immich docs.

#immich.env

UPLOAD_LOCATION=/media/immich
IMMICH_VERSION="v1.123.0"

TYPESENSE_API_KEY=
DB_PASSWORD=

DB_HOSTNAME=immich_postgres
DB_USERNAME=postgres
DB_DATABASE_NAME=immich
DB_DATA_LOCATION=/docker/immich

REDIS_HOSTNAME=immich_redis

POSTGRES_PASSWORD= # this should be the same as DB_PASSWORD above
POSTGRES_USER=postgres
POSTGRES_DB=immich

Joplin

Docs

# joplin.env

APP_PORT=22300
APP_BASE_URL=
DB_CLIENT=pg
POSTGRES_PASSWORD=
POSTGRES_DATABASE=joplin
POSTGRES_USER=
POSTGRES_PORT=5432
POSTGRES_HOST=joplin-db

# Optional SMTP settings
MAILER_ENABLED=1
MAILER_HOST=
MAILER_PORT=465
MAILER_SECURE=1
MAILER_AUTH_USER=
MAILER_AUTH_PASSWORD=
MAILER_NOREPLY_NAME=
MAILER_NOREPLY_EMAIL=

LinkStack

Docs

This one just needs the public hostname and admin email.

# linkstack.env

HTTPS_SERVER_NAME=
SERVER_ADMIN=

Miniflux

Docs

# miniflux.env

DATABASE_URL=postgres://miniflux:{...}@rss_db:5432/miniflux?sslmode=disable # replace {...} with your postgres password
RUN_MIGRATIONS=1

POSTGRES_USER=miniflux
POSTGRES_PASSWORD= # this is the password used above
POSTGRES_DB=miniflux

Paperless-ngx

Docs

# paperless.env

USERMAP_UID=1000
USERMAP_GID=1000
PUID=1000
PGID=1000

PAPERLESS_URL=

# Random secret key, use for example `base64 /dev/urandom | head -c50` to generate one
PAPERLESS_SECRET_KEY=

PAPERLESS_TIME_ZONE=

PAPERLESS_OCR_LANGUAGE=eng

PAPERLESS_REDIS: redis://paperless_broker:6379
PAPERLESS_OCR_USER_ARGS: '{"invalidate_digital_signatures": true}'

# Optional SMTP email settings
PAPERLESS_EMAIL_HOST=
PAPERLESS_EMAIL_PORT=587
PAPERLESS_EMAIL_USE_TLS=true
PAPERLESS_EMAIL_HOST_USER=
PAPERLESS_EMAIL_HOST_PASSWORD=
PAPERLESS_EMAIL_FROM=

Speedtest Tracker

Docs

# speedtest.env

PUID=1000
PGID=1000

# Generate with `echo -n 'base64:'; openssl rand -base64 32;` or use the speedtest-tracker website
APP_KEY=

# Public address or IP
APP_URL=

DB_CONNECTION=sqlite
APP_TIMEZONE=
DISPLAY_TIMEZONE=
SPEEDTEST_SCHEDULE=0,15,30,45 * * * * # run speedtest every 15 minutes

Tandoor

Docs

# tandoor.env

# Random secret key, use for example `base64 /dev/urandom | head -c50` to generate one
SECRET_KEY=

# Allowed hosts (see documentation), should be set to your hostname(s) but might be * (default) for some proxies/providers
ALLOWED_HOSTS=

# Add only a database password if you want to run with the default postgres, otherwise change settings accordingly
DB_ENGINE=django.db.backends.postgresql
POSTGRES_HOST=tandoor-db
POSTGRES_DB=tandoor
POSTGRES_PORT=5432
POSTGRES_USER=tandoor
POSTGRES_PASSWORD=

vaultwarden

Docs

Note that the cryptography API used by vaultwarden requires HTTPS, so local access can be a bit of a challenge.

These values are only required if you need to use the vaultwarden admin page (for user management, SMTP, hardware 2FA, etc.). The ADMIN_TOKEN value gave me trouble - to make it work, I used the 'Using argon2' instructions from Enabling admin page in the docs. At your-ip-or-url.com/admin, the password you used for the hash will unlock it (e.g. MySecretPassword per their example).

Note: The ADMIN_TOKEN value should be enclosed in single quotes. If it is not, all instances of $ in the value will need to be replaced with $$ to prevent the value from being split by the parser.

# vaultwarden.env

# Public domain or IP
DOMAIN=

ADMIN_TOKEN=

# Optional SMTP email settings
SMTP_HOST=
SMTP_FROM=
SMTP_PORT=587
SMTP_SECURITY=starttls
SMTP_USERNAME=
SMTP_PASSWORD=