Self-Hosted Apps Worth Running in 2026: The 12 That Actually Replace SaaS

Q: How do I back up these self-hosted services?

Treat the data volumes as the backup target, not the containers themselves. A weekly restic or borg job to a second disk plus an offsite copy — a small VPS, an encrypted Backblaze B2 bucket, or a friend's homelab over Tailscale — covers the realistic failure modes for a home setup.

Q: Is Tailscale really self-hosted?

Strictly no, the coordinator is SaaS. Practically, the data plane (the actual VPN traffic) is peer-to-peer WireGuard and never touches Tailscale's servers. If you need a fully self-hosted control plane, run Headscale. For most readers, Tailscale's free tier of 100 devices and 3 users is the right call.

By LK Wood IV · 2026-05-01 · 14 min read

TL;DR — The 12 picks, voted

The shortlist for the best self hosted apps 2026 is small on purpose. Twelve services that have outgrown their SaaS originals, not fifty half-finished forks. Pi-hole gets demoted for AdGuard Home. Plex gets cut. Mail-in-a-Box does not make the list — self-hosted email in 2026 is still a bad idea for almost everyone. Everything below runs in Docker, every snippet uses a pinned image tag, and the top five get full copy-paste compose files.

Affiliate disclosure. Some links here are affiliate links. If you click and buy, TechFuel HQ may earn a small commission at no extra cost to you. It does not change what gets recommended.

The scannable table — 12 apps, what they replace, what they need

#	App	Replaces	Difficulty (1–5)	Hardware floor	Killer feature	Verdict
1	Immich	Google Photos / iCloud Photos	3	6 GB RAM, 2 cores, Docker	ML face + object search that genuinely beats Google’s UI	Ship it. The 2026 release cadence finally slowed and breaking changes are rare.
2	Nextcloud AIO	Google Drive / Dropbox / Workspace	3	4 GB RAM, 2 cores	One container manages the whole stack including backups	Use AIO. Skip the manual compose.
3	Vaultwarden	Bitwarden cloud / 1Password	1	256 MB RAM	Bitwarden-compatible, runs on a potato, end-to-end encrypted	Easiest win on the list.
4	Paperless-ngx	Evernote / Dropbox Scan / paper	3	2 GB RAM, OCR is CPU-hungry	Tika + OCR + tagging makes paper actually searchable	Replace your filing cabinet.
5	Jellyfin	Plex / Netflix / Disney+	2	4 GB RAM, Intel iGPU for transcode	No subscriptions, no phoning home, hardware transcoding works	Still the Plex-killer. AMD GPUs remain weak for transcode.
6	AdGuard Home	Pi-hole / NextDNS	1	256 MB RAM	DNS-over-HTTPS upstream + per-client rules in a clean UI	Picked over Pi-hole for the better UI.
7	Tailscale (or Headscale)	Tailscale itself, ZeroTier, paid VPN	1 (Tailscale) / 4 (Headscale)	Negligible	WireGuard mesh that punches NAT and “just works”	Tailscale free tier is enough for most. Headscale only if you want zero vendor.
8	Home Assistant OS	Apple Home / Google Home / SmartThings	4	2 GB RAM, 32 GB disk, x86-64	Local control, no cloud dependency, every protocol	Run it as a VM, not a container.
9	AudioBookshelf	Audible / Libby	2	1 GB RAM	Tracks progress per-user across devices, podcast support included	Drop-in for an Audible library you already own.
10	n8n	Zapier / Make / IFTTT	3	1 GB RAM	400+ integrations, queue mode for real workloads	Beats Zapier for anything serious. Tax: you maintain it.
11	BookStack	Notion / Confluence (read-mostly)	2	1 GB RAM	Books → Chapters → Pages structure that doesn’t fight you	Picked over Outline for simpler hosting.
12	Uptime Kuma	UptimeRobot / Better Stack	1	256 MB RAM	Self-hostable status page for friends and family	The first thing every homelab should add after DNS.

