Best Self-Hosted Apps to Run at Home in 2026

Self-hosting means running software on a machine you control, such as a home server or a small VPS. This guide covers five young open-source apps: a feed reader, a calendar, a notes app, a monitoring tool and an SSH manager. For each we read the project's own documentation and list the install method, port, data folder, licence, backups and updates. Where a project does not document something, we say so.

Quick answer: pick one app, run it with Docker, put an HTTPS reverse proxy in front of it, and test a backup restore before storing anything you care about. These projects change quickly, so check the current docs.

Checked against the source on November 5, 2026. I re-checked the GitHub repository metadata for WyrmRSS, Catch, Beszel and Termix (none is archived) and, for Mitra, its project site. The licences match the table below.

• WyrmRSS: GPL-3.0; latest release v0.35.1 (October 24, 2026), newer than the 0.27 mentioned below
• Mitra: AGPL-3.0; the project site still shows v0.7.1 and says it is pre-1.0
• Catch: MIT; latest release v0.7.7 (November 2, 2026)
• Beszel: MIT; latest release v0.21.1 (October 22, 2026)
• Termix: Apache-2.0; latest release v26.11.0 (November 1, 2026)

How to choose

• One container: Mitra and Termix.
• More moving parts: WyrmRSS needs PostgreSQL plus two app containers; Catch needs PostgreSQL and a sync service.
• Agent per machine: Beszel.

1. WyrmRSS: self-hosted RSS reader

What it is: a feed reader with a Rust backend and React frontend. Version 0.27, per the developer, added a mobile interface and PWA install. The GitHub README confirms the licence is GPL-3.0.

Setup: the Docker docs give a Compose file with three services: postgres:18, ghcr.io/kryoseu/wyrm-server:latest and ghcr.io/kryoseu/wyrm-ui:latest. Save it as docker-compose.yaml and run docker compose -f docker-compose.yaml up. The web interface listens on port 3000 and the API server on port 3001. A desktop app with its own SQLite database needs no server.

Data and backups: the database lives in a named volume, wyrm_data, mounted at /var/lib/postgresql. The docs do not cover backups or updates. A standard PostgreSQL dump of the wyrm-db container is one route (our suggestion, not the project's), and OPML export gives you a second copy of your subscriptions.

Limits: the sample file uses the password wyrm for the database, so change it. WYRM_API_KEY is commented out in the sample, and the README says that if it is unset the API is open and any key is accepted. Set it.

Who it suits: people comfortable with PostgreSQL containers who want a phone-friendly reader. A read-only demo is at demo.wyrmrss.com.

2. Mitra: calendar that merges events and tasks

What it is: a calendar showing events and tasks together. The licence is AGPL-3.0. Our earlier article covered version 0.6; the project site now shows v0.7.1, with 0.8 marked as next.

Setup: the docs give this complete Compose file:

services:
  mitra:
    image: ghcr.io/a11delavar/mitra:latest
    restart: unless-stopped
    ports:
      - '3000:3000'
    volumes:
      - ~/mitra:/app/data

Run docker compose up -d and open http://localhost:3000.

Data and backups: everything is in the ~/mitra folder. The docs recommend stopping the container, running restic backup ~/mitra or tar czf mitra-backup.tar.gz -C ~/mitra ., then starting it again. Copying the folder while Mitra runs is usually fine, they add, because SQLite copes well.

Updates: run docker compose pull then docker compose up -d. Mitra never updates itself and migrates its database on start. You can pin 0.6 for fixes only, or an exact version such as 0.6.0. The docs warn that before 1.0 a new minor version can change things you rely on, so read the release notes first.

Settings worth knowing: set MITRA_URL to your public address. Reminders, app installation, secure cookies and Google Calendar redirects need HTTPS. MITRA_OIDC_ISSUER enables sign-in; enable it before others use the instance, because the docs say turning it on later resets everyone to an empty account. MITRA_UPDATE_CHECK and MITRA_MCP (the address AI tools connect to) are on by default and can be set to off.

Who it suits: one person or household wanting a single container. It is pre-1.0, and the developer says AI tools write much of the code.

