Cluster · 1 projects
obacht
Self-hosting is often named as a way out of the platform economy: running the software one uses on one's own hardware instead of renting it from a provider. In practice, however, this has so far remained reserved for a rather small and technically versed group, since besides the actual application it requires knowledge of Linux, containers, DNS, certificates and the configuration of one's own router. But what if this effort were not shifted onto the users, but taken over by the infrastructure itself? obacht builds on the approaches of previous self-hosting projects and develops them further into a platform which makes hardware that already exists in households and organisations reachable from anywhere, without the operator of this infrastructure having to be trusted.
Over the past two decades, the way we use software has fundamentally changed. Where software used to be bought once and installed on one's own computer, it is nowadays mostly rented as a subscription and runs in the data centres of a few large providers. Our data therefore no longer lies with us but with the respective provider, and the conditions under which we have access to it can change at any time.
The current debate on digital sovereignty often answers this with a switch from US-based to European providers. This is certainly a step in the right direction, but only half of the way: the data is still stored in someone else's data centre, just under a different jurisdiction.
buying, renting, browser, data centre, self-hosting
the status quo of self-hosting
The obvious alternative is to host the respective software oneself. Projects such as Nextcloud, Vaultwarden or Ghost are freely available for exactly this purpose. Nevertheless, according to the community's own surveys, more than 80 percent of the people who self-host work in tech. And let's not kid ourselves: this is rarely due to the software itself, but to everything around it.
Anyone who wants to make, for instance, their own cloud storage at home reachable from the outside currently has to set up a Linux system on a suitable computer, install a container runtime and keep it up to date, register a domain and point its DNS records to their own connection, request TLS certificates and renew them regularly, and finally configure a port forwarding in the router. The latter often does not work at all, since most private internet connections have no static IP address and many mobile and fibre providers place their customers behind a carrier-grade NAT. Although each of these steps can be solved individually, in sum they result in a hurdle which most people will never take—and even for those who do, hosting at home usually means a considerable amount of maintenance in the evenings.
obacht therefore takes a different approach. Instead of expecting users to acquire this knowledge, the platform takes over the operational part between the device and the software: installation, updates, certificates and remote access. The complexity is not removed, but hidden behind a simple interface, and can be unfolded again in an advanced mode by anyone who wants to understand what is happening underneath.
terminal, containers, certificates, router
device, apps, encryption, address
building on what already exists
A central idea of obacht is not to introduce new hardware, but to use what is already there: a Raspberry Pi that has been lying in a drawer since the last tinkering project, an old laptop that no longer receives updates for Windows 10, a retired office PC, or the Mac that is switched on anyway. Giving these devices a second life as a small server does not only save costs, but also resources, as it extends the life cycle of hardware that would otherwise end up as e-waste.
The project originated in a tool for monitoring and maintaining media art installations, in which small computers like the Raspberry Pi run unattended in exhibitions over long periods of time and have to be reachable remotely. Technically, obacht picks up the approach that was already explored within selfhost your way out: a cloud host with a static IP address, to which the devices at home connect via a WireGuard tunnel, so that neither a static IP address nor a port forwarding in the router is required. What was a functional prototype at that time, set up and operated by hand for every single device, is now being developed further into a platform that can be used without prior technical knowledge.
trust through architecture
If a platform establishes connections into people's homes, the question arises to what extent its operator has to be trusted. The aim of obacht is that this trust is not necessary in the first place, apart from the function of forwarding traffic. Every connection is established by the device itself, so no ports have to be opened at home. Incoming requests are routed by the gateway based on the requested domain only, without their content being decrypted, since the TLS certificates are issued and stored on the device itself and not in the cloud.
In addition, every change to a device, be it installing an app or binding a domain, is signed in the browser with a personal device key and verified by the device itself before it is executed. Should the platform be compromised at some point, it would at worst be able to interrupt connections, but neither read their content nor control the devices. Whether this holds up in every detail still has to be validated by an external audit, which has not taken place yet.
connections between visitor, obacht cloud and device
giving back to open source
Almost all apps that can be self-hosted are free and open source software, which is often maintained by small teams or single developers. Many of these projects finance themselves through a hosted cloud version of their own software. If more people host this software themselves, exactly this source of income is lost. More self-hosting should therefore not result in less funding for the people who develop the software in the first place.
For this reason, obacht forwards a fixed amount per running app to the respective project, via the funding channels the project itself offers, such as GitHub Sponsors, Open Collective or Liberapay. Projects without such a channel are not charged at all. This is not meant as a call for donations, but as a mechanism that is part of the infrastructure itself. The payouts will start with the official public launch; during the current pilot phase, they are not yet active.
outlook
obacht is currently being tested in a closed pilot phase with invited users and students. The next steps lead from individual devices to shared ones: so-called spaces, in which associations, small teams or educational contexts share a device and its apps with a common login. In the long run, an open registry is intended to allow open-source projects to reach people far beyond the technical communities in which they emerged.
Obacht
obacht is a platform that turns hardware which already exists, such as a Raspberry Pi, an old laptop or a Mac, into a server that is reachable from anywhere. Open-source applications can be installed from a signed catalogue, each of them receiving its own encrypted web address, without having to configure the router, containers or a terminal.
obacht consists of four parts: a small agent running on the respective device, a web app through which the devices are managed, a native app for macOS, and a gateway in the EU through which the devices are reachable from the outside. Together they take over the parts of self-hosting which otherwise require an administrator: installation, updates, certificates and remote access.
