Simple · Secure · Free forever
Self-host your homelab on the internet.
Selfie Proxy gives everything running at home — your NAS, your photo library, your Home Assistant dashboard — a friendly, secure address on the internet. Point one small server at your domain, connect your home network, and you're done.
Free and open source, forever.
The problem
Internet Service Providers protect consumers from hackers
Internet Service Providers use Carrier-Grade Network Address Translation (CGNAT) to protect consumers from hackers accessing their devices directly. Unfortunately, this also means your homelab cannot be accessed from the internet.
There are tools that solve this properly for a living: Cloudflare Tunnel, Tailscale, Pangolin, and others. They work well, but their setup and interfaces are designed for enterprise network engineers. Selfie Proxy instead focuses on usability and simplicity for the self-hoster.
Selfie Proxy is built for exactly one person: you, running your own stuff.
What you get
Everything a homelab needs.
Six things, each solving a real problem you've probably already hit.
One simple admin portal
Every homelab and every exposed server, managed from a single page — in light or dark, your call. A web form to fill in, not a config file to get right.
Authentication built in
The admin portal is protected out of the box, and a checkbox puts the same login in front of any server you expose. Separate user accounts add security too: everyone can reach the servers, only you can reach the portal.
Remote desktop and terminal, right in your browser
Open a homelab machine's desktop or command line from any tab. No VPN, no extra software to install.
Automatic certificates
Every server you add gets a real, auto-renewing HTTPS certificate the moment you save it. No certbot, no expired-cert surprises at 2am.
Add a server in seconds, from any homelab
Pick a subdomain, point it at your server's local address, save. Connect your house, a parents' house, a friend's rack — all from one portal.
Back up your setup, or move it to a new server
Every homelab, server, and static site, down to the files, in one ZIP you can restore anywhere. Other solutions lock this behind a paid enterprise plan.
What this isn't
Deliberately not for the enterprise
Selfie Proxy skips high availability, load balancing, role-based access, managed SaaS offerings, and auditing/enterprise compliance tooling. Those things matter for business continuity — and they're notoriously easy to misconfigure. For a homelab, they're just bloat waiting to bite you. If you're running this for a company, use a properly supported commercial product instead.
- No high availability and clustering
- No load balancing across replicas
- No role-based access control
- No managed, hosted SaaS offering
- No auditing and enterprise compliance
Questions
Before you install it
Is this actually secure?
Yes. Traffic between your homelab and the server always travels through an encrypted tunnel, to a server that's entirely under your own control rather than a third party's. Every exposed server gets HTTPS automatically, and the admin portal — optionally any server — is protected by a built-in login screen that automatically slows down repeated wrong-password attempts. It's open source, so the code is there for anyone to check.
Is this free?
Yes. Selfie Proxy is free and open source under the MIT license, usable in any environment, hobby or professional, without limitations. That said, if your business depends on it, you're probably better served by a supported enterprise solution — see "What this isn't" above.
Does it run on macOS or Windows?
The server needs Linux — it relies on Docker's host networking, which macOS and Windows don't support. The homelab agent has no such restriction: it runs fine in Docker's default bridge mode on macOS and Windows too. Just use an IP address rather than a hostname when setting it up, because Docker's bridge networking on those platforms has no local DNS support.
I already run NGINX at home with a valid certificate — can Selfie Proxy just use that?
No. Point Selfie Proxy directly at the web server itself, over HTTP or HTTPS with a self-signed certificate — not at the NGINX reverse proxy in front of it. Connecting straight to the server is what lets Selfie Proxy manage certificates for you automatically and protect the server with its own login, neither of which is possible if it's only forwarding to another reverse proxy.
Are HTTPS certificates handled automatically, including subdomains?
Yes. Every exposed server, static website, and the domain itself gets a free, auto-renewing Let's Encrypt certificate the moment you add it — no certbot, no manual renewal, and a self-signed fallback keeps things working in the rare case Let's Encrypt is temporarily rate-limited.
Does the homelab agent need root access?
No. The agent container runs as a non-root user by default — confirmed against a real homelab — and you're free to use your own UID/GID instead. Only the server itself needs root, to bind low ports and manage the host's SSH.
Does Selfie Proxy register my domain and point DNS at the server for me?
No. You buy and manage the domain with any registrar you like, then point it at your server yourself — one A record for the domain, one for the wildcard subdomain. The admin portal's Domains page tracks the domains you've added and shows whether their DNS already resolves correctly, but it never creates or changes a DNS record on your behalf.
See it in action
Selfie Proxy, in five screens
Every screenshot below is the real thing — no mockups.
Homelabs
See every home network you've connected — and whether it's actually online
A green dot means the tunnel is up right now. A red one means it isn't. No guessing, no SSH-ing in to check.
Remote desktop
Open a homelab machine's full desktop, right in the browser
No RDP client to install, no VPN to dial in first — just a tab.
Terminal access
Or skip the desktop — a real SSH session, in the browser
Type actual commands, see actual output. No separate terminal program to open, no key to copy around.
Edit server
One server, up to four ways in: web, terminal, remote desktop, port forwarding
Turn on just the protocols this one needs — a website behind SSO, an SSH terminal, or both at once, like here. No YAML, no restarting a reverse proxy by hand to pick up the change.
Local websites
Serve a plain static site under your own domain
A homepage, a resume, a small landing page — hosted straight from the server you already pay for, no separate hosting bill. Or skip the files entirely and point the domain straight at another address you manage.
Get Started
Deployed within minutes
-
1
Point your domain at the server
Add an
Arecord for your domain and a wildcard*.yourdomain.com, both pointing at your server's IP. -
2
Configure your server's firewall
Open inbound ports 80, 443, and 22.
-
3
Download and configure
Download
docker-compose.yamland.env— that's the entire install package — then fill in your domain, an admin username, and a one-time bootstrap password you'll be asked to change on first login. -
4
Start it
docker compose up -d. -
5
Log in and connect your first homelab
Visit
selfieproxy.yourdomain.com, create a new admin password, and the portal walks you through the rest.
See the complete instructions at GitHub.
The parts list
What you actually need
Under the hood
One outbound tunnel. Nothing opened at your router.
For the curious: here's the whole connection, end to end.
One encrypted tunnel out. Everything else stays home.
Your server. Your domain. Your rules.
No account to create, no vendor to trust with your traffic. Just your own small server, doing exactly one job.