3. Catch: notes in the style of Google Keep

What it is: a notes app with offline use, a PWA and an Android app. The repository (iiloni/catch) shows an MIT licence. It says the project is developed mainly with AI coding tools, and that outside contributions are not accepted at the moment.

Setup: the project site gives these steps, which download the Compose file and the environment template:

mkdir catch && cd catch
curl -fsSLO https://raw.githubusercontent.com/iiloni/catch/main/docker-compose.yml
curl -fsSL -o .env https://raw.githubusercontent.com/iiloni/catch/main/.env.example
chmod 600 .env

Fill in BETTER_AUTH_URL (your public address) and three secrets (BETTER_AUTH_SECRET, POSTGRES_PASSWORD, ELECTRIC_SECRET), each from openssl rand -hex 32. Then run docker compose up -d. The first account becomes the administrator. Registration is closed by default.

Data and backups: three volumes matter: postgres_data, attachment_data and backup_data. The guide suggests keeping backups on a different disk. Admins can back up and restore the whole server, attachments included, from Settings, with daily schedules. A command-line script (backup.sh create, list, restore) works even when Catch will not start.

Updates: ./update.sh backs up the database, pulls the new image, restarts and waits for a healthy status.

Reverse proxy: HTTPS is required (the Android app only connects over HTTPS), with HTTP/2 enabled. Set TRUSTED_PROXIES to your proxy's address, or the sign-in rate limit treats all visitors as the proxy.

Moving from Keep: export with Google Takeout, then use Settings, Data Management. The import is read on your device, and a repeat import skips notes already present.

4. Beszel: lightweight server monitoring

What it is: a hub (built on PocketBase) with a dashboard, plus agents. The licence is MIT. Its claim to be lighter than other tools is the project's own, with no figures given.

Setup: the quick start uses henrygd/beszel:latest for the hub, with port 8090:8090, APP_URL set to your hub address, and volumes ./beszel_data and ./beszel_socket. Create the admin account, click Add System, and copy the agent Compose file with its token and key. The agent image is henrygd/beszel-agent:latest. It uses host networking and mounts /var/run/docker.sock read-only for container stats. On the same machine, the hub reaches the agent through the shared socket /beszel_socket/beszel.sock; the agent's default port is 45876.

Data and backups: the hub's data is the beszel_data folder. Backups can be saved to disk or S3-compatible storage at /#/settings/backups in the hub, or you can stop the hub and copy the folder.

Updates: the quick start has no update section. Binary installs use ./beszel-agent update and ./beszel update.

Security: the install script needs root to create a beszel user, but the agent process does not run as root. Rootless containers cannot reach many host metrics, such as S.M.A.R.T. and GPU data.

5. Termix: SSH and server management

What it is: a self-hosted alternative to Termius with a plugin model. The repository states the licence as Apache-2.0, a detail our earlier article could not confirm.

Setup: the docs give this Compose file:

services:
  termix:
    image: ghcr.io/termix-ssh/termix:latest
    container_name: termix
    restart: unless-stopped
    ports:
      - "8080:8080"
    volumes:
      - termix-data:/app/data
    environment:
      PORT: "8080"
volumes:
  termix-data:

The docs list about 190 MB of RAM at idle, and for up to 1,000 hosts suggest 1 CPU core, 1 GB RAM and 5 GB disk.

Data and backups: all data sits in /app/data: the encrypted database (db.sqlite.encrypted), the keys in .env, plugins, certificates, recordings and pre-upgrade copies. Losing the volume means losing your hosts and credentials, and the database cannot be opened without the keys. Their recipe is to stop the container, archive the volume with tar in a throwaway Alpine container, then start it again. With PostgreSQL or MySQL, also back up the data folder for the keys.

Updates: back up, then docker compose pull and docker compose up -d.

Reverse proxy: the docs say a proxy needs WebSocket support, long timeouts because terminals sit idle, and no upload size cap. Caddy needs only reverse_proxy 127.0.0.1:8080 inside a site block. For nginx, the key lines are client_max_body_size 0;, the Upgrade and Connection headers, and read and send timeouts of 86400s.

Hosting location: the project advises a VPS, since a tool inside the network it manages is unreachable during an outage. It discloses sponsorship by GINERNET, whose VPS has a guide in the docs.

