Most self-hosting guides start at Jellyfin, which is the wrong first move. A media server on a machine with no DNS, no monitoring, no reverse proxy, and no backup plan is a house without plumbing. It will run for a week and then a router restart, a certificate expiry, or a disk fault will teach you why the foundational layer matters.
We reviewed nine services people typically stack under their media server, tested each on a mixed Linux and Windows setup, and narrowed it to seven that pay for themselves the first week. The list assumes you already know why you want to self-host and just want a sane order to install things.
What to look for in a self-hosted foundation
- Reversibility. Every service on this list can be uninstalled cleanly. Nothing here overwrites system config in ways you can’t undo.
- A single reboot survives it. If a service can’t come back up on its own after
reboot, it’s not foundational. - Container-friendly. Everything runs in Docker or Podman with a documented compose file. If your foundation is bare-metal-only, migrating to a new host is a rewrite.
- Independent. No service on this list requires another one to work. You can stop at three and still have a real setup.
- Reasonable defaults. A five-hour first-run setup means you’ll never touch it again. All picks below get you working within an hour.
- Actively maintained. Every project below shipped a release in the last ninety days at the time of writing.
Quick comparison
| App | Best for | Platforms | Free plan | Starting price/mo | Rating |
|---|---|---|---|---|---|
| Pi-hole | Network-wide DNS and ad blocking | Linux, Docker, Raspberry Pi | Yes, all features | $0 (donation) | 4.8 / 5 (GitHub 51k stars) |
| Uptime Kuma | Watching every other service | Linux, Docker, Windows | Yes, all features | $0 | 4.9 / 5 (GitHub 63k stars) |
| Nginx Proxy Manager | Reverse proxy with Let’s Encrypt | Linux, Docker | Yes, all features | $0 | 4.7 / 5 (GitHub 24k stars) |
| Tailscale | Zero-config VPN mesh | Linux, Windows, macOS | Yes, up to 100 devices | $6/user (Personal Pro) | 4.9 / 5 |
| Home Assistant | Smart-home orchestration | Linux, macOS, Windows, HAOS | Yes, all features | $0 | 4.8 / 5 |
| Portainer | Docker/Podman/K8s management UI | Linux, Docker, Windows | Yes, Community Edition | $0 CE, $79/mo BE | 4.6 / 5 |
| Restic | Encrypted, deduplicated backups | Linux, macOS, Windows | Yes, all features | $0 | 4.8 / 5 (GitHub 27k stars) |
The apps
1. Pi-hole, network DNS and ad blocking
Pi-hole is the first thing to install. It’s a network-wide DNS server that blocks ads and trackers at the resolver layer, which means every device on your network benefits with no per-device setup. It also gives you a working recursive DNS you’ll rely on for every other service on this list.
The install is one command. Point your router’s DHCP DNS at the Pi-hole IP and every phone, TV, and laptop starts benefiting immediately. The dashboard shows real-time query stats, so you learn what’s actually chattering on your network on day one.
Where it falls short: The Pi-hole web UI is dated (v6 is better, but still shows its age). If your ISP router doesn’t let you override DHCP DNS, you have to set DNS per-device.
Pricing:
- Free: Yes, all features
- Paid: None (donation only)
Platforms: Linux native, Raspberry Pi (the classic), Docker on anything
Download: Pi-hole official site · Pi-hole on GitHub
Bottom line: Install this first. Every other service on this list benefits from having a working local DNS, and the ad-blocking payoff hits every device you own.
2. Uptime Kuma, know when things break
Uptime Kuma watches every service you self-host and pings you when one goes down. Set up a Pi-hole check, a Nginx Proxy Manager check, a Jellyfin check, a router check. First time your Jellyfin container OOMs and dies at 3 AM, you’ll get a Discord ping instead of finding out by trying to play Bluey for a toddler on Saturday morning.
It supports HTTP, TCP, DNS, ping, Docker container, and dozens of other check types. Notifications go to Discord, Slack, Telegram, Gotify, Signal, ntfy, and about thirty others.
Where it falls short: The status page feature is fine but not as polished as a hosted service like Better Uptime. If your network drops entirely, Uptime Kuma can’t tell you (nothing running on that same network can).
Pricing:
- Free: Yes, all features
- Paid: None
Platforms: Docker, Linux native, Windows binary
Download: Uptime Kuma on GitHub
Bottom line: Install this second. It costs nothing and saves you the “how long has this been broken” question every self-hoster eventually asks.
3. Nginx Proxy Manager, reverse proxy the easy way
Nginx Proxy Manager is the reason “https://jellyfin.myhouse.com” works instead of “http://192.168.1.42:8096”. It’s a web UI on top of nginx that handles reverse-proxy config, Let’s Encrypt certificates, and access-control per domain, and it gets you HTTPS on your local services without hand-editing nginx conf files.
Two clicks per new service. It auto-renews certs, redirects HTTP to HTTPS, and lets you point subdomains at Docker containers by name. Wildcard certs with DNS challenge work out of the box for common providers.
Where it falls short: Debugging when a cert issuance fails involves reading nginx logs (there’s no in-UI diagnosis). Not as feature-dense as pure Traefik if you’re a power user.
Pricing:
- Free: Yes, all features
- Paid: None
Platforms: Docker (the sane choice), Linux
Download: Nginx Proxy Manager on GitHub
Bottom line: Install this third, right after your DNS and monitoring. Every service you add after this one gets a real hostname and a real cert automatically.
4. Tailscale, remote access without port forwarding
Tailscale is a mesh VPN built on WireGuard that gives every device you own a stable IP on a private network. That’s the whole pitch. Install the client, log in with Google or GitHub, and your phone, laptop, and home server are all on the same private LAN no matter where they physically are.
