Pick self-hosted apps, get one working docker-compose file

Tick the apps, type your domain, and this page writes a docker-compose.yml with Caddy or Traefik in front for automatic HTTPS (plus the Caddyfile, or Traefik's labels inside the file), a .env with fresh passwords, and the settings each app needs behind a proxy. The files are built in this page and nothing is uploaded.

Your domain

Reverse proxy Caddy Traefik

Who can reach it

Anyone online; ports 80 and 443 forwarded.

Hardware

Apps with no image for it are marked and left out.

Apps each gets its own address on your domain

Tick at least one app to see the files.

docker-compose.yml

Caddyfile save as caddy/Caddyfile

No Caddyfile with Traefik. Its settings are the command list of the traefik service, and each app's route is the traefik.* labels on its web service, all inside docker-compose.yml above. What Traefik mode writes and leaves out.

.env passwords made in your browser

Setup notes per-app settings

BACKUP.md what to copy, the dump commands

Then, on your server

At your DNS provider, create these records, all pointing at the server's public IP address:
Type Name Value
On your router or cloud firewall, send TCP 80, TCP 443 and UDP 443 to the server. Caddy uses port 80 to prove to Let's Encrypt that it owns each name.
Fill in LAN_IP in .env; docker compose up refuses to start without it. Forward nothing on your router. Then trust Caddy's root certificate on each device, as the setup notes show.

Put the files in one folder and start everything:

mkdir -p ~/selfhost/caddy && cd ~/selfhost
# save docker-compose.yml and .env here, the Caddyfile in ./caddy/
# (if the browser saved .env as env or _env, rename it to .env)
chmod 600 .env
docker compose up -d
docker compose logs -f caddy   # watch the certificates arrive

mkdir -p ~/selfhost && cd ~/selfhost
# save docker-compose.yml and .env here (no Caddyfile with Traefik)
# (if the browser saved .env as env or _env, rename it to .env)
# in .env, set TRAEFIK_ACME_EMAIL to an address you read
chmod 600 .env
docker compose up -d
docker compose logs -f traefik   # watch the certificates arrive

Open each address straight away and follow its setup notes: several apps give admin rights to whoever opens them first.

Will it run on my machine? See whether the RAM and disk figures the apps publish fit a Raspberry Pi 4 or 5, a mini PC, an old laptop or a small VPS, and whether every image has a build for its CPU.

Check a compose file you already have. Paste your own docker-compose.yml and see what will break or is risky: a database open to the internet, :latest tags, secrets in plain text, port clashes, and for these 100 apps the data folders you forgot to mount. It runs in your browser; the file is never uploaded.

What the file does, and why a chat answer often gets it wrong

One proxy, no port clashes. Only the proxy (Caddy, or Traefik if you pick it) publishes web ports (80, 443 and 443/udp for HTTP/3). The only other ports in any file are the two that are not web traffic: 53 TCP and UDP for AdGuard Home's DNS and 51820/udp for wg-easy's WireGuard, each labelled with a # PORT OUTSIDE THE PROXY comment. The web apps publish nothing, so Jellyfin, Vaultwarden and Audiobookshelf can all listen on their own port 80 inside their containers without fighting over the host, and so can Forgejo and Grafana on 3000 or Miniflux and Stirling-PDF on 8080.
Names that never collide. Nextcloud and Paperless-ngx both call their database db; Immich and Nextcloud both call their cache redis. Every service, container, volume, folder and variable is prefixed with the app's name, and each database keeps its documented name as an alias on its app's private network, so the documented settings still find it.
An exact trusted-proxy address. The proxy network's subnet is pinned and Caddy has the fixed address 172.30.0.2, so the value written into TRUSTED_PROXIES (Nextcloud), IMMICH_TRUSTED_PROXIES, PAPERLESS_TRUSTED_PROXIES, FreshRSS's TRUSTED_PROXY, PHOTOPRISM_TRUSTED_PROXY, Jellyfin's Known proxies, Kavita's KnownProxies and Home Assistant's Trusted proxies is right, not a guess.
Host networking where the docs demand it. Home Assistant runs with network_mode: host as its install page shows; the proxy (Caddy or Traefik) reaches it through host.docker.internal and the notes give both the current Settings path and the older configuration.yaml lines.
One login in front of everything. Tick Authelia and every other app in the file gets a login check first: a forward_auth block in its Caddyfile site, or the authelia@docker ForwardAuth middleware on its Traefik router, both exactly as Authelia's own proxy guides write them. Authelia's configuration.yml and users file come with the rest, their secrets generated in your browser. What it adds.
Elevated access is labelled. Where an app's own docs ask for more than a plain container (Portainer's Docker socket, wg-easy's NET_ADMIN and SYS_MODULE, Frigate's privileged and shared memory) the file keeps it and says what it gives away in an # ELEVATED ACCESS comment.
No shared default passwords. Every database password and app key is generated in your browser with crypto.getRandomValues: 32 letters and digits for database passwords, 64 for the Paperless secret key.
Sourced line by line. Each app block starts with a # Source: comment for every official page it came from and the date it was checked, followed by a # Changed: list of every difference from the documented file beyond the name prefix.

