Post by @pluvialgeist
My reading seems to suggest that I have a serious obstacle to self-hosting on my own hardware:
CGNAT
I really do live in Bumblefuck—I love it here—and Starlink is my only option for a high-speed ISP. I hate that, but I need a high-speed connection for work and I don't want to move. Not many other options for work out here, so for now: Starlink.
It looks like I can maybe get around some CGNAT issues with a VPN that includes port forwarding…but now I'm wondering if maybe I should just consider self-hosting from a VPS instead.
Anyone else on the Fedi have any experience with self-hosting with Starlink as an ISP? What's that been like for you? Have any tips or suggestions?
@pluvialgeist
Stepping Up to Self-Hosting
I got into Android at the beginning, with a pre-order of the T-Mobile G1, because I never liked the proprietary-everything ecosystem Apple built with the iPhone. I was geniunely excited about the potential of an open-source mobile OS, even if it was coming from a billionaire-owned tech giant. I rooted my Android phones and flashed custom ROMs to them for years. It was a blast. Then Google and Samsung started closing out that scene, and I lost the excitement that had drawn me in at the beginning. That sense of potential evaporated.
Years later, I found myself drawn back to open-source stuffs when I stumbled into the Fediverse. I love the sense of possiblity that pervades the Fediverse and FOSS projects in general. I've been hopping around for a few years now, trying different instaces running different software, and it's this Fedi project—littleFedi—that made me feel like now is the time for me to try my hand at hosting my own stuff. I know the code isn't ready for me yet, but that's okay because I need time to research self-hosting options. I'm hoping the Fedi can help with some of that.
I'm not a programmer or a techie—perhaps call me an advanced user. From my reading, I feel confident that I could manage self-hosting from a VPS. Honestly, though, I'd prefer my own hardware at home. The problem is that there are a lot of options, and I'm feeling a bit overwhelmed. I thought I'd share what I want from my hardware, at minimum, and see if some helpful Fedizens have suggestions. So here's what I want:
- A Nextcloud instance for file storage. I have hundreds of gigabytes of music, videos, and photos, and I want a place to store all of that in the cloud.
- A chat client. Maybe Nextcloud Talk, but I'm also thinking about a Matrix server. Just haven't read much about self-hosting Matrix yet.
- A Fediverse client. I had been thinking of WordPress with the ActivityPub plugin because I like having the option to write long blog posts as well as short status posts; however, I'm now thinking that I'll run a littleFedi instance once the code is published.
Email. Because if I'm going to be hosting my own cloud storage, chat, and social media, I might as well take care of my own email as well.EDIT 2026-08-12: After both @schmic@hessen.social and @deach@hachyderm.io left helpful comments in reply to this post, and then reading more about self-hosting email, I've decided against this one.
I have limited physical space in my cabin out here in Bumblefuck, so I've been looking at mini PCs. I see that Nextcloud even sells some with Nextcloud preconfigured, but I'm not sure any of those are for me. I prefer Linux, but I'm comfortable with installing Linux on a machine that ships with Windows. (Done that with several of my old laptops.) I'll consider a Mac mini if y'all recommend one, but it's been a decade-plus since I've messed around with macOS.
EDIT 2026-08-12: I'll need 2 TB of storage space, minimum, to start. I'd like a machine that I can easily upgrade with an additional SSD when the time comes for more storage.
I won't be making a quick decision here, so as long as this blog is still published without an update, I'm still looking for options and I would still appreciate tips, suggestions, and stories about your own self-hosting adventures.
Be good to yourself, and be good to others 🫶
@michal@kottman.xyz
@rebootdeluxe@infosec.exchange
@pluvialgeist I have no experience with StarLink, but I do have plenty of experience self-hosting behind CGNAT via a tiny VPS.
