This note documents my current setup for email.

It includes:

• aerc as an email client
• vdirsyncer for syncing contacts
• khard for reading and searching locally-synced contacts
• mbsync for syncing email to a local Maildir
• notmuch for organising and searching locally-synced email

Pre-start: Handling local credentials

To securely store credentials for syncing, I use pass. I recommend installing this for your system and setting it up with a GPG key.

Obsidian is a note/knowledge management tool I’ve used a fair amount in the past (before moving to nb). Below I log some considerations I dealt with whilst using Obsidian.

Self-deleting files

When I used Obsidian, I synced it to my devices using iCloud (though I don’t know if this is relevant to this particular issue). At various points, I noticed that some notes would completely disappear. Sometimes this would happen even whilst I was editing them, or I would see the note contents just go blank whilst the note was open. This was stressful if I was in a meeting or needed the note at that time (though luckily cmd-Z would usually re-surface the note contents back into the buffer).

A collection of “things”, software and systems I use on a frequent or daily basis.

I enjoy using open source, self-hosted, and independent software where possible. I like the reliability and quality of Apple hardware, and often the combination of the two works best for me.

Hardware

• iPhone 15 Pro Max - everything
• MacBook Air 2022: M2, 24GB memory - dev work, portable work
• iPad Pro - non dev work
• Apple Watch Ultra 2 - health & fitness tracking

Development

• Vim - text editor
• tmux - terminal multiplexing (where not provided by the terminal)
• Gitea - for git syncing

General

• Firefox - browser
  • Container tabs (I couldn’t live without this anymore)
  • uBlock Origin - ads
  • Privacy Badger - content blocking
  • Decentraleyes - content blocking
• Apple Calendar - on Mac and iOS
• aerc - email client. Combined with:
  • Khard - for contacts
  • Vdirsyncer - for syncing contacts
  • notmuch - for email indexing
  • mbsync - for email syncing

Hosting

• Raspberry Pi - for home-based and personal services.
• Linode - all my self-hosting needs. Get $100 for free with Linode using this link
• Fastmail - email. Get 10% off using this link
• Bunny - CDN and web storage for some websites/apps. You can use this referral link to sign-up.
• Termius - for SSH access to other hosts

Info/tainment

• Overcast - podcasts on iOS
• NetNewsWire - RSS feed reader, syncs with my self-hosted FreshRSS instance
• Carrot Weather - for weather on iOS
• Ivory - for Mastodon on iOS

Productivity

• Nextcloud - Data storage
• nb - Notes and todos and knowledge management
• Taskwarrior - Main task management

Messaging

• Telegram

Security

• Bitwarden - password management. Self-hosted using Vaultwarden
• Tailscale - for securely connecting all my devices and servers

As of September 2024 I use nb as my primary note-taking and knowledge management program.

Install

On a Mac, it can be installed from Homebrew: brew install nb.

Set nb directory

I sync my nb documents via Syncthing, and therefore need the tool to use my Syncthing directory as its “home”: nb set nb_dir ~/Syncthing/nb.

Migration from Obsidian

To migrate my notes from Obsidian, I created the top-level directories (which nb calls “notebooks”) in ~/Syncthing/nb and copied the .md files from Obsidian into the appropriate directories.

A few weeks back (as of 2024-09-01) I posted about a tool called jrnl on Mastodon. The post got a fair amount of engagement and discussion, and I’ve also given it a go over the past couple of weeks myself.

jrnl is a command-line tool for keeping a journal. It can be used for quick single-sentence entries or for long-form journaling. Similar to Taskwarrior, it’s a tool that does what it needs to do and then gets out of the way (i.e. you don’t need to open an app and click around to get to your journal).

If you’ve followed my blog or other notes, you’ll be well aware of my extensive use of Tailscale for nearly everything – securing access to remote servers and for connecting to services across my local network.

Tailscale DNS is great for assigning DNS names to individual hosts, but my approach (usually) involves using Docker containers, with which I run several services on a single host. It is then fiddly (or impossible? I’m not sure) to use a single Tailscale “machine” to expose multiple services on the same host nicely via the DNS system (system).

I self-host a Vaultwarden instance to manage my usernames, passwords, two-factor codes, and other details for my accounts everywhere.

Standard Bitwarden clients (including browser extensions and mobile apps) can use Vaultwarden instances as their backend server.

In this note I describe my particular setup.

