12 Best Self-Hosted Apps 2026 to Replace SaaS

By LK Wood IV · Published 2026-05-01 · Updated 2026-07-12 · 15 min read · St. Louis County, MO

Here is the entire argument on one screen. On the left, the recurring bills you can stop paying. On the right, the open-source app that does the same job — for the one-time cost of a little RAM instead of a monthly charge.

TL;DR — The 12 picks, voted

The shortlist for the best self hosted apps 2026 is small on purpose. Twelve services that have outgrown their SaaS originals, not fifty half-finished forks. Pi-hole gets demoted for AdGuard Home. Plex gets cut. Mail-in-a-Box does not make the list — self-hosted email in 2026 is still a bad idea for almost everyone. Everything below runs in Docker, every snippet uses a pinned image tag, and the top five get full copy-paste compose files.

The scannable table — 12 apps, what they replace, what they need

That’s the list. Below: what got cut, then deeper dives and copy-paste compose files for the top five.

What got cut and why

• Plex — not a SaaS replacement; it is the SaaS. Jellyfin replaces Plex.
• Pi-hole — voted out for AdGuard Home. The DNS-over-HTTPS upstream and per-client rules in AdGuard’s UI are meaningfully better, and the Docker deploy is identical in difficulty. Pi-hole still works fine if you already run it.
• Seafile — solid block-sync, but Nextcloud AIO has closed the gap and the ecosystem (calendar, contacts, office) is broader.
• Plausible CE / Umami / Mealie / FreshRSS / Linkding — all good, all on the bench. They didn’t beat the 12 above on either daily use or obvious SaaS replacement. If a self-hosted bookmark manager is specifically what you’re after, Linkding is fine but the two strongest options get their own head-to-head in Karakeep vs Linkwarden. If what you actually want is somewhere to read saved articles rather than file links — the job Pocket used to do before Mozilla shut it down — that is a different category, covered in self-hosted read-it-later apps.
• Mail-in-a-Box / Mailcow — explicitly cut. Self-hosted outbound email in 2026 still gets your IP scored as suspicious by Microsoft and Google more often than not, and inbound MX is fine until your dynamic IP changes or your ISP blocks port 25. Use a paid relay (Fastmail, Migadu, Proton) and move on. The long-running r/selfhosted email threads say the same thing in nicer language.
• Matrix / Mattermost / Rocket.Chat — a self-hosted chat server is its own category, not a general SaaS swap, so it sits outside this list. There is also no drop-in clone of Discord’s text-plus-voice bundle in 2026, and the voice/video story is the part most roundups skip. If replacing a Discord community or a team chat is what you actually want, the self-hosted Discord alternatives comparison breaks down which tool fits and the honest voice/video reality.

A difficulty score of 1 is “single container, defaults work, ten-minute deploy.” A 5 is “you’ll read documentation for a weekend and read it again at the next major upgrade.” Most of the 12 land at 1–3 — the apps that survive in homelabs are the ones where the 80% case is boring.

Where to actually start

Twelve services is a to-do list that stalls before it starts. It shouldn’t. The stack has a natural order — you do not stand up Immich and Home Assistant on day one. You stand up the ten-minute wins first, get the dopamine hit of a working service, then climb. This is the sequence I hand anyone who asks.

The top 5 — full setups

1. Immich — the Google Photos replacement that finally works

Immich is the reason a lot of people built their first homelab in 2025. The mobile app uploads from iOS and Android in the background, the ML stack identifies faces and objects locally, and the timeline UI beats Google Photos for most operations. The catch is RAM — the ML container alone wants ~2 GB at idle, and library import will pin a couple of cores for hours on a fresh install.

The official path is the Immich docker-compose template plus the bundled .env file. Pin the version explicitly — release is a moving tag and breaking schema changes have happened mid-year before. Per the Immich releases page the current stable is v3.0.3 (the v1.x line older guides pin is long superseded — Immich moved fast in 2026); pin the latest tagged release on install day. One upstream change worth knowing: Immich now ships Valkey, the Redis-compatible fork, in place of Redis — the compose below reflects that.

Critical detail: Immich is not a backup. The database can corrupt. Use Immich’s official backup guide and keep originals on a separate disk from the Immich Postgres.

