The Best Self-Hosted Apps of 2025 — a Personal Roundup

Introduction

#

People often write to me asking for a review of one app or another. Usually this is because the person asking is stuck on something, but it’s worth noting that sometimes people also ask to see current, modern apps. And there’s one important point here. Apps come out often, and the ideas behind them are interesting. But there’s one catch: personally, I want to see how the app and its author hold up over time. So it doesn’t end up like it often does with open source — the author gets tired, gets a paying job, and the app gets abandoned.

Today I want to talk about apps that were released in 2025, immediately caught the community’s attention, and so far show no signs of being abandoned.

Pangolin

#

Pangolin is an open-source platform for remote access and proxying with a focus on security (zero-trust). The project’s main goal is to provide a self-hostable alternative to Cloudflare Tunnel / Twingate / Zero-Trust VPN, allowing you to securely publish internal services to the internet and provide access to private resources via a browser or client applications.

✔️ Combines a reverse proxy (under the hood, Traefik) and Zero-Trust VPN / WireGuard tunnels ✔️ Has a management dashboard, authentication, and role-based access ✔️ Designed for both self-hosted installations and management via the Pangolin Cloud control service

The repository contains TypeScript code, the Dashboard UI interfaces, and server-side logic for managing access and routing.

⚙️ Core mechanisms and architecture

#

🛠️ Components

#

📌 Pangolin Server — the central server with a UI and API that manages access to resources.

📌 Newt — a tunnel agent (site connector) that establishes a secure connection between a remote network/host and the Pangolin Server via a WireGuard-like tunnel (often in userspace).

📌 Clients — users or machines that connect to services through Pangolin and get access to “Private Resources”.

🔑 Authentication and authorization

#

Pangolin supports:

• Built-in authentication with a UI
• Integration with external IdPs (OAuth2/OIDC) — for example, Authentik or Keycloak.
• Auto-provisioning of users on login via an external IdP.

Access rules for resources can be configured by:

• IP / CIDR range
• URL path
• Roles/groups
• ASN rules
• Port and protocol-level rules (TCP/UDP).

🌐 Networking mechanisms

#

🚀 A WireGuard-like tunnel provides secure communication between the server and remote sites/clients.

🚀 Zero-Trust Network Access (ZTNA) — access is determined not by the presence of a VPN connection, but by the access policy for each resource.

🚀 Magic DNS — resolves friendly names inside the private network when a client connects.

📌 Use cases

#

Pangolin is a good fit for:

✅ Publishing internal web services (UIs, APIs, dashboards, etc.) through a browser without opening ports directly ✅ Providing access to SSH, RDP, databases, or other internal services ✅ Uniting multiple networks/offices under a single secure infrastructure ✅ Zero-Trust Remote Access (ZTNA) instead of a traditional VPN

👍 Pros

#

🔐 Security and Zero-Trust

• Granular resource-level access, doesn’t grant full access to the whole network.
• Support for external OAuth2/OIDC IdPs.

🌍 Flexible networking capabilities

• Support for tunnels through NAT/firewalls (Newt).
• Clients for Windows/Mac/Linux.

📊 UI + management

• A dashboard with access controls, logs, and settings.
• Fine-grained access rule configuration.

🔄 Active community and frequent updates

• Active releases with new features (firewall, ACL, DNS, magic DNS, etc.).

👎 Cons and limitations

#

⚠️ Complexity

• Initial setup can be difficult for beginners (DNS, tunnels, firewall).

  ⚠️ Configuration dependency

• Misconfiguration can lead to vulnerabilities (for example, authentication CVEs in insecure configurations).

⚠️ The upstream project is still evolving

• Some components (for example, mobile clients) still need work and a release is planned for later.

⚠️ DNS dependency and external access

• If DNS/server components are unavailable, services can stop resolving (as shown in practical cases).

⚠️ License

• The core code is under AGPL-3 (which requires opening up changes for public use); commercial variants with different terms also exist.

Pangolin is a great self-hosted alternative to Cloudflare Tunnels and classic VPN solutions with a Zero-Trust approach, if you need advanced routing, authentication, and role-based access without directly forwarding ports into your network.

Papra

#

📌 What is Papra

#

Papra is a cloud and open-source platform for managing and archiving documents. It helps organize, store, and quickly find any files in one place, eliminating the “chaos” of folders and data scattered across different services.

Core ideas:

• centralized document storage;
• convenient organization via tags and “organizations”;
• powerful search;
• extensibility via API and integrations;
• the ability to self-host (run it yourself on your own server).

