Week of Julyâ¯16â¯2026 SelfâHosted Megathread: Community Verdicts, RealâWorld Setâups & StepâbyâStep Guides

The Community Spark #

Every Monday, r/selfhosted rolls out a âProject Megathreadâ that aggregates the weekâs hottest selfâhosting experiments. The Week of 16â¯Julâ¯2026 blew up because three overlapping trends converged:

1. A surge in Hetzner Cloud âbareâmetalâ offers â users were scrambling to compare pricing, performance, and automation tooling.
2. DockerâCompose vs. PodmanâCompose debates â the community asked which orchestrator survived the recent docker daemon deprecation on Alpine 3.19.
3. Zeroâtrust networking with Tailscale 2.0 â many posted âI can finally expose my Home Assistant without a reverse proxyâ. The result? Over 2â¯500 comments, dozens of screenshots, and a clear split between âAnsibleâfirstâ and âShellâscriptâfirstâ camps. Below we synthesize those lived experiences into a single, actionable reference.

Synthesized Community Perspectives #

DeepâDive Actionable Guide #

1ï¸â£ Provision a Hetzner CX31 Server via the API #

# Install hcloud CLI (requires Go)
curl -sSL https://github.com/hetznercloud/cli/releases/download/v1.41.0/hcloud-linux-amd64.tar.gz | tar -xz
sudo mv hcloud /usr/local/bin/
# Authenticate (replace with your API token)
export HCLOUD_TOKEN="yourâhetznerâapiâtoken"
# Create server â Ubuntu 24.04 LTS, 4â¯vCPU, 8â¯GB RAM
hcloud server create \
  --name selfhostedâweek16 \
  --type cx31 \
  --image ubuntu-24.04 \
  --ssh-key myâsshâkey \
  --user-data "@cloudâinit.yml"

cloud-init.yml (excerpt) installs Docker, Podman, and Tailscale automatically.

#cloud-config
package_update: true
packages:
  - podman
  - podman-docker
  - tailscale
runcmd:
  - systemctl enable --now tailscaled
  - tailscale up --authkey=${TAILSCALE_AUTHKEY}

2ï¸â£ Deploy the âMedia Stackâ with PodmanâCompose #

Create docker-compose.yml (compatible with Podman) in ~/media-stack/:

version: "3.9"
services:
  plex:
    image: ghcr.io/linuxserver/plex:latest
    restart: unless-stopped
    network_mode: bridge
    environment:
      - TZ=Europe/Paris
      - PUID=1000
      - PGID=1000
    volumes:
      - ./plex/config:/config
      - ./media:/data
  jellyfin:
    image: jellyfin/jellyfin:latest
    restart: unless-stopped
    network_mode: bridge
    ports:
      - "8096:8096"
    volumes:
      - ./jellyfin/config:/config
      - ./media:/data

Run it:

cd ~/media-stack
podman-compose up -d

3ï¸â£ Automate the Whole Setup with Ansible #

Create site.yml:

- hosts: selfhosted
  become: true
  vars:
    tailscale_key: "{{ lookup('env','TAILSCALE_AUTHKEY') }}"
  tasks:
    - name: Install required packages
      apt:
        name: [podman, podman-docker, tailscale]
        state: present
        update_cache: yes
    - name: Enable and start Tailscale
      systemd:
        name: tailscaled
        enabled: true
        state: started
    - name: Authenticate Tailscale
      command: tailscale up --authkey {{ tailscale_key }} --ssh
    - name: Deploy media stack
      community.docker.podman_compose:
        project_src: /home/ubuntu/media-stack
        state: present

Run from your laptop:

ansible-playbook -i selfhosted, site.yml -e TAILSCALE_AUTHKEY=tskey-xxxx

Result: A fully reproducible VPS with a zeroâtrust tunnel, readyâtoâplay Plex/Jellyfin, and an idempotent state you can versionâcontrol.

Pros & Cons Comparative Table #

The Verdict / Expert Advice #

• Beginner (single home server) â Use DockerâCompose with a simple docker-compose.yml and Tailscale âauth keyâ. The ecosystem is forgiving, and you can migrate to Podman later.
• Power User / Multiânode â Adopt Hetzner + Ansible + PodmanâCompose. The idempotent playbooks keep your infra reproducible, and Podmanâs rootless model scales securely.
• PrivacyâFirst â Combine Vultr bare metal + Bash + OpenVPN; you keep everything inâhouse, albeit at a higher cost.

Frequently Asked Questions (FAQ) #

Q1: Can I replace Ansible with a pure Bash script without losing repeatability?
A: You can, but Bash lacks builtâin idempotency checks. Youâll need to manually guard each step (e.g., if ! command -v podman >/dev/null; then apt install -y podman; fi). Ansibleâs changed_when and creates parameters make this painless. Q2: Does PodmanâCompose support all DockerâCompose files?
A: It supports versionâ¯3.x syntax used by most community projects. Edgeâcase features (e.g., build: with context arguments) may need minor tweaks or a fallback to podman build. Q3: How secure is Tailscale compared to a selfâhosted WireGuard VPN?
A: Tailscale builds on WireGuard and adds an ACLâdriven control plane. For most users, itâs as secure as a manually configured WireGuard tunnel, but if you cannot trust any thirdâparty, run your own tailscale exit node or switch to an onâprem WireGuard server. Q4: Whatâs the cheapest way to run a persistent selfâhosted Git server?
A: Deploy Gitea via Podman on a Hetzner CX11 (ââ¯â¬3/mo). The community shares a readyâmade Ansible role that provisions SQLiteâbacked Gitea in under five minutes.