Week of July 16 2026 Self‑Hosted Megathread: Community Verdicts, Real‑World Set‑ups & Step‑by‑Step Guides

The Community Spark #

Every Monday, r/selfhosted rolls out a “Project Megathread” that aggregates the week’s hottest self‑hosting experiments. The Week of 16 Jul 2026 blew up because three overlapping trends converged:

1. A surge in Hetzner Cloud “bare‑metal” offers – users were scrambling to compare pricing, performance, and automation tooling.
2. Docker‑Compose vs. Podman‑Compose debates – the community asked which orchestrator survived the recent docker daemon deprecation on Alpine 3.19.
3. Zero‑trust networking with Tailscale 2.0 – many posted “I can finally expose my Home Assistant without a reverse proxy”.

The result? Over 2 500 comments, dozens of screenshots, and a clear split between “Ansible‑first” and “Shell‑script‑first” camps. Below we synthesize those lived experiences into a single, actionable reference.

Synthesized Community Perspectives #

The community’s lived experience shows a pattern: start with a reproducible Ansible playbook, spin up Podman containers, and lock everything behind Tailscale. The following guide stitches these pieces together.

Deep‑Dive Actionable Guide #

1️⃣ Provision a Hetzner CX31 Server via the API #

# Install hcloud CLI (requires Go)
curl -sSL https://github.com/hetznercloud/cli/releases/download/v1.41.0/hcloud-linux-amd64.tar.gz | tar -xz
sudo mv hcloud /usr/local/bin/

# Authenticate (replace with your API token)
export HCLOUD_TOKEN="your‑hetzner‑api‑token"

# Create server – Ubuntu 24.04 LTS, 4 vCPU, 8 GB RAM
hcloud server create \
  --name selfhosted‑week16 \
  --type cx31 \
  --image ubuntu-24.04 \
  --ssh-key my‑ssh‑key \
  --user-data "@cloud‑init.yml"

cloud-init.yml (excerpt) installs Docker, Podman, and Tailscale automatically.

#cloud-config
package_update: true
packages:
  - podman
  - podman-docker
  - tailscale
runcmd:
  - systemctl enable --now tailscaled
  - tailscale up --authkey=${TAILSCALE_AUTHKEY}

2️⃣ Deploy the “Media Stack” with Podman‑Compose #

Create docker-compose.yml (compatible with Podman) in ~/media-stack/:

version: "3.9"
services:
  plex:
    image: ghcr.io/linuxserver/plex:latest
    restart: unless-stopped
    network_mode: bridge
    environment:
      - TZ=Europe/Paris
      - PUID=1000
      - PGID=1000
    volumes:
      - ./plex/config:/config
      - ./media:/data
  jellyfin:
    image: jellyfin/jellyfin:latest
    restart: unless-stopped
    network_mode: bridge
    ports:
      - "8096:8096"
    volumes:
      - ./jellyfin/config:/config
      - ./media:/data

Run it:

cd ~/media-stack
podman-compose up -d

3️⃣ Automate the Whole Setup with Ansible #

Create site.yml:

- hosts: selfhosted
  become: true
  vars:
    tailscale_key: "{{ lookup('env','TAILSCALE_AUTHKEY') }}"
  tasks:
    - name: Install required packages
      apt:
        name: [podman, podman-docker, tailscale]
        state: present
        update_cache: yes

    - name: Enable and start Tailscale
      systemd:
        name: tailscaled
        enabled: true
        state: started

    - name: Authenticate Tailscale
      command: tailscale up --authkey {{ tailscale_key }} --ssh

    - name: Deploy media stack
      community.docker.podman_compose:
        project_src: /home/ubuntu/media-stack
        state: present

Run from your laptop:

ansible-playbook -i selfhosted, site.yml -e TAILSCALE_AUTHKEY=tskey-xxxx

Result: A fully reproducible VPS with a zero‑trust tunnel, ready‑to‑play Plex/Jellyfin, and an idempotent state you can version‑control.

Pros & Cons Comparative Table #

The Verdict / Expert Advice #

• Beginner (single home server) → Use Docker‑Compose with a simple docker-compose.yml and Tailscale “auth key”. The ecosystem is forgiving, and you can migrate to Podman later.
• Power User / Multi‑node → Adopt Hetzner + Ansible + Podman‑Compose. The idempotent playbooks keep your infra reproducible, and Podman’s rootless model scales securely.
• Privacy‑First → Combine Vultr bare metal + Bash + OpenVPN; you keep everything in‑house, albeit at a higher cost.

Frequently Asked Questions (FAQ) #

Q1: Can I replace Ansible with a pure Bash script without losing repeatability?
A: You can, but Bash lacks built‑in idempotency checks. You’ll need to manually guard each step (e.g., if ! command -v podman >/dev/null; then apt install -y podman; fi). Ansible’s changed_when and creates parameters make this painless.

Q2: Does Podman‑Compose support all Docker‑Compose files?
A: It supports version 3.x syntax used by most community projects. Edge‑case features (e.g., build: with context arguments) may need minor tweaks or a fallback to podman build.

Q3: How secure is Tailscale compared to a self‑hosted WireGuard VPN?
A: Tailscale builds on WireGuard and adds an ACL‑driven control plane. For most users, it’s as secure as a manually configured WireGuard tunnel, but if you cannot trust any third‑party, run your own tailscale exit node or switch to an on‑prem WireGuard server.

Q4: What’s the cheapest way to run a persistent self‑hosted Git server?
A: Deploy Gitea via Podman on a Hetzner CX11 (≈ €3/mo). The community shares a ready‑made Ansible role that provisions SQLite‑backed Gitea in under five minutes.