Self-Hosting Stack 2026 — What to Run Yourself and Why Now

Self-host the things whose loss would hurt and whose failure you can survive: passwords, files, code, notes, DNS filtering and your own AI chat front end. Do not self-host the things where a bad week costs you deliverability or data — email in particular. And treat the exit plan as the product: exports, off-site backups and a payment method that is not a single bank. That framing comes from a week in which Switzerland's Federal Council published results of a proof of concept with 172 employees on the openDesk suite and launched a 3,000-employee pilot to run through 2027, Imbue released Cloud in a Bottle (AGPL-3.0) so a Raspberry Pi or an old laptop installs Nextcloud, Vaultwarden, Forgejo, Jellyfin and Open WebUI in one click, and Autistici/Inventati — a collective hosting email and blogs for activists since 2001 — announced its shutdown after a 26 August US terrorism designation made its site unreachable and led its bank to suspend its account on 5 September. The lesson is not "cloud bad". It is that the layer you do not control is the layer that decides.

Why this week and not last year

The Swiss case is the institutional version. On 3 September 2026 the Federal Council published the results of PoC BOSS, a feasibility test in which 172 federal employees used openDesk — a German open-source collaboration platform — instead of Microsoft 365. On that basis a pilot for about 3,000 employees in critical processes runs to the end of 2027, in parallel with Microsoft 365 rather than replacing it outright. Switzerland's military Cyber Command is not waiting: it intends to replace Microsoft 365 entirely with openDesk by October 2026, on the stated ground that foreign governments should not be able to reach sensitive Swiss data. Behind both sits the 2024 EMBAG law, which requires federal agencies to publish government-developed software as open source by default.

Cloud in a Bottle is the individual version. Built by Imbue with open-source contributors and licensed AGPL-3.0, it is a personal cloud platform that installs web applications with one click on hardware you control — an old laptop, a Raspberry Pi, your own VPS — or on Imbue's managed service from $5 a month with a $10 starting credit. The curated catalogue is the self-hosting canon: Nextcloud for files, calendar and contacts; Vaultwarden for passwords; Forgejo for Git; Jellyfin and Navidrome for media; Pi-hole for network ad blocking; SearXNG for search; a Matrix Synapse homeserver for chat; Open WebUI for a local LLM interface; Uptime Kuma for monitoring; plus Minecraft and a notes app. It hit the Hacker News front page with over 600 points because it removes the reason most people never started: the first weekend.

Autistici/Inventati is the warning. A/I ran email, hosting and the Noblogs platform for activists for 25 years. After the US designation on 26 August, its website became inaccessible on 28 August, Banca Etica suspended its account on 5 September, and on 6 September it announced closure. A/I rejects the accusations entirely; that is not the point here. The point is the failure chain: not a server, not a disk, but a domain and a bank. Neither is something self-hosting alone protects you from, and both are things a good exit plan does.

The three tiers

Tier 1 — run it yourself, no debate

Passwords (Vaultwarden, Bitwarden-compatible clients). A breach here is catastrophic and the software is small, stable and offline-capable. Files and calendar (Nextcloud). Code (Forgejo or Gitea): a mirror of everything you have on GitHub, pulled nightly, costs almost nothing and turns a platform outage or account suspension into an inconvenience. Notes: plain Markdown in a synced folder beats any hosted notes app for longevity; if you use Obsidian, the vault is already files, and Nextcloud syncs it. DNS filtering (Pi-hole or AdGuard Home): the single biggest quality-of-life win per hour spent.

Tier 2 — run it yourself if you will maintain it

Media (Jellyfin, Navidrome): great, but storage grows and transcoding wants real hardware. Chat (Matrix Synapse): worth it for a family or a small team; federation and encryption key management add operational load. Local AI (Open WebUI in front of a local model or an API key): the front end is trivial to host; the model is a hardware question. For most people the sane configuration is a self-hosted front end pointing at a paid API, which keeps your conversation history on your disk without buying a GPU. Monitoring (Uptime Kuma): host it somewhere other than the box it monitors.

Tier 3 — do not self-host

Email. Deliverability is a reputation system you do not control; a misconfigured DKIM or a neighbour's spam on a shared IP range costs you real messages. A/I ran mail for 25 years with expertise most of us do not have and still could not survive a sanction. Use a paid provider with export, and keep your own domain so you can move. Anything with legal retention duties — invoicing records, payroll — unless you also own the backup and audit story. Public-facing services for other people unless you are prepared to be on call.