Self-hosted VPS with Pangolin

Configuration and documentation for running self-hosted services on a single VPS using Docker, managed through Dockge and exposed via a Pangolin reverse proxy with automatic HTTPS.

Prerequisites

• A VPS (tested on Hetzner CX33, which handles the load with ease, but any provider will work)
• A domain with a wildcard DNS A record pointing to the VPS
• Docker Engine and Docker Compose v2
• Basic familiarity with Docker and Linux

Services

Service	URL	Description
Pangolin	pangolin.example.com	Reverse proxy (Traefik + WireGuard tunnel)
Dockge	—	Docker Compose management UI
MariaDB	—	Shared database (internal only)
phpMyAdmin	pma.example.com	Database admin (behind Pangolin auth)
FreshRSS	rss.example.com	RSS reader
PostgreSQL	—	Shared database (internal only)
Redis	—	Shared queue/cache (internal only)
Linkwarden	linkwarden.example.com	Bookmark manager
Vaultwarden	vault.example.com	Password manager
Obsidian LiveSync	sync.example.com	CouchDB sync backend for the Obsidian Self-hosted LiveSync plugin (end-to-end encrypted)
Forgejo	git.example.com	Git forge (repos, issues, PRs) — SSH on port 2222
Woodpecker CI	ci.example.com	CI/CD with Codeberg integration (behind Pangolin auth)
Tuwunel	matrix.example.com	Matrix homeserver (federated)
Element Web	chat.example.com	Matrix web client
FreeScout	support.<client>.com	Help desk / shared inbox (one instance per client)
NanoClaw	—	AI agent — Matrix-driven, edits a site and pushes staging for Woodpecker to deploy (outbound only)
Postfix	—	Outbound SMTP relay (internal only)
Glances	monitor.example.com	System & container monitoring — real-time (behind Pangolin auth)
Beszel	monitor.example.com	System & container monitoring — historical + alerts (pick one)
Umami	umami.example.com	Privacy-friendly web analytics
Activepieces	automate.example.com	No-code/low-code workflow automation
Backrest	backrest.example.com	Restic backup web UI (behind Pangolin auth)
Renovate	—	Dependency bot — opens update PRs on Forgejo (outbound only)

Documentation

• INSTALL.md — Shared bootstrap (networks, Pangolin, Dockge, databases, Postfix) + index of per-service guides
• BACKUP.md — Backup strategy (restic + rclone to Nextcloud)
• MAINTENANCE.md — Recurring maintenance tasks and health checks
• AI.md — AI usage policy and security guardrails

Each service directory contains its own README.md with install steps, .env keys, and the Pangolin resource to add.

Repo structure

├── pangolin/       # Pangolin stack: docker-compose, Traefik config
├── dockge/         # Dockge compose file
├── backup/         # Backup script and config templates
├── matrix/         # Tuwunel + Element Web compose stack
├── forgejo/        # Forgejo Git forge compose stack
├── woodpecker/     # Woodpecker CI compose stack
├── vaultwarden/    # Vaultwarden compose stack
├── linkwarden/     # Linkwarden compose stack
├── obsidian-livesync/ # CouchDB backend for the Obsidian LiveSync plugin
├── postgres/       # Shared PostgreSQL instance
├── redis/          # Shared Redis instance (queue/cache)
├── freshrss/       # FreshRSS compose stack
├── freescout/      # FreeScout help desk (instance-per-client)
├── nanoclaw/       # NanoClaw AI agent (Matrix-driven, deploys via Woodpecker)
├── phpmyadmin/     # phpMyAdmin compose stack
├── mariadb/        # Shared MariaDB instance
├── glances/        # Glances system monitoring stack (real-time)
├── beszel/         # Beszel system monitoring stack (historical + alerts)
├── postfix/        # Outbound SMTP relay stack
├── umami/          # Umami web analytics stack
├── activepieces/   # Activepieces workflow automation stack
├── backrest/       # Backrest restic UI stack
├── renovate/       # Renovate dependency bot (one-shot, host cron)
├── INSTALL.md      # Step-by-step installation guide
├── BACKUP.md       # Backup strategy documentation
├── MAINTENANCE.md  # Recurring maintenance checklist
├── AI.md           # AI usage policy
└── .mcp.json       # Context7 MCP server (up-to-date library docs for AI tooling)