# docker-compose.yml — Immich, pinned
# Source: https://github.com/immich-app/immich/releases (pin to latest tag on install)
name: immich

services:
  immich-server:
    image: ghcr.io/immich-app/immich-server:v3.0.3
    extends:
      file: hwaccel.transcoding.yml
      service: quicksync # change to 'cpu' if no Intel iGPU
    volumes:
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
      - /etc/localtime:/etc/localtime:ro
    env_file: .env
    ports:
      - 2283:2283
    depends_on:
      - redis
      - database
    restart: always

  immich-machine-learning:
    image: ghcr.io/immich-app/immich-machine-learning:v3.0.3
    volumes:
      - model-cache:/cache
    env_file: .env
    restart: always

  redis:
    # Immich ships Valkey (a drop-in Redis fork) upstream as of the 2026 releases
    image: docker.io/valkey/valkey:9@sha256:4963247afc4cd33c7d3b2d2816b9f7f8eeebab148d29056c2ca4d7cbc966f2d9
    restart: always

  database:
    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
      POSTGRES_INITDB_ARGS: '--data-checksums'
    volumes:
      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
    restart: always

volumes:
  model-cache:

2. Nextcloud AIO — file sync, calendar, contacts, in one container

The official Nextcloud All-in-One project ships everything — Apache, PHP, the database, Redis, the office stack, Talk, the backup container — managed by a single mastercontainer that you talk to over a web UI on port 8080. It is the right answer for new self-hosters and for experienced ones who got tired of debugging PHP-FPM at 1 a.m.

# One-liner from the official AIO README
sudo docker run \
  --init \
  --sig-proxy=false \
  --name nextcloud-aio-mastercontainer \
  --restart always \
  --publish 80:80 \
  --publish 8080:8080 \
  --publish 8443:8443 \
  --volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
  --volume /var/run/docker.sock:/var/run/docker.sock:ro \
  ghcr.io/nextcloud-releases/all-in-one:latest

The latest tag here is the AIO mastercontainer, which the project explicitly maintains as the supported entry point — the actual Nextcloud server image underneath gets pinned by AIO to a tested release. That’s the one place I make an exception to the “no :latest” rule. If you want full version control, watch the Nextcloud AIO releases page and use a digest pin instead.

AIO turns on file sync, CalDAV, CardDAV, and Collabora office editing by default. The performance ceiling on a budget mini PC with 16 GB of RAM is around 4–5 active users on a 2.5 GbE network. Beyond that, tune Redis cache before blaming the box.

For the complete setup — NPM reverse proxy config, Office activation, CalDAV/CardDAV client setup, and AIO backup — see the Nextcloud AIO Docker setup guide.

3. Vaultwarden — Bitwarden, on a potato

Vaultwarden is a Rust reimplementation of the Bitwarden server API by dani-garcia. The current stable line is 1.36.x as of early 2026, per the Vaultwarden releases. It is fully compatible with the official Bitwarden mobile, browser, and desktop clients, which is the whole point — your phone doesn’t know it’s not talking to Bitwarden’s cloud. For the server-choice decision behind that — the official Bitwarden server’s eleven-container stack versus this single container, and exactly which features you trade away — see Vaultwarden vs Bitwarden.

# docker-compose.yml — Vaultwarden, version-pinned
services:
  vaultwarden:
    image: vaultwarden/server:1.36.0-alpine
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      DOMAIN: "https://vault.example.lan"
      SIGNUPS_ALLOWED: "false"      # flip to true for first user, then back
      ADMIN_TOKEN: "${ADMIN_TOKEN}" # generate with: openssl rand -base64 48
      WEBSOCKET_ENABLED: "true"
    volumes:
      - ./vw-data:/data
    ports:
      - 8222:80

Two things people miss. Vaultwarden needs a real TLS cert for mobile clients — put it behind Caddy or Traefik with Let’s Encrypt, or use Tailscale Funnel for a zero-config TLS path. And back up ./vw-data somewhere off the host — a vault you can’t restore is a vault you don’t have. The Vaultwarden on Proxmox setup guide covers Caddy reverse proxy, the Tailscale-only setup path, and an automated SQLite backup script with online backup API support.

4. Jellyfin — Plex without the company

Jellyfin is the mature fork of Emby. It does what Plex does — library scanning, transcoding, mobile and TV apps — without phoning home, without watching your viewing history, and without a “Pass” subscription gating hardware acceleration.