That’s the list. Below: what got cut, then deeper dives and copy-paste compose files for the top five.

What got cut and why

Plex — not a SaaS replacement; it is the SaaS. Jellyfin replaces Plex.
Pi-hole — voted out for AdGuard Home. The DNS-over-HTTPS upstream and per-client rules in AdGuard’s UI are meaningfully better, and the Docker deploy is identical in difficulty. Pi-hole still works fine if you already run it.
Seafile — solid block-sync, but Nextcloud AIO has closed the gap and the ecosystem (calendar, contacts, office) is broader.
Plausible CE / Umami / Mealie / FreshRSS / Linkding — all good, all on the bench. They didn’t beat the 12 above on either daily use or obvious SaaS replacement.
Mail-in-a-Box / Mailcow — explicitly cut. Self-hosted outbound email in 2026 still gets your IP scored as suspicious by Microsoft and Google more often than not, and inbound MX is fine until your dynamic IP changes or your ISP blocks port 25. Use a paid relay (Fastmail, Migadu, Proton) and move on. The long-running r/selfhosted email threads say the same thing in nicer language.

A difficulty score of 1 is “single container, defaults work, ten-minute deploy.” A 5 is “you’ll read documentation for a weekend and read it again at the next major upgrade.” Most of the 12 land at 1–3 — the apps that survive in homelabs are the ones where the 80% case is boring.

The top 5 — full setups

1. Immich — the Google Photos replacement that finally works

Immich is the reason a lot of people built their first homelab in 2025. The mobile app uploads from iOS and Android in the background, the ML stack identifies faces and objects locally, and the timeline UI beats Google Photos for most operations. The catch is RAM — the ML container alone wants ~2 GB at idle, and library import will pin a couple of cores for hours on a fresh install.

The official path is the Immich docker-compose template plus the bundled .env file. Pin the version explicitly — release is a moving tag and breaking schema changes have happened mid-year before. Per the Immich changelog the current stable is v1.140.x; pin the latest tagged release on install day.

Critical detail: Immich is not a backup. The database can corrupt. Use Immich’s official backup guide and keep originals on a separate disk from the Immich Postgres.

# docker-compose.yml — Immich, pinned
# Source: https://github.com/immich-app/immich/releases (pin to latest tag on install)
name: immich

services:
  immich-server:
    image: ghcr.io/immich-app/immich-server:v1.140.1
    extends:
      file: hwaccel.transcoding.yml
      service: quicksync # change to 'cpu' if no Intel iGPU
    volumes:
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
      - /etc/localtime:/etc/localtime:ro
    env_file: .env
    ports:
      - 2283:2283
    depends_on:
      - redis
      - database
    restart: always

  immich-machine-learning:
    image: ghcr.io/immich-app/immich-machine-learning:v1.140.1
    volumes:
      - model-cache:/cache
    env_file: .env
    restart: always

  redis:
    image: docker.io/redis:6.2-alpine@sha256:e3b17ba9479deec4b7d1eeec1548a253acc5374d68d3b27559a75d2b873b7d3a
    restart: always

  database:
    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
      POSTGRES_INITDB_ARGS: '--data-checksums'
    volumes:
      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
    restart: always

volumes:
  model-cache:

2. Nextcloud AIO — file sync, calendar, contacts, in one container

The official Nextcloud All-in-One project ships everything — Apache, PHP, the database, Redis, the office stack, Talk, the backup container — managed by a single mastercontainer that you talk to over a web UI on port 8080. It is the right answer for new self-hosters and for experienced ones who got tired of debugging PHP-FPM at 1 a.m.

# One-liner from the official AIO README
sudo docker run \
  --init \
  --sig-proxy=false \
  --name nextcloud-aio-mastercontainer \
  --restart always \
  --publish 80:80 \
  --publish 8080:8080 \
  --publish 8443:8443 \
  --volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
  --volume /var/run/docker.sock:/var/run/docker.sock:ro \
  ghcr.io/nextcloud-releases/all-in-one:latest

The latest tag here is the AIO mastercontainer, which the project explicitly maintains as the supported entry point — the actual Nextcloud server image underneath gets pinned by AIO to a tested release. That’s the one place I make an exception to the “no :latest” rule. If you want full version control, watch the Nextcloud AIO releases page and use a digest pin instead.