In this glorious age of crawlers DDoSing the entire internet, I wouldn't host at home even if I could: the bots would eat my bandwidth. With a VPS fronting, the VPS can eat most of the bot traffic, and I only see a tiny fraction it at home. So when a large wave comes, even if my VPS dies, my homelab, my LAN keeps going just fine, like nothing happened.
I have a €4/month VPS, it runs Caddy, iocaine, coturn, postfix, and that's about it. iocaine takes care of the bots, Caddy does the reverse proxying web-stuff into the homelab, coturn makes it possible to self-host Prosody with audio & video calls at home, ignoring CGNAT, and postfix delivers mail to storage within the homelab - it only runs on the VPS to be able to check reverse DNS and stuff like that.
With this setup, I can basically firewall stuff off before it eats into my home bandwidth, and nothing in my homelab is directly exposed to the wider internet.
@algernon @pluvialgeist @homelab We ( @phlash & I ) fix the NAT problem with an L2TP tunnel from Andrews and Arnold. Home connection can then be any ISP we like.
This gives us a static IP in A&A's address block and makes email hosting actually workable from home.
We run fail2ban on all our public endpoints and block instantly we see any failed connection attempts.
Our web site is static and served from a cheap CDN we rent to keep the load off our home networks.
HTH and good luck! 😁
@pluvialgeist I have a small VPS from Racknerd for about US$10/yr and use iptables on it to forward traffic to a "server" at home which connects to the VPS via Wireguard. Lately I have been allowing the home server do the fail2ban'ing, but that task could be moved to the VPS if needed.
@pluvialgeist Before anything else, one question decides the whole approach: do you actually need the public to reach these services, or do you just need to get to your own stuff from outside?
Everything downstream (VPS, tunnels, port forwarding, whether CGNAT even matters) branches off that answer. Worth nailing it down before you build anything.
@Snuggle2476@mas.to I want to self-host a Fedi client and Matrix, though I'll keep membership to myself on the one and just my family on the other. Still, both need to federate with the outside world, so yes, I want the public to reach [some of] my services…right? Or am I not understanding some fundamental way these things work?
@pluvialgeist You've got it right, nothing fundamental missing. Federation is inbound by design: other servers push to yours, so the public has to reach both. Private membership limits who gets accounts, not whether federated traffic arrives.
Cleanest CGNAT fix: a cheap VPS as your front door, WireGuard back to your home box, VPS proxies inbound. Your hardware still does the hosting.
I run Matrix from home, but on port-forwarding, not CGNAT, so the VPS bit is architecture, not lived experience.
(he/him)
I use this setup:
https://codeberg.org/quiteBold/self-hosting/src/branch/main/exposing_internal-services.md
A mini VPS as relay for the homelab outbound VPN.
And yes #FCKELN
@pluvialgeist @homelab I found Wireguard (vpn protocol) to be rather insensitive towards CGNAT. Build a tunnel to a small VM you host with a static IP.
@masek @pluvialgeist @homelab yep, did it the same way. small vps at a hoster and let my fritzbox handle the wireguard connection. Works like a charm.
@piratehonk @masek @pluvialgeist @homelab Do you have a pointer to the tooling you use? Is it just forwarding from the static IP (VPS) to DynDNS (Fritz!box)?
@dertho @masek @pluvialgeist @homelab I would have to check later, but it is the other way around. the Fritzbox connects to wireguard on the vps, that way you can ignore CGNAT. It doesn't work the other way around.
(he/him)
@piratehonk @dertho @masek @pluvialgeist @homelab
Or you connect from your local reverse proxy via WG to your VPS.
See my documentation here:
https://codeberg.org/quiteBold/self-hosting
@pluvialgeist @homelab is IPv6-only an option? That would make things less complicated if your users/other sources alsonuse ipv6
It looks like you're given a /56 with each connection:
https://starlink.com/en-qa/support/article/1192f3ef-2a17-31d9-261a-a59d215629f4
I have ipv6 at home, so if you want me to test anything from here, DM me :)