🎯 What it’s for

#

Papra solves the classic problems of digital document management:

✔️ Centralized storage — all documents in one place instead of hundreds of folders on disk.

✔️ Organization and metadata — tags, automatic tagging rules, “organization” structures for teams. ✔️ Search and quick access — full-text search across documents lets you find what you need in seconds. ✔️ Integrations and automation — API, webhooks, CLI, email import, and SDK let you embed Papra into your workflows. ✔️ Archiving — suitable for both everyday use and long-term storage of important documents.

👤 Target audience

#

🔹 Individual users

#

• storing personal documents: scans, applications, contracts, insurance, receipts, etc.;
• convenient storage and search;
• access from different devices.

🔹 Small and medium teams

#

• shared access to documents between employees;
• organization by project or group;
• action auditing and access management.

🔹 Professionals and companies

#

• archiving legally important documents;
• integration with other systems via API and webhooks;
• monitoring of user activity and auditing.

🔹 Tech enthusiasts and self-hosters

#

• running the service on your own infrastructure;
• control over your data, with no cloud provider involved.

🎉 Pros

#

✅ Centralized document management All documents and metadata are gathered in one place, easy to organize and find.

✅ Powerful search Fast full-text search — even across the content of uploaded files.

✅ Flexible organization Tags, automatic classification rules, “organization” hierarchies.

✅ Developer tools API, CLI, SDK, and webhooks let you automate tasks or integrate Papra into other services.

✅ Email import You can email documents to a unique address, and Papra automatically saves the attachments.

✅ Open-source and self-hostable You can run Papra on your own host for free.

✅ Transparency and privacy Papra positions itself as an ethical and independent solution that doesn’t sell your data.

⚠ Cons / limitations

#

❗ Requires setup (if self-hosted) To run Papra on your own server, you need basic Docker and admin skills.

❗ Basic features are still evolving Some advanced features, such as document sharing or upload requests, may not yet be implemented or are still in development.

❗ A paid plan for large volumes The cloud version has a free tier with limited storage and members, and larger organizations need a paid plan.

❗ Not a highly specialized DMS This isn’t a large enterprise document management system with advanced workflows, version control, or complex permissions — compared to major enterprise DMS platforms.

📊 Summary

#

Papra is a convenient, modern toolset for managing, searching, and archiving documents that can be used as a personal archive as well as by teams. It’s a good fit for anyone who wants to:

✔ centralize all their documents; ✔ have powerful search and metadata; ✔ have control over their data via self-hosting; ✔ integrate document management into their workflows.

If you need an enterprise DMS solution with advanced business workflows, Papra can be a good foundation, but you may need to integrate it with other systems.

TinyAuth

#

🚀 What is TinyAuth

#

TinyAuth is a lightweight authentication (login/access control) app that helps protect web services and applications in a simple way: it shows a login screen before granting access to a protected service and verifies the user.

TinyAuth’s core idea is simplicity:

• minimal dependencies (no complex database, interfaces, or heaps of configuration),
• configuration via environment variables,
• integration with popular proxies (for example, Traefik, Nginx, Caddy),
• support for basic login (OAuth, TOTP two-factor authentication, etc.).

This solution is much simpler than comprehensive products like Authentik, Keycloak, or other IAM/SSO systems geared toward corporate networks and large projects.

👥 Who TinyAuth is for

#

Target audience:

✅ Homelab enthusiasts who want to quickly protect their self-hosted services (for example: web panels, home services, personal dashboards).

✅ People looking for a minimalist, simple solution without complex infrastructure.

✅ Those using reverse proxies (Traefik, Nginx, Caddy) who want to add a simple login check before accessing services.

👎 Not the best choice for large organizations or systems with:

• complex user management,
• LDAP/AD integration,
• multi-tier access permissions,
• dynamic user updates without a restart.

⚙️ How it works

#

TinyAuth is usually deployed as a container (for example, Docker) and sits between the user and the protected service:

1. The user’s request hits TinyAuth.
2. TinyAuth displays a login screen.
3. After successful authentication, the request continues on to the service.

Configuration happens via environment variables — for example, the user list, secrets, OAuth settings, etc.

Sessions are stateless (no database on the server side), which keeps the system simple, but comes with a limitation: the server cannot automatically terminate a session so that it “expires” server-side.

👍 TinyAuth pros

#

✔️ Simplicity and lightness

• Configures without complex setups.
• Doesn’t require a separate database.
• Minimal dependencies.