AIO turns on file sync, CalDAV, CardDAV, and Collabora office editing by default. The performance ceiling on a budget mini PC with 16 GB of RAM is around 4–5 active users on a 2.5 GbE network. Beyond that, tune Redis cache before blaming the box.

3. Vaultwarden — Bitwarden, on a potato

Vaultwarden is a Rust reimplementation of the Bitwarden server API by dani-garcia. The current stable line is 1.35.x as of early 2026, per the Vaultwarden releases. It is fully compatible with the official Bitwarden mobile, browser, and desktop clients, which is the whole point — your phone doesn’t know it’s not talking to Bitwarden’s cloud.

# docker-compose.yml — Vaultwarden, version-pinned
services:
  vaultwarden:
    image: vaultwarden/server:1.35.4-alpine
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      DOMAIN: "https://vault.example.lan"
      SIGNUPS_ALLOWED: "false"      # flip to true for first user, then back
      ADMIN_TOKEN: "${ADMIN_TOKEN}" # generate with: openssl rand -base64 48
      WEBSOCKET_ENABLED: "true"
    volumes:
      - ./vw-data:/data
    ports:
      - 8222:80

Two things people miss. Vaultwarden needs a real TLS cert for mobile clients — put it behind Caddy or Traefik with Let’s Encrypt, or use Tailscale Funnel for a zero-config TLS path. And back up ./vw-data somewhere off the host — a vault you can’t restore is a vault you don’t have.

4. Jellyfin — Plex without the company

Jellyfin is the mature fork of Emby. It does what Plex does — library scanning, transcoding, mobile and TV apps — without phoning home, without watching your viewing history, and without a “Pass” subscription gating hardware acceleration.

# docker-compose.yml — Jellyfin with Intel Quick Sync transcoding
services:
  jellyfin:
    image: lscr.io/linuxserver/jellyfin:10.10.7
    container_name: jellyfin
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/Chicago
      - JELLYFIN_PublishedServerUrl=http://192.168.1.50:8096
    devices:
      - /dev/dri:/dev/dri   # Intel iGPU passthrough for QSV
    volumes:
      - ./config:/config
      - /srv/media:/data/media:ro
    ports:
      - 8096:8096
    restart: unless-stopped

Intel Quick Sync is what makes Jellyfin viable on a budget mini PC. N100 and 12th-gen-or-newer iGPUs handle 4K HEVC decode without breaking a sweat. AMD GPUs on Linux remain weaker for transcode in 2026 — if your homelab is AMD-only, plan for direct-play clients (NVIDIA Shield, Apple TV, a recent smart TV). The Jellyfin team keeps a clear hardware acceleration matrix; read it before you buy a box.

5. Home Assistant OS — local-first smart home

Home Assistant is on this list because it replaces Apple Home, Google Home, and SmartThings simultaneously, and because the cloud-dependency stories from those vendors keep getting worse. It is not on this list because it is easy. It is rated 4/5 on difficulty for a reason: deep automation requires real time investment.

The recommended path in 2026 is still Home Assistant OS running as a VM, not the Docker container. Per the official installation docs, the container variant loses the Supervisor and the add-on ecosystem, and the add-on ecosystem (Mosquitto, Zigbee2MQTT, ESPHome, the official Z-Wave stack) is most of what makes HA worth running.

For a Proxmox host, the tteck Proxmox Helper Scripts (now community-maintained at community-scripts/ProxmoxVE) install HA OS as a VM in about three minutes. That’s the path. Allocate 2 GB RAM, 2 vCPUs, 32 GB disk, and pass through a USB Zigbee/Z-Wave coordinator if you have one. See the Proxmox vs TrueNAS vs Unraid comparison for which hypervisor fits your situation.