What it does not do

Backups are a plan, not a service. BACKUP.md names every folder and volume the file mounts and gives each project's documented dump command for this file's service names, but nothing runs on a schedule: put the commands in cron or your backup tool yourself. The commands were read from each project's docs, not run against a live install, and where a project publishes no backup procedure (Actual Budget's server folder, Kavita, Syncthing, n8n, Ghost's Docker install, ntfy, changedetection.io) the plan says so and falls back to Docker's generic volume copy.
Home-only and VPN set-ups, but not the DNS for them. “Who can reach it” binds every published port to the server's LAN address (LAN_IP) or its Tailscale address (VPN_IP) instead of all interfaces, and Caddy then signs each name with its own local certificate authority, whose root you trust once per device (the notes give the steps for Windows, macOS, Linux, iPhone and Android; many Android apps still ignore a root you install yourself). Not covered: the DNS that makes a name like photos.home.arpa point at the server (no split-horizon DNS server is configured for you: use your router, AdGuard Home's rewrites or hosts files), installing Tailscale itself, a firewall for Home Assistant (with network_mode: host it listens on port 8123 on every interface whichever mode you pick), and publicly trusted certificates in Caddy, which would need a Caddy build with a DNS-provider module.
Checked for structure, not by running Docker. Automated tests build every app alone, all one hundred together and several pairs, and check that the YAML parses, only the proxy publishes web ports and the only other published ports are 53/tcp and 53/udp (DNS), 51820/udp (WireGuard), 1883/tcp (MQTT), 52000/udp and 52000/tcp (Neko's WebRTC), 1935/tcp (Owncast's RTMP) and 3334/tcp and 3334/udp (bitmagnet's BitTorrent), no host port is published twice (when Pi-hole and AdGuard Home are both picked, the one picked first keeps port 53 and the file says so), no names clash, every web app is on the proxy network, every Caddy site or Traefik router points at a real service and its documented port, and every variable is defined. Caddy mode is also checked to stay byte for byte what it was before Traefik mode existed. Nobody starts the containers in those tests.
Image tags follow the docs. Most apps are documented with latest, stable or a major tag, so a later docker compose pull can bring a new major version. Read each app's release notes before updating.
Two extra host ports, no more. AdGuard Home publishes 53 (TCP and UDP) for DNS and wg-easy 51820/udp for WireGuard, because neither is web traffic. Everything else that needs a port of its own is left out: Forgejo clones over HTTPS only (no SSH), Syncthing syncs through its outgoing connections and public relays (its port 22000 is not opened), and Frigate's RTSP and WebRTC ports are not published (its page says how to add them).
Single sign-on is a login wall, not OIDC. Authelia puts a password check in front of each app through the proxy, with users in a file and no e-mail server. It does not log you in to the apps themselves, and phone or desktop clients that talk to their server without a browser cannot pass it.
Hardware transcoding, GPU machine learning and SMTP mail are left out; each app's docs cover them.

Traefik mode: the labels written for you

Already run Traefik, or prefer labels to a Caddyfile? Choose Traefik next to the domain field. The apps, addresses, passwords and trusted-proxy address stay the same; only the proxy changes.

One traefik service on traefik:v3.7 (3.7 is the release Traefik currently supports), configured only with command flags: the Docker provider with exposedByDefault=false, so only containers labelled traefik.enable=true are routed; entrypoint web on :80 redirecting to websecure on :443 with HTTP/3; a Let's Encrypt resolver on the HTTP-01 challenge (the DNS challenge when you pick a home-only or VPN set-up), stored in /letsencrypt/acme.json in the traefik-letsencrypt volume, with the e-mail from .env. Traefik publishes 80, 443 and 443/udp; the only other ports in the file are AdGuard Home's 53 and wg-easy's 51820/udp when you pick them.
Labels on each app's web container: a router named after the app with Host(`cloud.example.org`), the websecure entrypoint and the certresolver, and a service whose loadbalancer.server.port is the app's documented internal port (80 for Nextcloud, 2283 for Immich, 8096 for Jellyfin, 3000 for Forgejo and Grafana). Every router, service and middleware name starts with the app's slug, so one hundred apps' labels cannot collide.
The same fixed address. Traefik gets 172.30.0.2, exactly where Caddy sits, so every trusted-proxy value in the file stays right. The proxy network gets the fixed name dankhost-proxy, because --providers.docker.network needs the real name and Compose would otherwise prefix it with the folder name.
The per-app proxy settings, translated. Nextcloud's two .well-known CalDAV/CardDAV redirects become one redirectregex middleware; Actual's and PhotoPrism's compression becomes a compress middleware; PhotoPrism's flush_interval -1 becomes responseForwarding.flushInterval=-1ms (a negative value flushes after every write); Syncthing's Host rewrite becomes passHostHeader=false. Vaultwarden's X-Real-IP needs no label: Traefik adds X-Real-Ip to every proxied request by default. Home Assistant keeps network_mode: host; for a host-networked container Traefik's Docker provider looks up host.docker.internal, which the extra_hosts entry provides.
No 60-second upload cut-off. Traefik v3 stops reading a request after 60 seconds by default (readTimeout), which would break long photo, video and file uploads to Immich, Nextcloud or PhotoPrism. The file sets it to 0, no limit, on websecure.