Notes

• I access Vaultwarden through Tailscale. Even though this is encrypted as-is, Bitwarden clients require use of TLS. As such, we need to use some method for handling a TLS connection. In my case, I use a Tailscale sidecar container to handle this.
• If you don’t use Tailscale, then you could instead use a reverse proxy.

Setup

To begin, set-up a new docker-compose.yml file that includes the Vaultwarden and reverse-proxy containers.

I’ve switched from managed photo providers (such as Apple or Google photos) to a self-hosted Photoprism instance. This note documents my setup.

I use Linode for this, and you can get a free $100 credit using this referral link.

Update 2022: More recently I’ve migrated Photoprism over to a home-based Raspberry Pi, which works great.

Server setup

Provision a new server or instance (at least 4GB memory and 2 CPU cores), and create and attach a big (I use 1TB) volume.

This is a reference quick-start note for deploying PostgreSQL via Docker, and with working self-signed TLS.

1. Generate keys for TLS

E.g. with one year expiry:

mkdir postgres-certs && cd postgres-certs
openssl req -new -x509 -days 365 -nodes -text -out server.crt -keyout server.key
sudo chown 999 server.key
sudo chmod 0600 server.key

Postgres key permissions are fussy. In this case, we set the key to be owned by the postgres user in the container (999), which you may not want to do if you’re on a shared environment. See this thread for more info.

This is a reference quick-start note for deploying MongoDB via Docker, and with working self-signed TLS.

Note: This setup does not yet consider replica sets. Coming soon…

1. Generate keys for TLS

E.g. with one year expiry:

openssl req -nodes -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365
cp cert.pem certificateKey.pem
cat key.pem >> certificateKey.pem

2. Create a Docker Compose file

Ensure to reference the correct locations via volume mounts.

I use Woodpecker CI to automate my personal CI/CD processes. This note documents my setup.

Create a docker-compose.yml and bring the service up (notes on environment below):

version: '3'

services:
  woodpecker-server:
    image: woodpeckerci/woodpecker-server:latest
    ports:
      - 8000:8000
    expose:
      - 8000
    volumes:
      - ./woodpecker-server-data:/var/lib/woodpecker/
    environment:
      - WOODPECKER_OPEN=false
      - WOODPECKER_HOST=https://your.host
      - WOODPECKER_AGENT_SECRET=SECRET
      - WOODPECKER_GITEA=true
      - WOODPECKER_GITEA_URL=https://git.wilw.dev
      - WOODPECKER_GITEA_CLIENT=GITEA_CLIENT
      - WOODPECKER_GITEA_SECRET=GITEA_SECRET

  woodpecker-agent:
    image: woodpeckerci/woodpecker-agent:latest
    command: agent
    depends_on:
      - woodpecker-server
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - WOODPECKER_SERVER=woodpecker-server:9000
      - WOODPECKER_AGENT_SECRET=SECRET

Replace the WOODPECKER_HOST variable with the URL/host required, and also the URL for your Gitea instance.

I run a number of services on my own machines and VPSs, and for each system I ensure there are appropriate backups in place.

Backup target

I usually use Backblaze B2 as a backup solution due to its low costs, simplicity, and ease of use.

Linode’s Object Storage service is also great, but I use Linode to handle nearly 100% of my workloads and it feels safer (and more compliant with the 3-2-1 principle of backing-up) to store backups with a different datacentre and provider from the primary data store.

I’m interested in being able to look after my own data, as much as possible. I try to ensure that this is at least (almost) as convenient as commercial where I can (and so there is probably much more I can do).

What I currently selfhost

Most of the services I selfhost run on Linode servers. I can definitely recommend them for ease of security, management, and performance. For personal services, I use a home-based Raspberry Pi.

My notes are kept using Joplin. I use Joplin server to keep all of my devices in-sync.

Below is a docker-compose.yml I use to run the server.

version: '3'

services:
  db:
    image: postgres:13
    volumes:
      - ./data/postgres:/var/lib/postgresql/data
    restart: unless-stopped
    environment:
      - POSTGRES_PASSWORD=CHANGEME
      - POSTGRES_USER=joplin
      - POSTGRES_DB=joplin
  app:
    image: joplin/server:latest
    depends_on:
      - db
    ports:
      - "8084:22300"
    restart: unless-stopped
    environment:
      - APP_PORT=22300
      - APP_BASE_URL=http://CHANGEME
      - DB_CLIENT=pg
      - POSTGRES_PASSWORD=CHANGEME
      - POSTGRES_DATABASE=joplin
      - POSTGRES_USER=joplin
      - POSTGRES_PORT=5432
      - POSTGRES_HOST=db

Note: I run my Joplin server in my Tailscale network, so I don’t bother with TLS certs, but you may wish to put a reverse proxy in front if you run it publicly.