The Home Assistant 2026.3 release notes confirmed the move to zstd-compressed container images, which broke a few older Synology installs but is fine on any modern Docker. Read release notes before every monthly upgrade. HA breaks integrations a few times a year — upgrades are not background tasks.

The other 7 — short notes

AdGuard Home (replaces Pi-hole, NextDNS, your router’s bad ad blocker)

Pin adguard/adguardhome:v0.107.x. Run it on the same box as Uptime Kuma. Point your router’s DHCP DNS at the AdGuard container IP and every device on your network — phones, smart TVs, the IoT garbage — gets DNS-level filtering with zero per-device setup. The DoH/DoT upstream config is in the UI; switch it to Quad9 or Cloudflare 1.1.1.1 and you’ve also leaked less DNS to your ISP than you did last week.

Tailscale (replaces Tailscale, ZeroTier, paid commercial VPN)

Yes, Tailscale is technically a SaaS for the coordinator. The free personal tier (100 devices, 3 users) is enough for almost every homelab, and the WireGuard data plane runs entirely peer-to-peer once peers are connected. The right way to read this is: Tailscale replaces commercial OpenVPN/WireGuard services and ZeroTier, both of which are also SaaS. If you genuinely refuse the coordinator, Headscale is the open-source alternative — but plan for a difficulty score of 4, not 1.

AudioBookshelf (replaces Audible)

If you already own audiobooks (legitimately, ideally), AudioBookshelf gives you per-user progress sync, mobile apps, and podcast support. Pin ghcr.io/advplyr/audiobookshelf:2.x — the project version-pins cleanly. Resource use is minimal; it’ll run alongside Jellyfin on the same box without arguing.

n8n (replaces Zapier, Make, IFTTT)

400+ integrations, a real queue mode for production workloads, and the ability to drop into JavaScript when the visual builder won’t do what you need. Pin to a specific tag — n8n’s latest has shipped breaking workflow changes inside a single major release before. The n8n Docker image page maintains tags per release; pick the current stable on install day.

BookStack (replaces Notion as a wiki / docs site)

For pure note-taking, Obsidian beats every self-hosted option. For a team or family wiki — recipes, runbooks, “how the network is set up” — BookStack is the right answer. Outline is also good but the hosting story is harder. Pin lscr.io/linuxserver/bookstack:25.x.

Uptime Kuma (replaces UptimeRobot, Better Stack)

Already covered in the self-hosting essentials guide. It belongs here because once you have 12 services running, you need to know which one died at 2 a.m. before your family tells you the internet is “broken.” Pin louislam/uptime-kuma:1.23.x.

Paperless-ngx (replaces Evernote scan, Dropbox Scan, paper)

Drop a PDF in the consume folder, OCR runs, the document is tagged, you can full-text-search five years of mail in seconds. Per the official Paperless-ngx Docker docs, pin ghcr.io/paperless-ngx/paperless-ngx:2.x and run Postgres next to it (not SQLite — you will outgrow SQLite). Tika and Gotenberg containers are optional but strongly recommended for handling Word and Excel attachments.

What hardware actually runs all 12

Rough memory budget: ~24 GB RAM if you run everything simultaneously with realistic headroom. CPU is less of a problem than people think — Immich’s ML is the spike, and the rest idle hard.

The Proxmox vs TrueNAS vs Unraid comparison covers the OS choice. For hardware, Best Mini PCs for a Homelab in 2026 lands on a 32 GB Ryzen 5825U or Intel 12th-gen-or-newer box, NVMe boot, separate disk for media. If you’re starting from a single mini PC and have never set up Proxmox, the Proxmox mini PC setup walkthrough is the next read.

FAQ

What are the best self hosted apps in 2026?