Comparison

A safe self-hosting baseline

1. Backups: follow each app's own method and store a copy on a different machine or disk. Back up secrets too: Termix keys, Catch's .env. Test a restore once, since an untested backup is unproven; Docker's volume documentation describes the same approach for testing restores.
2. Updates: latest tags move without warning. Pin versions where the docs allow it (Mitra does), back up before every update, and read release notes for pre-1.0 projects.
3. Reverse proxy with TLS: Caddy's documentation says it obtains and renews certificates for public domains automatically, as long as your DNS records point at the server and ports 80 and 443 are reachable. Mitra's example is two lines: mitra.example.com { reverse_proxy localhost:3000 }. For Beszel, the proxy must forward WebSockets, and APP_URL should be your public address.
4. Do not rely on the host firewall for Docker ports: Docker's documentation says published ports can bypass ufw rules, and that publishing ports is "insecure by default" because it listens on all addresses. If your proxy runs on the same machine, publish as 127.0.0.1:3000:3000 so only the host can reach the port.
5. Least privilege: keep registration closed (Catch's default), set WYRM_API_KEY, enable Mitra sign-in before inviting users, mount the Docker socket read-only as Beszel does, and replace sample passwords.
6. Monitoring: Beszel can watch hosts and containers and send alerts. The WyrmRSS sample also defines container healthchecks.

Who should skip it

• Anyone who needs a settled, 1.0 product. Mitra's site describes it as pre-1.0, and the other four projects also use 0.x or date-style version numbers that change quickly (see the release numbers above).
• Teams that cannot accept copyleft licences. WyrmRSS is GPL-3.0 and Mitra is AGPL-3.0, according to their repositories and site.
• Anyone who wants a large community. On November 5, 2026 the GitHub star counts were roughly 10 for Catch and 129 for WyrmRSS, against about 15,800 for Termix and 26,800 for Beszel.

Alternatives worth a look

• FreshRSS is an established self-hosted RSS and Atom reader, AGPL-3.0 licensed, an older option than WyrmRSS.
• Uptime Kuma is an MIT-licensed self-hosted monitor for HTTP, TCP, ping, DNS and Docker containers with notifications; it checks whether services are up rather than collecting host metrics through agents.
• Joplin is an open-source note-taking app for Windows, macOS, Linux, Android and iOS that syncs through Joplin Cloud, Dropbox or OneDrive, so it is not a self-hosted server like Catch.

Frequently asked questions

Is self-hosting free? The software is free. You pay for hardware or hosting, electricity and your own time on updates and backups.

Do I need a server at home? No. A home server or a small VPS both work. Termix's maker favours a VPS for tools you need when your home network is down.

Can I run all five on one machine? Nothing in the docs forbids it, but Mitra, Catch and the WyrmRSS UI all default to port 3000, so change the host side of one mapping (for example 3100:3000).

Which app should I try first? Mitra is the quickest to start: one container, one folder. WyrmRSS and Termix also have live demos.

Facts come from each project's repository or documentation, and makers' claims are attributed to them. We did not install or load-test any of these apps.

Sources

• github.com/kryoseu/WyrmRSS (README and docs/installation/docker.md)
• mitracal.com (home, /docs/, /docs/backups, /docs/updates/, /docs/configuration/)
• catchnotes.site, github.com/iiloni/catch and its DEPLOYMENT.md
• beszel.dev (getting-started, hub-installation, agent-installation, reverse-proxy) and github.com/henrygd/beszel
• github.com/Termix-SSH/Termix and docs.termix.site (install, Docker, backup, updating, reverse-proxy)
• caddyserver.com/docs/automatic-https
• docs.docker.com (packet-filtering-firewalls, port-publishing, storage/volumes)
• GitHub repository metadata and latest releases for kryoseu/WyrmRSS, iiloni/catch, henrygd/beszel and Termix-SSH/Termix, checked November 5, 2026
• freshrss.org, github.com/louislam/uptime-kuma, joplinapp.org

Related: Best Overleaf Alternatives for LaTeX: Self-Hosted and Local · Best Open Source Personal Finance Apps That Keep Your Data Local