# docker-compose.yml — Jellyfin with Intel Quick Sync transcoding
services:
  jellyfin:
    image: lscr.io/linuxserver/jellyfin:10.11.11
    container_name: jellyfin
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/Chicago
      - JELLYFIN_PublishedServerUrl=http://192.168.1.50:8096
    devices:
      - /dev/dri:/dev/dri   # Intel iGPU passthrough for QSV
    volumes:
      - ./config:/config
      - /srv/media:/data/media:ro
    ports:
      - 8096:8096
    restart: unless-stopped

Intel Quick Sync is what makes Jellyfin viable on a budget mini PC. N100 and 12th-gen-or-newer iGPUs handle 4K HEVC decode without breaking a sweat. AMD GPUs on Linux remain weaker for transcode in 2026 — if your homelab is AMD-only, plan for direct-play clients (NVIDIA Shield, Apple TV, a recent smart TV). The Jellyfin team keeps a clear hardware acceleration matrix; read it before you buy a box.

5. Home Assistant OS — local-first smart home

Home Assistant is on this list because it replaces Apple Home, Google Home, and SmartThings simultaneously, and because the cloud-dependency stories from those vendors keep getting worse. It is not on this list because it is easy. It is rated 4/5 on difficulty for a reason: deep automation requires real time investment.

The recommended path in 2026 is still Home Assistant OS running as a VM, not the Docker container. Per the official installation docs, the container variant loses the Supervisor and the add-on ecosystem, and the add-on ecosystem (Mosquitto, Zigbee2MQTT, ESPHome, the official Z-Wave stack) is most of what makes HA worth running.

For a Proxmox host, the tteck Proxmox Helper Scripts (now community-maintained at community-scripts/ProxmoxVE) install HA OS as a VM in about three minutes. That’s the path. Allocate 2 GB RAM, 2 vCPUs, 32 GB disk, and pass through a USB Zigbee/Z-Wave coordinator if you have one. See the Proxmox vs TrueNAS vs Unraid comparison for which hypervisor fits your situation.

The Home Assistant 2026.3 release notes confirmed the move to zstd-compressed container images, which broke a few older Synology installs but is fine on any modern Docker. Read release notes before every monthly upgrade. HA breaks integrations a few times a year — upgrades are not background tasks.

The other 7 — short notes

AdGuard Home (replaces Pi-hole, NextDNS, your router’s bad ad blocker)

Pin adguard/adguardhome:v0.107.x. Run it on the same box as Uptime Kuma. Point your router’s DHCP DNS at the AdGuard container IP and every device on your network — phones, smart TVs, the IoT garbage — gets DNS-level filtering with zero per-device setup. The DoH/DoT upstream config is in the UI; switch it to Quad9 or Cloudflare 1.1.1.1 and you’ve also leaked less DNS to your ISP than you did last week.

The AdGuard Home + Local DNS on Proxmox tutorial covers the LXC setup from scratch: port 53 in an unprivileged container, OISD and Steven Black blocklists, local A records for pve.lan / nas.lan, and an optional Unbound recursive resolver that cuts upstream providers out entirely.

Tailscale (replaces Tailscale, ZeroTier, paid commercial VPN)

Yes, Tailscale is technically a SaaS for the coordinator. The free personal tier (6 users and unlimited user devices) is enough for almost every homelab, and the WireGuard data plane runs entirely peer-to-peer once peers are connected. The right way to read this is: Tailscale replaces commercial OpenVPN/WireGuard services and ZeroTier, both of which are also SaaS. If you are choosing between those last two, see ZeroTier vs Tailscale. If you genuinely refuse the coordinator, Headscale is the open-source alternative — but plan for a difficulty score of 4, not 1. And if the real question is how to reach these services from outside your LAN at all, Tailscale vs Cloudflare Tunnel covers the private-network-versus-public-tunnel split and the current free-tier limits, which have moved past the numbers above.

AudioBookshelf (replaces Audible)

If you already own audiobooks (legitimately, ideally), AudioBookshelf gives you per-user progress sync, mobile apps, and podcast support. Single container, no companion services, about 100 MB idle RAM — the lightest useful self-hosted app on this list. The iOS and Android apps are official and free. Podcast RSS auto-download is built in. Pin ghcr.io/advplyr/audiobookshelf:latest. Full setup with library directory structure, mobile app config, metadata matching, and Tailscale remote access is in the AudioBookshelf Docker guide.

n8n (replaces Zapier, Make, IFTTT)

400+ integrations, a real queue mode for production workloads, and the ability to drop into JavaScript when the visual builder won’t do what you need. Pin to a specific tag — n8n’s latest has shipped breaking workflow changes inside a single major release before. The n8n Docker image page maintains tags per release; pick the current stable on install day.