The 12 covered above: Immich, Nextcloud AIO, Vaultwarden, Paperless-ngx, Jellyfin, AdGuard Home, Tailscale, Home Assistant OS, AudioBookshelf, n8n, BookStack, and Uptime Kuma. They were picked for daily-use value, mature documentation, and a clear SaaS counterpart they actually replace — not for being interesting.

Can a single mini PC run all twelve?

Yes, with a real budget. A 32 GB Ryzen 5825U or Intel 12th-gen mini PC with a 1 TB NVMe runs the full stack with headroom for a couple of VMs. The bottleneck is almost always RAM — Immich’s ML container plus Nextcloud’s PHP plus Home Assistant in a VM eats 12–14 GB before users touch anything.

Is Jellyfin really better than Plex in 2026?

For most homelab setups, yes. No subscription, no remote-access gatekeeping, hardware transcoding works on Intel Quick Sync without paywalls, and the apps on Apple TV, Android TV, and Roku have all reached parity with Plex’s basic features. Plex still wins on “your relatives can install one app and find your library.”

Should I self-host email?

No, almost certainly not. Outbound deliverability to Gmail and Microsoft 365 is consistently bad from residential IPs in 2026, and inbound on a dynamic IP breaks at the worst times. Use a paid relay (Fastmail, Migadu, Proton) and self-host everything else. Mailcow and Mail-in-a-Box work, but the operational tax is real.

How do I back up these self-hosted services?

Treat the data volumes (./immich-data, ./vw-data, ./nextcloud-data, etc.) as the backup target, not the containers. A weekly restic or borg job to a second disk plus an offsite copy (a small VPS, an encrypted Backblaze B2 bucket, or a friend’s homelab over Tailscale) covers the realistic failure modes.

Is Tailscale really self-hosted?

Strictly, no — the coordinator is SaaS. Practically, the data plane (the actual VPN traffic) is peer-to-peer WireGuard and never touches Tailscale’s servers. If you need a fully self-hosted control plane, run Headscale. For most readers, Tailscale’s free tier is the right call.

Sources

Immich docker-compose template — https://docs.immich.app/install/docker-compose
Immich releases — https://github.com/immich-app/immich/releases
Immich backup and restore — https://docs.immich.app/administration/backup-and-restore
Nextcloud All-in-One — https://github.com/nextcloud/all-in-one
Nextcloud AIO releases — https://github.com/nextcloud/all-in-one/releases
Vaultwarden releases — https://github.com/dani-garcia/vaultwarden/releases
Tailscale Funnel — https://tailscale.com/kb/1223/funnel
Jellyfin hardware acceleration — https://jellyfin.org/docs/general/post-install/transcoding/hardware-acceleration/
LinuxServer Jellyfin tags — https://hub.docker.com/r/linuxserver/jellyfin/tags
Home Assistant installation — https://www.home-assistant.io/installation/
Home Assistant 2026.3 release notes — https://www.home-assistant.io/blog/2026/03/04/release-20263/
Community-maintained Proxmox helper scripts — https://github.com/community-scripts/ProxmoxVE
AdGuard Home image — https://hub.docker.com/r/adguard/adguardhome
AdGuard Home releases — https://github.com/AdguardTeam/AdGuardHome/releases
Headscale — https://github.com/juanfont/headscale
n8n Docker image — https://hub.docker.com/r/n8nio/n8n
Paperless-ngx setup docs — https://docs.paperless-ngx.com/setup/
Nextcloud system requirements — https://docs.nextcloud.com/server/latest/admin_manual/installation/system_requirements.html

How this article was produced. This piece was drafted with AI assistance and reviewed by Lowell K. Wood IV. Sources are linked inline; product recommendations are based on published specs, public release notes, and — where marked with an artifact — captures from his own lab. Last updated: 2026-05-01. Spot a mistake? Email hello@techfuelhq.com.

Lowell K. Wood IV (LK Wood IV) runs TechFuel HQ from St. Louis County, Missouri — a homelab and budget-PC infrastructure site for self-hosters who refuse to pay cloud rent. Contact: hello@techfuelhq.com