✔️ Good integration with reverse proxies

Works out of the box with Traefik, Nginx, Caddy, and other servers.

✔️ Two-factor authentication support

You can add 2FA (for example, TOTP), which raises the security level compared to a simple login/password.

✔️ Open source and lightweight for homelabs

A great fit for protecting internal services for home-server enthusiasts.

👎 Cons and limitations

#

⚠️ Not designed for large projects

• No full-fledged user management system.
• No LDAP/Active Directory support or complex access rights.

⚠️ Stateless (limited sessions)

The server can’t “expire” sessions like a full authenticator; session management is simplified.

⚠️ Poor scaling at the enterprise level

If you need dozens of groups/roles, centralized management, and dynamic user updates — TinyAuth may be inconvenient.

⚠️ Requires a restart to update configuration

Any change to the user list/access rights often requires a restart.

📌 Where it makes sense to use it

#

✨ Protecting home web services (a home Proxmox/AdGuard/Nextcloud).

✨ Paired with Traefik/Nginx for basic protection.

✨ When you need simple authentication without corporate IAM solutions.

🛑 When it’s better not to use TinyAuth

#

❌ If you need corporate IAM built to standards.

❌ If you need centralized LDAP/AD access or SSO across many services.

❌ If you have many users and complex rights/groups.

📌 Alternatives (more often used in more complex environments)

#

• Authentik — a flexible IAM/SSO with LDAP/AD support.
• Keycloak — a powerful enterprise SSO/OAuth platform.
• Authelia — a reverse-proxy-oriented authenticator.
• OAuth-Proxy/OAuth2-Proxy — lightweight proxies for OAuth authorization.

Zerobyte

#

📌 What is Zerobyte

#

Zerobyte is a system for scheduling, running, monitoring, and restoring backups. It’s built on top of the popular tool Restic, which handles the actual backup process (encryption, deduplication, etc.). Zerobyte adds to Restic:

• a modern web interface (GUI) for management;
• a backup job scheduler;
• status and log monitoring;
• flexible retention and encryption policies; all of this is easy to configure without running commands manually.

🔐 Backups are encrypted and compressed, and stored on various types of storage (local disk, cloud, S3-compatible service, etc.).

🧠 Key features

#

✔️ Automatic backups with a scheduler and schedules. ✔️ Encryption and compression of data via Restic. ✔️ Support for various sources: local directories, NFS, SMB, WebDAV, etc. ✔️ Multiple storage options for saving backups:

• local directories;
• S3-compatible storage;
• cloud providers via rclone (Google Drive, Dropbox, etc.). ✔️ A web interface for monitoring all jobs and restoring files.

📦 Can run via Docker + Docker Compose (the standard method).

👤 Target audience

#

Zerobyte is aimed primarily at:

🎯 Home-lab enthusiasts and self-hosters — people who manage their own servers, NAS, or home clusters and want a convenient interface for backups. 🎯 Small companies and IT specialists who need a simple backup system without complex enterprise infrastructure. 🎯 Any users for whom Restic alone is too inconvenient via the CLI, but who like its functionality.

👍 Zerobyte pros

#

✅ A simple web interface that makes backup work easier (no CLI needed). ✅ Flexible settings for scheduling and retention policies. ✅ Encryption and deduplication courtesy of Restic. ✅ Support for various storage backends, including cloud storage via rclone. ✅ Can serve as a centralized backup location for a large amount of data.

👎 Cons and limitations

#

⚠️ Still in early development (0.x) — there may be API changes, bugs, and instability. ⚠️ Depends on Docker — no official support for running without containers. ⚠️ Some features (for example, database backups, stopping services before a backup) aren’t built in — you need to arrange them yourself with scripts. ⚠️ It’s not always considered ready for large enterprise environments (better suited for smaller installations).

🧩 How it differs from Restic

#

Restic on its own is a CLI backup tool — powerful, but without a graphical interface or scheduler. Zerobyte takes Restic and:

📍 adds convenience: a GUI, schedules, monitoring; 📍 makes management more accessible for non-CLI users.

🧪 Example usage scenario

#

1. Run Zerobyte via Docker on your home server.
2. Add data sources through the web interface: home folders, NFS/SMB shares.
3. Configure a backup destination (for example, S3-compatible storage or a cloud service via rclone).
4. Create a schedule for automatic backups.
5. In case of failure, restore data through the web interface.