I run git on a machine I can touch. That is not because public forges are immoral. It is because a git clone that still works after the account page returns 404 is a different object from a bookmark to someone else’s uptime.
Self-hosting has a reputation problem. It is sold as a lifestyle and practised as a second job. The useful version is narrower: host the one or two remotes whose loss would take away your ability to continue, and leave the weather forecast alone.
Basics · Self-hosting means the service runs on computers you can reach without the vendor's account page
A laptop with files is local. A virtual machine in a rented datacentre can still be self-hosted if you hold the disk image, the DNS, and a tested rebuild. The vendor of the rack is a dependency. The vendor of the application account is a different, usually tighter, dependency. This essay is about loosening the second one.
Start with a remote you can clone
Git is the kindest first service. The protocol is old, the data is files, and a second copy is a command:
git clone --mirror git@git.example.org:you/project.git
git -C project.git fsck --fullForgejo (or GitLab CE, or cgit) on a small VPS or a box under the desk is enough. What you must own is not the UI. It is:
- the object store (
./data/ bare repos), - the name (
git.example.org) at a registrar you have logged into this year, - a backup that has been restored onto a machine that is not the original.
If the restore needs the original TLS certificate and the original ACME account key and the original disk, you have built a shrine.
DNS is part of the service
A box without a name is a hobby. A name without transferable DNS is a leash. Look up the registrar, the nameservers, and whether the account recovers through the mailbox you are trying to protect.
dig +short NS git.example.org
dig +short SOA git.example.orgKeep a second copy of the zone, even a text file of records, off the host. When Let’s Encrypt fails because HTTP-01 cannot reach a box you are rebuilding, DNS-01 with a token stored elsewhere is the difference between an afternoon and a week.
Email is the trap
People self-host mail because identity depends on it, then discover they have volunteered to fight deliverability, blocklists, and a moving target of “best practice.” I do not recommend starting there.
If mail is the hinge of your other accounts, the practical move is often: a mailbox at a provider you can leave via IMAP, plus a second mailbox at a different provider on a different registrar, plus recovery codes on paper. Hosting Postfix because it feels sovereign, without monitoring, backups, and a practised restore, is how mail disappears on a Saturday.
Power, disk, and the boring week
A home server that is also the only restic repository is one object. Put the repository on another machine, preferably off-site. Put the password somewhere that is not /root/.config on the same disk.
Energy is not a lifestyle add-on here. An unclean shutdown after a brown-out is a restore you did not schedule. A small UPS talking to NUT, plus restic check on a timer, is more sovereignty than another container.
restic snapshots
restic check --read-data-subset=5%Updates are part of the path. An unpatched Forgejo on the public internet is not a critical-path win. Schedule them. Read the release notes. Have a snapshot you can roll back.
Expert · Rebuild from cold storage, or you do not host it
A rebuild drill that counts:
- New disk or new VPS. No copies from the running host except the backup.
- Restore the git data (or the whole VM image) with the documented command.
- Restore DNS if the address changed.
- Obtain a new certificate without the old host’s
/etc/letsencrypt. git clonefrom a third machine that has never seen the original SSH host key — and expect to verify the new key.
If step 4 needs a file you only left on the dead box, ACME is on the critical path. If step 5 is skipped because “I’ll just disable key checking,” you have trained yourself to accept impersonation.
Pin OS images. Record versions. Treat docker compose pull as a change you can revert, not as hygiene that happens in the dark.
What I do not host
Search engines, maps, most chat, and anything whose operators are better at staying up than I am at staying interested. The test is not ideological. The test is: if this vanishes on Tuesday, can I continue the work on Wednesday with a clone and a documented restore?
If the honest answer is no, either host it properly or admit it is a dependency and keep an exit. Pretending a container on a forgotten Pi is an institution is how self-hosting earns its reputation.