I have a small fleet of Raspberry Pis (mostly the Pi 4 Model B), which I use at home for various tasks.

They are all firewalled off and are reachable via Tailscale. A small number of the services they run are also exposed to the local network.

What they run

As of the time of writing, services I run on the Pis include the following:

• Nextcloud
• Photoprism
• Home Assistant
• Jellyfin
• FreshRSS

Storage

I use large SSDs (e.g. this one) for the Pis that require extra storage, such as for my photos. These are connected via USB3-SATA cables (such as these).

2FAuth is a self-hostable web service for managing two-factor authentication tokens. It has a nice, clean interface, is responsive (so it can be simply added to the homescreen on iOS), and has various useful features:

• Adding new tokens by scanning QR codes;
• Searching for tokens;
• Lots of features related to security and usability.

Running the service itself is as straight forward as bringing up the supplied docker-compose.yml file. However - as noted in this blog post - if, like me, you plan to run it inside of a Tailscale tailnet, you’ll need to ensure HTTPS is enabled in order for the camera to work. To do this, attach a reverse-proxy armed with the required certificates.

Gitea is a fantastic GitHub-like service for git remotes and for viewing code and git projects via a web-browser. One can join existing instances (such as Codeberg), or self-host it.

I self-host a Gitea instance. I use a docker-compose.yml file like the one below.

version: "3"

services:
  gitea:
    image: gitea/gitea:latest
    restart: unless-stopped
    environment:
      - USER_UID=1000
      - USER_GID=1000
    networks:
      - traefik_net
    volumes:
      - ./gitea_data:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "22:22"
    expose:
      - 3000
    labels:
      - traefik.http.routers.gitea.rule=Host(`domain.com`)
      - traefik.http.routers.gitea.tls=true
      - traefik.http.routers.gitea.tls.certresolver=myresolver
      - traefik.http.services.gitea.loadbalancer.server.port=3000

networks:
  traefik_net:
    external: true

Change the domain at which you host the instance and setup the DNS/labels as described in the Traefik note.

For sensitive data storage in the cloud, I will usually provision a separate volume, encrypt it, and then use this as the volume mapper for containerised services.

Creating and attaching a volume

I use Linode to host the vast majority of my services. In Linode, new volumes can be easily created and attached to an instance.

After a short while the instance will then recognise the new device and make it available via the OS.

I use Nextcloud as an alternative to Google Drive or iCloud. I self-host it on a VPS or Raspberry Pi and make it available only within my Tailscale network so that it is only accessible to my own authorised devices.

Nextcloud is relatively straight-forward to run using a docker-compose.yml file:

version: '3'

services:
  db:
    image: mariadb:10.5
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
    restart: unless-stopped
    volumes:
      - ./nextcloud-data/db:/var/lib/mysql
    environment:
      - MYSQL_ROOT_PASSWORD=CHANGEME
      - MYSQL_PASSWORD=CHANGEME
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud

  app:
    image: nextcloud:22
    restart: unless-stopped
    ports:
      - 8083:80
    volumes:
      - ./nextcloud-data/storage:/var/www/html

Bring the service up, navigate to the IP address or domain, and configure the instance to get started.

When browsing Twitter, I use a self-hosted Nitter instance. Nitter allows you to browse Twitter using a more privacy-respecting front-end.

To run Nitter, create a docker-compose.yml:

version: "3"

services:

  nitter:
    image: zedeus/nitter:latest
    ports:
      - "8085:8080"
    volumes:
      - ./nitter.conf:/src/nitter.conf:ro
    depends_on:
      - nitter-redis
    restart: unless-stopped

  nitter-redis:
    image: redis:6-alpine
    command: redis-server --save 60 1 --loglevel warning
    volumes:
      - ./nitter-redis:/data
    restart: unless-stopped

Simply bring up the service, navigate to the IP address or domain, and get started.

When browsing Reddit, I use a self-hosted Teddit instance. Teddit allows you to view Reddit using a nicer and more privacy-respecting front-end.