The following describes the main processes as they appear in the default easy mode, as well as what happens in the background along the way. Since obacht is currently in a closed pilot phase, some of the details may still change.
both main flows in easy mode
connecting a device
Supported are Raspberry Pis, Linux machines such as old laptops or mini PCs, and Macs with Apple silicon. After choosing the type of device and giving it a name, a personal device key is created once in the browser and protected with a passphrase. This key never leaves the browser and is used to sign all later changes to the device. The device in turn only accepts changes that are signed with exactly this key.
How the agent gets onto the device depends on the hardware. For a Raspberry Pi, a set of prepared files is copied onto a freshly flashed SD card, so that neither SSH nor a terminal is necessary. A Linux machine is connected with a one-time install command, which remains valid for seven days. On a Mac, a native app is installed, which runs the hosting environment in a lightweight Linux VM and connects itself via the browser. In all cases, the device then establishes an outbound connection to obacht and shows up in the dashboard after a few minutes.
Raspberry Pi setup via SD card
installing an app
The catalogue currently contains more than sixty open-source applications in seven categories, ranging from personal cloud storage and password managers to websites, collaborative tools, design software and local language models. Each of these apps is described by a manifest, which is signed by the registry and pins the exact versions of the container images used. Should a manifest be altered on its way, the device would refuse the installation.
The installation itself comes down to a few decisions on a single page: on which device the app should run, under which address it should be reachable, and a few settings such as an admin password, which are prefilled where possible. After unlocking the device key, the installation is signed in the browser and passed on to the device by the API, which itself only relays it. The device checks the signature, installs the app and reports back every step, from reserving the address to issuing the certificate. At the end, the app is reachable under its own address and can be opened on a smartphone via QR code.
addresses
Every app gets its own web address, which is composed of the name of the app, the username and the obacht domain, for instance nextcloud.demo.obacht.space. Alternatively, apps can be published under one's own domain, either as a single address via an A record, or as a whole protected zone, which is verified once via a TXT record and can then be used for any number of apps. In all cases, the certificate is issued directly on the device via Let's Encrypt, so that the gateway only sees the name of the requested address, but not the content.
easy and advanced mode
The interface comes in two modes. The easy mode uses plain language and is oriented towards the logic of an app store: apps instead of templates, web addresses instead of domains, a device key instead of SSH keys. The advanced mode in turn shows what lies underneath, such as services, events, logs, monitoring, the raw templates, a file browser and a terminal in the browser. The idea here is not to hide the complexity, but to make it unfoldable step by step for those who want to understand what is happening on their device.
advanced mode
the mac app
On macOS, obacht runs as an app in the menu bar. The apps themselves run inside a bundled Linux VM, while local language models via Ollama run natively on the graphics chip of the Mac, which would not be possible inside the VM. The menu bar shows whether everything is running and how much traffic has been used, and allows pausing the device; the app window lists the apps hosted on the Mac together with their addresses. In addition, a domain can be bound to a local port, so that, for example, a development server on the Mac becomes reachable under a real address.
The following screen recording shows the whole process on a Mac mini in about two and a half minutes: from signing in and connecting the Mac, to installing a local language model including Open WebUI and chatting with it under its own address, to publishing a Ghost website from the same machine.
tech stack
The following part is rather aimed at a technically versed readership.
The agent on the devices is written in Go and runs as a single static binary, which stores its state in SQLite and regularly compares the desired with the actual state of the device. On the cloud side, several NestJS services handle the API, the WireGuard network, SSH access and the gateway. The gateway uses nginx with the ssl_preread module to forward incoming traffic based on the requested domain into the respective WireGuard tunnel, without being able to decrypt it; TLS only terminates in Caddy on the device itself. The web app is built with Next.js, the macOS app with SwiftUI, and the whole infrastructure is hosted in Germany.
Three paths run through the system: visitors accessing an app hosted on a device, owners sending signed changes to their device and, in advanced mode, an SSH connection to the device. None of these requires an open port at home, and at no point does the platform hold a key that would allow it to read the traffic of an app or to act on a device on its own.
connection paths: visitor, owner, SSH
tech stack overview
limitations
It should be emphasised that obacht is neither a backup solution nor does it promise availability. If the device at home is switched off or its internet connection fails, the apps hosted on it are not reachable either, and the data lies only on this one device. The described security architecture has been designed with care, but has not yet been validated in depth by an external audit. Until the public launch, obacht is therefore to be understood as a pilot, and not as infrastructure for particularly sensitive data.
Associated material
Publications, talks and further reading connected to this cluster.
selfhost your way outcluster · 2020–
A central paradox of digital infrastructure in the age of platform economies is this: while the internet was originally conceived as a decentralized networked medium, today's digital everyday life is dominated by centralized providers offering proprietary services. The loss of digital sovereignty affects not only individuals but especially smaller organizations—such as associations, NGOs, or cultural institutions—that often lack the resources and expertise to operate their own infrastructures. Selfhost your Way out explores how decentralized different aspects of hosting solutions can remain viable even under restrictive conditions.
- obacht.dev
- docs.obacht.dev
- demo video