12 Best Self-Hosted Apps 2026 to Replace SaaS: Immich, Nextcloud, Vaultwarden + 9 More

By LK Wood IV · Published 2026-05-01 · Updated 2026-06-10 · 14 min read · St. Louis County, MO

TL;DR — The 12 picks, voted

The shortlist for the best self hosted apps 2026 is small on purpose. Twelve services that have outgrown their SaaS originals, not fifty half-finished forks. Pi-hole gets demoted for AdGuard Home. Plex gets cut. Mail-in-a-Box does not make the list — self-hosted email in 2026 is still a bad idea for almost everyone. Everything below runs in Docker, every snippet uses a pinned image tag, and the top five get full copy-paste compose files.

Affiliate disclosure. Some links here are affiliate links. If you click and buy, TechFuel HQ may earn a small commission at no extra cost to you. It does not change what gets recommended.

The scannable table — 12 apps, what they replace, what they need

That’s the list. Below: what got cut, then deeper dives and copy-paste compose files for the top five.

What got cut and why

• Plex — not a SaaS replacement; it is the SaaS. Jellyfin replaces Plex.
• Pi-hole — voted out for AdGuard Home. The DNS-over-HTTPS upstream and per-client rules in AdGuard’s UI are meaningfully better, and the Docker deploy is identical in difficulty. Pi-hole still works fine if you already run it.
• Seafile — solid block-sync, but Nextcloud AIO has closed the gap and the ecosystem (calendar, contacts, office) is broader.
• Plausible CE / Umami / Mealie / FreshRSS / Linkding — all good, all on the bench. They didn’t beat the 12 above on either daily use or obvious SaaS replacement.
• Mail-in-a-Box / Mailcow — explicitly cut. Self-hosted outbound email in 2026 still gets your IP scored as suspicious by Microsoft and Google more often than not, and inbound MX is fine until your dynamic IP changes or your ISP blocks port 25. Use a paid relay (Fastmail, Migadu, Proton) and move on. The long-running r/selfhosted email threads say the same thing in nicer language.

A difficulty score of 1 is “single container, defaults work, ten-minute deploy.” A 5 is “you’ll read documentation for a weekend and read it again at the next major upgrade.” Most of the 12 land at 1–3 — the apps that survive in homelabs are the ones where the 80% case is boring.

The top 5 — full setups

1. Immich — the Google Photos replacement that finally works

Immich is the reason a lot of people built their first homelab in 2025. The mobile app uploads from iOS and Android in the background, the ML stack identifies faces and objects locally, and the timeline UI beats Google Photos for most operations. The catch is RAM — the ML container alone wants ~2 GB at idle, and library import will pin a couple of cores for hours on a fresh install.

The official path is the Immich docker-compose template plus the bundled .env file. Pin the version explicitly — release is a moving tag and breaking schema changes have happened mid-year before. Per the Immich changelog the current stable is v1.140.x; pin the latest tagged release on install day.

Critical detail: Immich is not a backup. The database can corrupt. Use Immich’s official backup guide and keep originals on a separate disk from the Immich Postgres.

# docker-compose.yml — Immich, pinned
# Source: https://github.com/immich-app/immich/releases (pin to latest tag on install)
name: immich

services:
  immich-server:
    image: ghcr.io/immich-app/immich-server:v1.140.1
    extends:
      file: hwaccel.transcoding.yml
      service: quicksync # change to 'cpu' if no Intel iGPU
    volumes:
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
      - /etc/localtime:/etc/localtime:ro
    env_file: .env
    ports:
      - 2283:2283
    depends_on:
      - redis
      - database
    restart: always

  immich-machine-learning:
    image: ghcr.io/immich-app/immich-machine-learning:v1.140.1
    volumes:
      - model-cache:/cache
    env_file: .env
    restart: always

  redis:
    image: docker.io/redis:6.2-alpine@sha256:e3b17ba9479deec4b7d1eeec1548a253acc5374d68d3b27559a75d2b873b7d3a
    restart: always

  database:
    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
      POSTGRES_INITDB_ARGS: '--data-checksums'
    volumes:
      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
    restart: always

volumes:
  model-cache:

2. Nextcloud AIO — file sync, calendar, contacts, in one container

The official Nextcloud All-in-One project ships everything — Apache, PHP, the database, Redis, the office stack, Talk, the backup container — managed by a single mastercontainer that you talk to over a web UI on port 8080. It is the right answer for new self-hosters and for experienced ones who got tired of debugging PHP-FPM at 1 a.m.