For the full setup — PostgreSQL backend, Nginx Proxy Manager HTTPS, queue mode with Redis, and backup strategy — see the n8n self-hosted Docker guide.

BookStack (replaces Notion as a wiki / docs site)

For pure note-taking, Obsidian beats every self-hosted option. For a team or family wiki — recipes, runbooks, “how the network is set up” — BookStack is the right answer. Outline is also good but the hosting story is harder. The stack is two containers (BookStack + MySQL) with about 180 MB idle RAM — the lightest wiki option on this list. Pin lscr.io/linuxserver/bookstack:latest and configure LDAP if you’re already running Authentik or Keycloak for unified auth. Full setup with MySQL, NPM HTTPS, LDAP, and backup is in the BookStack Docker guide.

Uptime Kuma (replaces UptimeRobot, Better Stack)

Already covered in the self-hosting essentials guide. It belongs here because once you have 12 services running, you need to know which one died at 2 a.m. before your family tells you the internet is “broken.” Pin louislam/uptime-kuma:1.23.x.

Paperless-ngx (replaces Evernote scan, Dropbox Scan, paper)

Drop a PDF in the consume folder, OCR runs, the document is tagged, you can full-text-search five years of mail in seconds. Pin ghcr.io/paperless-ngx/paperless-ngx:2 and run PostgreSQL next to it — not SQLite, which write-locks under concurrent requests. Add Tika and Gotenberg containers alongside; without them, Word and Excel files ingest silently with no searchable text. The full compose stack with correspondent auto-tagging, subdirectory tag mapping, and NPM HTTPS is in the Paperless-ngx setup guide.

What hardware actually runs all 12

Rough memory budget: ~24 GB RAM if you run everything simultaneously with realistic headroom. CPU is less of a problem than people think — Immich’s ML is the spike, and the rest idle hard.

The Proxmox vs TrueNAS vs Unraid comparison covers the OS choice. For hardware, Best Mini PCs for a Homelab in 2026 lands on a 32 GB Ryzen 5825U or Intel 12th-gen-or-newer box, NVMe boot, separate disk for media. If you’re starting from a single mini PC and have never set up Proxmox, the Proxmox mini PC setup walkthrough is the next read. If you have an old gaming PC sitting in a closet, the repurpose-as-server guide skips the hardware purchase entirely. For the complete Docker Compose stack — NPM + Portainer + Uptime Kuma + Watchtower + Gitea with working compose files and a shared proxy network — the Docker Compose starter stack tutorial has everything wired together.

Does it actually save money?

The Self-Hosting Break-Even Calculator answers this for your specific situation — add your subscriptions, set your hardware budget, and see exactly when self-hosting pays for itself. Spoiler: replacing $30–50/month in SaaS with a $170 mini PC usually breaks even in under 6 months.

Pick the box that runs the stack

The 12-app stack needs a real host. The TechFuelHQ PC Builder checks socket / RAM / PSU / GPU clearance compatibility for the AM4, AM5, and Intel platforms that pair well with Docker stacks. For mini-PC turnkey picks, the mini-PC homelab guide covers Minisforum MS-01 (10GbE for storage-heavy stacks) and the cheap used-OptiPlex path. If your stack outgrows a single 2.5GbE link, the 10GbE homelab networking guide covers the cheap switch options.

Sources and methodology

App recommendations synthesize maintainer documentation, deployment guides, and the maintained Docker image tags as of 2026-06-10. RAM and CPU footprint figures are taken from each project’s published documentation.

Primary sources cited:

• Immich docs — official Immich documentation
• Nextcloud AIO docs — official Nextcloud All-In-One reference
• Vaultwarden wiki — official documentation
• Jellyfin docs — official Jellyfin reference
• AdGuard Home — project documentation
• Tailscale docs — official documentation and free-tier limits
• Home Assistant docs — official OS installation guide
• r/selfhosted community — community deployment reports

Email corrections to hello@techfuelhq.com.