What Traefik mode does not do

No dashboard. Traefik's API and dashboard are not turned on and port 8080 is not published. If you want the dashboard, add it yourself behind authentication.
The Docker socket is mounted directly. Traefik reads the labels through /var/run/docker.sock, mounted read-only. Traefik's own documentation warns: “Accessing the Docker API without any restriction is a security concern: If Traefik is attacked, then the attacker might get access to the underlying host.” The :ro flag does not make the Docker API read-only. The same page lists ways to restrict it, such as a socket proxy or TLS or SSH access to the daemon; this file uses none of them.
HTTP-01 in public mode, the DNS challenge in private modes. With “Public domain” every name needs a public DNS record and port 80 reachable from the internet. With “Home network only” or “Over a VPN” nothing is reachable from outside, so Traefik uses Let's Encrypt's DNS challenge instead: that needs a real domain at a DNS provider Traefik supports and an API token for it (the file is set up for Cloudflare's CF_DNS_API_TOKEN; other providers need their own variables), and the builder refuses a local name such as home.arpa. The certificate names show up in public Certificate Transparency logs. No wildcard certificate in either mode.
It does not join an existing Traefik. It starts its own Traefik on ports 80 and 443. If one already runs, copy the labels: blocks onto your services and change the network and resolver names to yours.
No TCP or UDP routes. As in Caddy mode, nothing but HTTPS goes through the proxy: no Forgejo SSH, no Syncthing port 22000.

Every Traefik setting above comes from Traefik's official documentation, fetched on the date shown:

Traefik docs: Setup on Docker (traefik:v3.7 image, static configuration as command flags, HTTP to HTTPS redirection, a named proxy network) checked 2026-09-24
Traefik docs: Releases (3.7, released 2026-05-05, is the release in active support) checked 2026-09-24
Traefik docs: Docker provider (exposedByDefault, network, Host networking, Docker API Access security note) checked 2026-09-24
Traefik docs: EntryPoints (http.redirections, http3, transport.respondingTimeouts.readTimeout default 60s) checked 2026-09-24
Traefik docs: ACME certificate resolver (email required, storage, httpChallenge on the web entrypoint, 'Redirection is fully compatible with the HTTP-01 challenge') checked 2026-09-24
Traefik docs: Exposing services on Docker, advanced (Let's Encrypt storage at /letsencrypt/acme.json in a mounted volume) checked 2026-09-24
Traefik docs: Docker routing labels (traefik.enable, routers, services, middlewares, traefik.docker.network) checked 2026-09-24
Traefik docs: FAQ, the forwarded headers (X-Forwarded-For, X-Real-Ip, X-Forwarded-Proto ...) Traefik adds by default checked 2026-09-24
Traefik docs: Exposing services, WebSocket supported out of the box checked 2026-09-24
Traefik docs: RedirectRegex middleware (regex, replacement, permanent; dollar signs doubled in labels) checked 2026-09-24
Traefik docs: Docker provider, Host networking (host.docker.internal lookup) checked 2026-09-24
Traefik docs: Compress middleware (encodings zstd, br, gzip) checked 2026-09-24
Traefik docs: HTTP service load balancer (passHostHeader is true by default) checked 2026-09-24
Traefik docs: static configuration options (serverstransport.insecureskipverify, used only when Frigate is picked, to accept its self-signed certificate on 8971) checked 2026-09-26
Traefik docs: Headers middleware (customRequestHeaders) checked 2026-09-29

The one hundred apps and where each definition comes from

Every page below was fetched on the date shown and the compose definition was copied from it, not written from memory. Each app also has its own page with the RAM, CPU and disk figures its project publishes and the compose file for that app alone.