# One-liner from the official AIO README
sudo docker run \
  --init \
  --sig-proxy=false \
  --name nextcloud-aio-mastercontainer \
  --restart always \
  --publish 80:80 \
  --publish 8080:8080 \
  --publish 8443:8443 \
  --volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
  --volume /var/run/docker.sock:/var/run/docker.sock:ro \
  ghcr.io/nextcloud-releases/all-in-one:latest

The latest tag here is the AIO mastercontainer, which the project explicitly maintains as the supported entry point — the actual Nextcloud server image underneath gets pinned by AIO to a tested release. That’s the one place I make an exception to the “no :latest” rule. If you want full version control, watch the Nextcloud AIO releases page and use a digest pin instead.

AIO turns on file sync, CalDAV, CardDAV, and Collabora office editing by default. The performance ceiling on a budget mini PC with 16 GB of RAM is around 4–5 active users on a 2.5 GbE network. Beyond that, tune Redis cache before blaming the box.

For the complete setup — NPM reverse proxy config, Office activation, CalDAV/CardDAV client setup, and AIO backup — see the Nextcloud AIO Docker setup guide.

3. Vaultwarden — Bitwarden, on a potato

Vaultwarden is a Rust reimplementation of the Bitwarden server API by dani-garcia. The current stable line is 1.35.x as of early 2026, per the Vaultwarden releases. It is fully compatible with the official Bitwarden mobile, browser, and desktop clients, which is the whole point — your phone doesn’t know it’s not talking to Bitwarden’s cloud.

# docker-compose.yml — Vaultwarden, version-pinned
services:
  vaultwarden:
    image: vaultwarden/server:1.35.4-alpine
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      DOMAIN: "https://vault.example.lan"
      SIGNUPS_ALLOWED: "false"      # flip to true for first user, then back
      ADMIN_TOKEN: "${ADMIN_TOKEN}" # generate with: openssl rand -base64 48
      WEBSOCKET_ENABLED: "true"
    volumes:
      - ./vw-data:/data
    ports:
      - 8222:80

Two things people miss. Vaultwarden needs a real TLS cert for mobile clients — put it behind Caddy or Traefik with Let’s Encrypt, or use Tailscale Funnel for a zero-config TLS path. And back up ./vw-data somewhere off the host — a vault you can’t restore is a vault you don’t have. The Vaultwarden on Proxmox setup guide covers Caddy reverse proxy, the Tailscale-only setup path, and an automated SQLite backup script with online backup API support.

4. Jellyfin — Plex without the company

Jellyfin is the mature fork of Emby. It does what Plex does — library scanning, transcoding, mobile and TV apps — without phoning home, without watching your viewing history, and without a “Pass” subscription gating hardware acceleration.

# docker-compose.yml — Jellyfin with Intel Quick Sync transcoding
services:
  jellyfin:
    image: lscr.io/linuxserver/jellyfin:10.10.7
    container_name: jellyfin
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/Chicago
      - JELLYFIN_PublishedServerUrl=http://192.168.1.50:8096
    devices:
      - /dev/dri:/dev/dri   # Intel iGPU passthrough for QSV
    volumes:
      - ./config:/config
      - /srv/media:/data/media:ro
    ports:
      - 8096:8096
    restart: unless-stopped

Intel Quick Sync is what makes Jellyfin viable on a budget mini PC. N100 and 12th-gen-or-newer iGPUs handle 4K HEVC decode without breaking a sweat. AMD GPUs on Linux remain weaker for transcode in 2026 — if your homelab is AMD-only, plan for direct-play clients (NVIDIA Shield, Apple TV, a recent smart TV). The Jellyfin team keeps a clear hardware acceleration matrix; read it before you buy a box.

5. Home Assistant OS — local-first smart home

Home Assistant is on this list because it replaces Apple Home, Google Home, and SmartThings simultaneously, and because the cloud-dependency stories from those vendors keep getting worse. It is not on this list because it is easy. It is rated 4/5 on difficulty for a reason: deep automation requires real time investment.

The recommended path in 2026 is still Home Assistant OS running as a VM, not the Docker container. Per the official installation docs, the container variant loses the Supervisor and the add-on ecosystem, and the add-on ecosystem (Mosquitto, Zigbee2MQTT, ESPHome, the official Z-Wave stack) is most of what makes HA worth running.