To run Teddit, create a docker-compose.yml:

version: "3"

services:

  teddit:
    image: teddit/teddit:latest
    environment:
      - REDIS_HOST=teddit-redis
    ports:
      - "8086:8080"
    depends_on:
      - teddit-redis

  teddit-redis:
    image: redis:6.2.5-alpine
    command: redis-server
    environment:
      - REDIS_REPLICATION_MODE=master

Simply bring the service up, navigate to the IP address or domain for the service, and you’re ready to go.

For managing and consuming RSS feeds, I use FreshRSS.

To run a FreshRSS instance, create a docker-compose.yml file:

version: "3"

services:
  freshrss:
    image: freshrss/freshrss
    environment:
      - "CRON_MIN=3,33" # Change this if you like
      - TZ=Europe/London
    volumes:
      - ./freshrss_data:/var/www/FreshRSS/data
      - ./freshrss_extensions:/var/www/FreshRSS/extensions
    restart: unless-stopped
    ports:
      - 8081:80

I run FreshRSS within my Tailscale network and so I do not bother with TLS certificates or a reverse proxy. If you do want to use one, look at the Traefik note.

Most of my personal services I run within my Tailscale network, and so I do not tend to bother with HTTPS (since provisioning TLS certificates for multiple services running on a single host via Tailscale is a pain).

However, for external services that need to be accessed publicly, I use Traefik as a reverse proxy and for managing and provisioning TLS certificates.

Running Traefik

Run Traefik using Docker. Create a docker-compose.yml file in a directory called traefik:

I use Umami for analytics on this website and a few other services that I run. I self-host Umami using Docker.

To start, create a docker-compose.yml:

version: '3'

services:

  umami:
    image: ghcr.io/mikecao/umami:postgresql-latest
    environment:
      DATABASE_URL: postgresql://umami:CHANGEME@umamidb:5432/umami
      DATABASE_TYPE: postgresql
      HASH_SALT: CHANGEME
    depends_on:
      - umamidb
    restart: always
    expose:
      - 3000
    networks:
      - traefik_net
    labels:
      - traefik.http.routers.umami.rule=Host(`CHANGEME`)
      - traefik.http.routers.umami.tls=true
      - traefik.http.routers.umami.tls.certresolver=myresolver

  umamidb:
    image: postgres:12-alpine
    environment:
      POSTGRES_DB: umami
      POSTGRES_USER: umami
      POSTGRES_PASSWORD: CHANGEME
    volumes:
      - ./sql/schema.postgresql.sql:/docker-entrypoint-initdb.d/schema.postgresql.sql:ro
      - ./umami-data:/var/lib/postgresql/data
    restart: always
    networks:
      - traefik_net

networks:
  traefik_net:
    external: true

HTTPS

Since Umami must be publicly-accessible (so it can measure analytics on public websites), it must also be served over HTTPS.

I use a self-hosted Monica instance to keep on top of birthdays and other useful/interesting notes about friends and family.

This note documents my setup.

Create a docker-compose.yml file:

version: "3.4"

services:
  monica:
    image: monica:latest
    depends_on:
      - monicadb
    environment:
      - APP_KEY=CHANGEME
      - DB_HOST=monicadb
      - APP_ENV=nonprod # See note below
      - APP_URL=http://CHANGEME
      - APP_TRUSTED_PROXIES=*
      - MAIL_DRIVER=smtp
      - MAIL_HOST=CHANGEME
      - MAIL_PORT=587
      - MAIL_USERNAME=CHANGEME
      - MAIL_PASSWORD=CHANGEME
      - MAIL_ENCRYPTION=tls
      - MAIL_FROM_ADDRESS=CHANGEME
      - MAIL_FROM_NAME=Monica
    volumes:
      - ./monica_data:/var/www/html/storage
    restart: always
    ports:
      - 8082:80

  monicadb:
    image: mysql:5.7
    environment:
      - MYSQL_RANDOM_ROOT_PASSWORD=true
      - MYSQL_DATABASE=monica
      - MYSQL_USER=homestead
      - MYSQL_PASSWORD=CHANGEME
    volumes:
      - ./mysql:/var/lib/mysql
    restart: always

Note on APP_ENV

When running with APP_ENV=production, Monica enforces HTTPS connections. I run Monica in my Tailscale network without TLS certificates, and so I run Monica in nonprod (which I made up) mode to allow this to work.