selfhostit apps are small apps you run on your own hardware: a Raspberry Pi, a NAS or a cheap server. Each one is a single container with its data in one folder, and they all install the same way, with Docker.
| App | What it does | Port |
|---|---|---|
| Splitwiz | Split shared costs with your partner or roommate | 8090 |
| should-we | Pick one option together, as a group | 8091 |
| Flowy | A private period and cycle tracker | 8092 |
| Troye | A private calorie and weight tracker | 8093 |
| Shoppa | A shared shopping list for your household | 8094 |
| Calio | One calendar for your household: plans, pet sitting and trips | 8095 |
The port is where the installer puts each app, so they can all run on one machine. If another program already has it, the app gets the next free port, and keeps that one.
On a Raspberry Pi, a Linux server or a NAS you can reach over SSH:
curl -fsSL https://github.com/selfhostit/docs/releases/latest/download/install.sh | shIt installs Docker if it is missing (on Linux), asks which apps you want and where to keep them, and starts them. Run it again to update; your settings and data are kept.
It can also set up Tailscale, so your phones reach the apps over HTTPS, which they need to install an app and get notifications. You only open a link to sign in; there are no keys or settings to copy. Then put the apps on your phones.
Prefer to read and check a script before you run it? Download it, verify it, read it, then run it:
curl -fsSLO https://github.com/selfhostit/docs/releases/latest/download/install.sh
gh attestation verify install.sh --repo selfhostit/docs
less install.sh
sh install.shThe installer is a signed release, and it installs a pinned release of each app, checking every file it downloads against its SHA-256.
Security and privacy says step by step what it does, what the apps protect and what you are trusting.
The apps keep their data on your machine, in one folder each, with no selfhostit cloud and no
analytics. They listen on 127.0.0.1 only and are reached through Tailscale or your own
reverse proxy, never a forwarded port. Containers run as a normal user with no Linux
capabilities and a read-only filesystem, a new install asks for a one-time setup code,
passwords are stored as bcrypt hashes, sign-ins are rate limited and the web apps send a
Content Security Policy. Every change, and every week, is scanned with CodeQL, govulncheck,
Grype and gitleaks. Updates follow versioned releases, each image has a signed attestation
of the commit that built it, and the installer pins each app's release with SHA-256 checks.
Not done yet: an independent audit.
Details, with links to the code: Security and privacy. Report a problem
privately through the app's Security tab on GitHub or to kalfasyan@pm.me
(policy).
- Raspberry Pi and Linux: a Pi, a mini PC, an old laptop or a VPS.
- Synology NAS: with Container Manager, from the DSM web interface.
- Other NAS and home servers: QNAP, Unraid, TrueNAS SCALE, Portainer, CasaOS and anything else that takes a Compose file.
- Use them on your phones: Tailscale, or a reverse proxy with your own domain.
- Updates and backups
- Security and privacy: how your data is protected, and how to report a problem.
Anything that runs Docker containers for linux/amd64, linux/arm64 or linux/arm/v7:
x86 and ARM servers, a Raspberry Pi 3 or newer (64-bit Raspberry Pi OS is best), and NAS
models with a Docker app. Each app needs about 128 to 512 MB of memory. NAS models without
Docker support (many budget and older ones) won't work.
Need a hand with setup, or have an idea for an app? Write to kalfasyan@pm.me, or see selfhostit.org/contact. Found a bug in an app? Open an issue in that app's repository.