For a Proxmox host, the tteck Proxmox Helper Scripts (now community-maintained at community-scripts/ProxmoxVE) install HA OS as a VM in about three minutes. That’s the path. Allocate 2 GB RAM, 2 vCPUs, 32 GB disk, and pass through a USB Zigbee/Z-Wave coordinator if you have one. See the Proxmox vs TrueNAS vs Unraid comparison for which hypervisor fits your situation.

The Home Assistant 2026.3 release notes confirmed the move to zstd-compressed container images, which broke a few older Synology installs but is fine on any modern Docker. Read release notes before every monthly upgrade. HA breaks integrations a few times a year — upgrades are not background tasks.

The other 7 — short notes

AdGuard Home (replaces Pi-hole, NextDNS, your router’s bad ad blocker)

Pin adguard/adguardhome:v0.107.x. Run it on the same box as Uptime Kuma. Point your router’s DHCP DNS at the AdGuard container IP and every device on your network — phones, smart TVs, the IoT garbage — gets DNS-level filtering with zero per-device setup. The DoH/DoT upstream config is in the UI; switch it to Quad9 or Cloudflare 1.1.1.1 and you’ve also leaked less DNS to your ISP than you did last week.

The AdGuard Home + Local DNS on Proxmox tutorial covers the LXC setup from scratch: port 53 in an unprivileged container, OISD and Steven Black blocklists, local A records for pve.lan / nas.lan, and an optional Unbound recursive resolver that cuts upstream providers out entirely.

Tailscale (replaces Tailscale, ZeroTier, paid commercial VPN)

Yes, Tailscale is technically a SaaS for the coordinator. The free personal tier (100 devices, 3 users) is enough for almost every homelab, and the WireGuard data plane runs entirely peer-to-peer once peers are connected. The right way to read this is: Tailscale replaces commercial OpenVPN/WireGuard services and ZeroTier, both of which are also SaaS. If you genuinely refuse the coordinator, Headscale is the open-source alternative — but plan for a difficulty score of 4, not 1.

AudioBookshelf (replaces Audible)

If you already own audiobooks (legitimately, ideally), AudioBookshelf gives you per-user progress sync, mobile apps, and podcast support. Single container, no companion services, about 100 MB idle RAM — the lightest useful self-hosted app on this list. The iOS and Android apps are official and free. Podcast RSS auto-download is built in. Pin ghcr.io/advplyr/audiobookshelf:latest. Full setup with library directory structure, mobile app config, metadata matching, and Tailscale remote access is in the AudioBookshelf Docker guide.

n8n (replaces Zapier, Make, IFTTT)

400+ integrations, a real queue mode for production workloads, and the ability to drop into JavaScript when the visual builder won’t do what you need. Pin to a specific tag — n8n’s latest has shipped breaking workflow changes inside a single major release before. The n8n Docker image page maintains tags per release; pick the current stable on install day.

For the full setup — PostgreSQL backend, Nginx Proxy Manager HTTPS, queue mode with Redis, and backup strategy — see the n8n self-hosted Docker guide.

BookStack (replaces Notion as a wiki / docs site)

For pure note-taking, Obsidian beats every self-hosted option. For a team or family wiki — recipes, runbooks, “how the network is set up” — BookStack is the right answer. Outline is also good but the hosting story is harder. The stack is two containers (BookStack + MySQL) with about 180 MB idle RAM — the lightest wiki option on this list. Pin lscr.io/linuxserver/bookstack:latest and configure LDAP if you’re already running Authentik or Keycloak for unified auth. Full setup with MySQL, NPM HTTPS, LDAP, and backup is in the BookStack Docker guide.

Uptime Kuma (replaces UptimeRobot, Better Stack)

Already covered in the self-hosting essentials guide. It belongs here because once you have 12 services running, you need to know which one died at 2 a.m. before your family tells you the internet is “broken.” Pin louislam/uptime-kuma:1.23.x.

Paperless-ngx (replaces Evernote scan, Dropbox Scan, paper)

Drop a PDF in the consume folder, OCR runs, the document is tagged, you can full-text-search five years of mail in seconds. Pin ghcr.io/paperless-ngx/paperless-ngx:2 and run PostgreSQL next to it — not SQLite, which write-locks under concurrent requests. Add Tika and Gotenberg containers alongside; without them, Word and Excel files ingest silently with no searchable text. The full compose stack with correspondent auto-tagging, subdirectory tag mapping, and NPM HTTPS is in the Paperless-ngx setup guide.

What hardware actually runs all 12

Rough memory budget: ~24 GB RAM if you run everything simultaneously with realistic headroom. CPU is less of a problem than people think — Immich’s ML is the spike, and the rest idle hard.