The killer feature for self-hosters is that you never open a port on your home router. No dynamic DNS, no port-forwarding, no exposing Jellyfin to the internet. Your phone hits http://jellyfin.tailnet-name.ts.net:8096 and it just works.
Where it falls short: Free tier caps at 100 devices, three users. Deep networking use (subnet routing, exit nodes) requires reading docs. If Tailscale as a company disappears, the coordination server (Headscale) is open-source but you’ll spend an afternoon migrating.
Pricing:
- Free: Yes, up to 100 devices, three users
- Paid: Personal Pro at around $6/user/mo, Business at around $18/user/mo
Platforms: Linux, Windows, macOS, iOS, Android
Download: Tailscale official site · Tailscale on GitHub
Bottom line: Install this fourth. It replaces every “how do I access this from outside” problem you’ll otherwise spend weekends on.
5. Home Assistant, if you have any smart devices
Home Assistant is the local-first smart-home hub. If you have a smart plug, a Zigbee sensor, or an Amazon Echo, Home Assistant lets you control it without sending data to a manufacturer’s cloud. It also becomes the automation layer for everything else: “turn on the office light at sunset,” “notify me when the door opens after midnight,” “turn off the TV when the last person leaves.”
The install is a Docker container or the appliance OS (HAOS) if you want a dedicated Raspberry Pi. Add-ons handle Zigbee, Z-Wave, Matter, and Thread bridges. Once it’s running it becomes the single control plane for your home.
Where it falls short: The learning curve is real. First-time users spend a full evening on the YAML for their first automation. The UI is much better than it was two years ago but still not what you’d call intuitive.
Pricing:
- Free: Yes, all features
- Paid: Nabu Casa cloud subscription at around $6.50/mo (adds remote access and Google/Alexa integration, both otherwise self-hostable)
Platforms: HAOS on Raspberry Pi, Docker, Linux, Windows via WSL
Download: Home Assistant official site · Home Assistant on GitHub
Bottom line: Install this fifth, and only if you actually have smart devices to control. Skip it otherwise.
6. Portainer, Docker without the CLI
Portainer is the web UI for Docker (and Podman, and Kubernetes if you’re feeling ambitious). It doesn’t replace the CLI so much as make routine work faster. You see running containers, their resource use, their logs, and their compose files without opening a terminal.
For anyone new to Docker, Portainer is the training wheels that make it possible to run containers without memorizing every flag. For veterans, it’s a dashboard for “is anything red right now.”
Where it falls short: Community Edition (which is free) has been trimmed of features over the years to nudge you toward Business Edition. Some views are BE-only. It’s still worth it for the free tier.
Pricing:
- Free: Community Edition, all core features
- Paid: Business Edition at around $79/mo (three nodes)
Platforms: Docker (native), Kubernetes, Podman
Download: Portainer official site · Portainer on GitHub
Bottom line: Install this sixth if you’re new to Docker; skip if you’re already comfortable with docker-compose and don’t need a UI.
7. Restic, backups you'll actually run
Restic is a command-line backup tool that gets the boring parts right: encrypted at rest, deduplicated, versioned, and it can push to almost any storage backend (local disk, SFTP, S3, Backblaze B2, Wasabi, Google Cloud Storage). One command to back up, one command to restore, and the repository format is stable and open.
Set a cron job for restic backup /docker and restic backup /home nightly, mirror the repo to B2 for offsite ($6/TB/mo), and your entire self-hosted setup is recoverable. That’s cheaper than a Synology backup license and more flexible than any GUI tool.
Where it falls short: No GUI (Backrest or Autorestic on top help). First-run learning curve is real. Deep prune operations can be slow on large repos.
Pricing:
- Free: Yes, all features
- Paid: None (Backblaze B2 storage costs around $6/TB/mo separately)
Platforms: Linux, macOS, Windows, FreeBSD
Download: Restic official site · Restic on GitHub
Bottom line: Install this seventh, and set up the cron job the same day. Every self-hoster who skipped this step has a story about losing a home directory.
How to pick the right one
If you want the simplest option: install Pi-hole on a $50 Raspberry Pi and stop there. That alone changes your home network.
If you need remote access: Tailscale, before you install anything else outward-facing.
If you’re on a budget: everything here is free. The only real cost is a $6/TB/mo B2 subscription for offsite backups.
If you’re a power user: skip Portainer, replace Nginx Proxy Manager with Traefik, and script your Restic runs with Autorestic. Everything else stays.
If you tried to install Jellyfin first and hit “why isn’t this working from my phone”: you skipped Nginx Proxy Manager and Tailscale. Install both before you try again.
FAQ
What is the best free self-hosted foundation stack?
Pi-hole, Uptime Kuma, Nginx Proxy Manager, Tailscale, and Restic. All five are free forever and cover DNS, monitoring, reverse proxy, remote access, and backups. Add Portainer if you want a Docker UI, Home Assistant if you have smart devices.
Do I need all seven?
Only three: Pi-hole (or another local DNS), Nginx Proxy Manager (or Traefik), and Restic. The other four are strongly recommended but not strictly required for a working setup.
What self-hosted app should I install first?
Pi-hole. It benefits every device on your network on day one and gives you a working DNS layer for everything that follows.
Is Tailscale really necessary?
If you never leave your home network, no. If you want your phone to hit your Jellyfin server from a cafe or your parents’ house, yes, and it’s easier than every alternative.
Can I skip the reverse proxy?
You can, until the first time you want to access a service by hostname instead of IP:port, or you want HTTPS. Both happen faster than new self-hosters expect.
What's the cheapest way to back up a self-hosted setup?
Restic pushing to Backblaze B2 at around $6/TB/mo, with a local mirror on an external USB drive for fast restores. That’s under $20/mo for most home setups.
