35 Self-Hosted Apps That Actually Replace Your

The self-hosting pitch usually goes like this: trade convenience for control, sacrifice polish for privacy, accept that you're now your own sysadmin. The Github Awesome channel just dropped 35 projects that complicate that narrative—tools that match their commercial competitors in functionality while keeping your data exactly where you want it.

I'm interested in this from a security perspective, not an ideological one. When you self-host, your threat model shifts. You're no longer trusting a company's security practices—you're betting on your own. That's either better or worse depending on what you're defending against and how realistic you are about your capabilities.

The Infrastructure Layer

Several projects tackle the foundational security problems that make self-hosting feel risky. VaulTLS acts as a centralized certificate authority for your home network—Rust backend, Vue.js frontend, automated cert generation and distribution. As the video describes it: "Modern dashboard for generating and distributing TLS and SSH certificates. OIDC authentication, restful API for automation, automated email notifications before certs expire."

This matters because certificate management is where home labs typically fail. Self-signed certs everywhere, browsers throwing warnings, no systematic renewal. VaulTLS professionalizes what's usually chaos.

Newt handles another common failure point: exposing services without opening firewall ports. It's a WireGuard tunnel client that reaches out from behind your firewall to a central server, negotiating encrypted tunnels over WebSockets. Your services stay unexposed. The attack surface stays small.

NetAlertX sits between basic network scanners and enterprise tools, continuously mapping your LAN via ARP, DHCP, and SNMP. Unknown device joins your network? You know immediately. This is baseline visibility that most home networks lack entirely.

The Privacy Calculation

SelfSync lets you run your own Chrome sync server—browser history, bookmarks, passwords stored in your SQLite database instead of Google's. The implementation uses Chromium's native end-to-end encryption, meaning even your own server can't read your passwords at rest.

Here's where threat modeling gets interesting. If you're worried about Google's data collection, this solves it. If you're worried about state-level attackers or your own server security, maybe not. The encryption is strong, but you're now responsible for backup integrity, server hardening, and patch management. Most people are worse at this than Google's security team. Some people have threat models where that's still the right trade-off.

Hister takes the same approach to search history—a browser extension that indexes every page you visit into a local database. "A background browser extension performs automatic full text indexing of the actual rendered content of every website you visit," the video explains. Full-text search of your entire browsing history without sending that data anywhere.

The privacy win is obvious. The security risk is also obvious: if someone compromises your machine, they now have a searchable database of everywhere you've been online. Whether that's better than trusting a search company depends entirely on your specific circumstances.

The Practical Tools That Actually Work

PaperMerge tackles document management with automatic OCR and searchable overlays. Point your scanner at it, and PDFs become searchable without you touching them. For anyone managing sensitive documents—legal files, medical records, financial statements—keeping this local means those documents never touch a cloud service's servers. The OCR happens on your hardware. The search index lives in your database.

Tandoor Recipes strips recipe websites down to ingredients and instructions, no blog posts about someone's childhood memories. One-click serving size scaling and auto-generated grocery lists organized by supermarket aisle. This is the type of tool that makes self-hosting feel practical rather than performative—it solves a real problem better than the commercial alternatives.

BookLore manages ebook libraries with automatic metadata fetching and a built-in reader that syncs progress across devices. The multi-user support and granular sharing permissions mean a family can share a library without sharing accounts or compromising individual privacy.

The AI Shift

Several projects reflect how AI is changing what self-hosting means. Octopoda-OS gives AI agents persistent memory, semantic search, and crash recovery in two lines of Python. As described in the video: "Memory survives restarts and deployments. Agents communicate with each other through shared inboxes."

Squarebox goes further—it's an MCP server that lets AI assistants like Claude interact with your local file system and run terminal commands with "zero latency. Your agent gets the hands it needs to be a real developer assistant. Your data stays strictly on your machine."

This is the emerging frontier: AI that's useful enough to access your files but controlled enough that you're comfortable giving it that access. Self-hosting becomes the answer to "do I trust this AI company with my codebase?"

Familiar searches music libraries by semantic meaning rather than metadata. Type "melancholy with piano" and it queries the audio itself using CLAP embeddings. Every track gets processed locally. The search happens locally. No streaming service learns your listening patterns.

The Complexity Trap

Most of these projects deploy via Docker, which solves dependency hell but introduces its own attack surface. You're running containers, which is better isolation than running everything bare metal, but you're also trusting base images and managing a container runtime.

Modelship tries to address part of this problem by packaging multiple AI models into a single unified inference server—one OpenAI-compatible API for your entire local AI stack. The video describes it as solving "juggling five Docker containers, weird port configs, and constant resource fights."

But reduction in complexity isn't the same as reduction in risk. You still need to understand what you're running, keep it patched, and have a realistic backup strategy. The Github Awesome channel doesn't talk about any of this, which is fine—it's a showcase, not a security guide. But anyone actually deploying these tools needs to think about it.

What Self-Hosting Actually Costs

Time is the hidden cost. BudgetBee gives you complete financial data ownership in a single Docker container, but you're now responsible for that data's security and availability. Maintainerr automates Plex library maintenance so unwatched media doesn't eat your hard drive, but you need to configure the rules and monitor the results.

The trade-off isn't control versus convenience. It's responsibility versus outsourcing. Sometimes taking on that responsibility makes sense—when you have specific privacy requirements, when you're managing sensitive data, when commercial tools don't fit your workflow, or when you just want to learn by building your own infrastructure.

Other times it doesn't. If you can't commit to keeping systems patched and monitoring for issues, commercial services with professional security teams are probably safer. If your threat model includes sophisticated attackers, your home server might not be the fortress you think it is.

These 35 projects show that self-hosted tools can match commercial alternatives in features and polish. Whether they're better for you specifically depends on what you're optimizing for and what you're actually capable of maintaining. The software has gotten good enough that convenience is no longer the deciding factor. Now you just need to be honest about the rest.

Rachel "Rach" Kovacs is Buzzrag's cybersecurity and privacy correspondent.