The Proxmox vs TrueNAS vs Unraid comparison covers the OS choice. For hardware, Best Mini PCs for a Homelab in 2026 lands on a 32 GB Ryzen 5825U or Intel 12th-gen-or-newer box, NVMe boot, separate disk for media. If you’re starting from a single mini PC and have never set up Proxmox, the Proxmox mini PC setup walkthrough is the next read. If you have an old gaming PC sitting in a closet, the repurpose-as-server guide skips the hardware purchase entirely. For the complete Docker Compose stack — NPM + Portainer + Uptime Kuma + Watchtower + Gitea with working compose files and a shared proxy network — the Docker Compose starter stack tutorial has everything wired together.

Does it actually save money?

The Self-Hosting Break-Even Calculator answers this for your specific situation — add your subscriptions, set your hardware budget, and see exactly when self-hosting pays for itself. Spoiler: replacing $30–50/month in SaaS with a $170 mini PC usually breaks even in under 6 months.

Pick the box that runs the stack

The 12-app stack needs a real host. The TechFuelHQ PC Builder checks socket / RAM / PSU / GPU clearance compatibility for the AM4, AM5, and Intel platforms that pair well with Docker stacks. For mini-PC turnkey picks, the mini-PC homelab guide covers Minisforum MS-01 (10GbE for storage-heavy stacks) and the cheap used-OptiPlex path. If your stack outgrows a single 2.5GbE link, the 10GbE homelab networking guide covers the cheap switch options.

FAQ

What are the best self hosted apps in 2026?

The 12 covered above: Immich, Nextcloud AIO, Vaultwarden, Paperless-ngx, Jellyfin, AdGuard Home, Tailscale, Home Assistant OS, AudioBookshelf, n8n, BookStack, and Uptime Kuma. They were picked for daily-use value, mature documentation, and a clear SaaS counterpart they actually replace — not for being interesting.

Can a single mini PC run all twelve?

Yes, with a real budget. A 32 GB Ryzen 5825U or Intel 12th-gen mini PC with a 1 TB NVMe runs the full stack with headroom for a couple of VMs. The bottleneck is almost always RAM — Immich’s ML container plus Nextcloud’s PHP plus Home Assistant in a VM eats 12–14 GB before users touch anything.

Is Jellyfin really better than Plex in 2026?

For most homelab setups, yes. No subscription, no remote-access gatekeeping, hardware transcoding works on Intel Quick Sync without paywalls, and the apps on Apple TV, Android TV, and Roku have all reached parity with Plex’s basic features. Plex still wins on “your relatives can install one app and find your library.”

Should I self-host email?

No, almost certainly not. Outbound deliverability to Gmail and Microsoft 365 is consistently bad from residential IPs in 2026, and inbound on a dynamic IP breaks at the worst times. Use a paid relay (Fastmail, Migadu, Proton) and self-host everything else. Mailcow and Mail-in-a-Box work, but the operational tax is real.

How do I back up these self-hosted services?

Treat the data volumes (./immich-data, ./vw-data, ./nextcloud-data, etc.) as the backup target, not the containers. A weekly restic or borg job to a second disk plus an offsite copy (a small VPS, an encrypted Backblaze B2 bucket, or a friend’s homelab over Tailscale) covers the realistic failure modes. The automated off-site backups with restic guide has a complete working systemd service and retention policy.

Is Tailscale really self-hosted?

Strictly, no — the coordinator is SaaS. Practically, the data plane (the actual VPN traffic) is peer-to-peer WireGuard and never touches Tailscale’s servers. If you need a fully self-hosted control plane, run Headscale. For most readers, Tailscale’s free tier is the right call.

Lowell K. Wood IV (LK Wood IV) runs TechFuel HQ from St. Louis County, Missouri — a homelab and budget-PC infrastructure site for self-hosters who refuse to pay cloud rent. Contact: hello@techfuelhq.com

Sources and methodology

App recommendations synthesize maintainer documentation, deployment guides, and the maintained Docker image tags as of 2026-06-10. RAM and CPU footprint figures are taken from each project’s published documentation.

Primary sources cited:

• Immich docs — official Immich documentation
• Nextcloud AIO docs — official Nextcloud All-In-One reference
• Vaultwarden wiki — official documentation
• Jellyfin docs — official Jellyfin reference
• AdGuard Home — project documentation
• Tailscale docs — official documentation and free-tier limits
• Home Assistant docs — official OS installation guide
• r/selfhosted community — community deployment reports

Email corrections to hello@techfuelhq.com.