My Self-Hosting Stack in 2026

People assume a personal server is either a Raspberry Pi running a single hobby app or a full homelab rack. Mine is neither: one small VPS, one platform, a handful of services that each had to argue their way in.

The rules

Three rules decided most of the architecture:

1. Everything behind the edge. Applications bind to loopback ports only. The edge terminates TLS and owns routing. Nothing else is reachable, and the firewall enforces it even if a container config drifts.
2. Images pinned by digest, not tag. latest is not a version. Every service in the stack references an exact digest that was audited before it was allowed to run.
3. Every deployment leaves a receipt. What changed, what was checked, what broke. Future-me is the most important user of these notes.

The residents

• OpenShip — the platform itself: panel, edge, TLS, backups. It deploys the rest, which makes its own upgrades the most carefully staged events on the box.
• A private AI chat — a self-hosted LLM frontend, telemetry deliberately amputated, registration closed after the first account.
• Vaultwarden — passwords. The service whose acceptance criteria were the strictest, for obvious reasons.
• Bark bridge — a tiny transform shim so an iPhone can receive push notifications about the health of everything above.
• This blog — the newest and simplest resident. Static files in, HTTPS out.

What I keep saying no to

A mail server (the operational cost is a second job), "just one more" dashboard, and anything whose logs I wouldn't actually read. Every service on the box has a failure story I understand. That's the bar.