guide self-hosting tutorial

The Complete Guide to Self-Hosting in 2026

Everything you need to know about self-hosting your applications — from choosing services to exposing them safely.

HomeGate Team ·

Self-hosting gives you full control over your data and services. This guide covers everything you need to get started — especially how to expose your services to the internet safely.

Why Self-Host?

  • Privacy — Your data stays on your hardware
  • Control — Customize everything to your needs
  • Cost — Often cheaper than SaaS subscriptions at scale
  • Independence — No vendor lock-in, no ToS changes
ServiceWhat it doesDefault Port
JellyfinMedia streaming (movies, TV, music)8096
ImmichPhoto & video backup (Google Photos alternative)2283
NextcloudFile sync, calendar, contacts443
OllamaLocal AI/LLM inference server11434
VaultwardenPassword manager (Bitwarden compatible)8080
Home AssistantSmart home automation8123
GiteaSelf-hosted Git (GitHub alternative)3000

The Challenge: Exposing Services

Running services on your home network is easy. Making them accessible from outside is where it gets complicated:

The Traditional Way (Hard)

  1. Get a static IP or set up dynamic DNS
  2. Configure port forwarding on your router
  3. Set up a reverse proxy (nginx, Caddy, Traefik)
  4. Get SSL certificates (certbot, Let’s Encrypt)
  5. Configure a firewall
  6. Set up DDoS protection
  7. Hope your ISP doesn’t block ports or use CGNAT

The CGNAT Problem

Many ISPs now use Carrier-Grade NAT (CGNAT), which means you share a public IP with other customers. Port forwarding simply doesn’t work. Traditional self-hosting guides fall apart at step 2.

The HomeGate Way (Easy)

  1. Sign up for HomeGate
  2. Install Tailscale on your home server
  3. Add your service in the dashboard
  4. Your service is live with HTTPS

No port forwarding. No static IP. No nginx config. Works behind CGNAT.

How HomeGate Works

HomeGate is a reverse proxy that connects to your home server via Tailscale:

Internet → HomeGate Proxy (SSL + DDoS protection) → Tailscale Tunnel → Your Home Server

Your home IP is never exposed. Visitors connect to our infrastructure, and we securely tunnel the traffic to your services.

Custom Domains

Every service gets a free *.homegate.sh subdomain. To use your own domain:

jellyfin.example.com  CNAME  your-id.homegate.sh

SSL certificates are provisioned automatically. No certbot, no renewal scripts.

Security Best Practices

Even with HomeGate handling the proxy layer, good security hygiene matters:

On Your Home Server

  • Keep your OS and Docker images updated
  • Use strong passwords for all services
  • Enable 2FA where supported (Nextcloud, Vaultwarden, Gitea)

In HomeGate

  • Use IP allowlisting to restrict access to known IPs
  • Use header authentication for services that support it
  • Monitor bandwidth for unusual activity

Getting Started

The fastest path from zero to a publicly accessible self-hosted service:

  1. Create a HomeGate account
  2. Install Tailscale: curl -fsSL https://tailscale.com/install.sh | sh
  3. Add your service in the dashboard (name + port)
  4. Connect with the auth key HomeGate provides
  5. Access your service at https://your-id.homegate.sh

You’ll be live in under 5 minutes.

← Back to blog