Hi,
Welcome to the first Self-Hosted Stack update. Thanks for subscribing.
This newsletter covers project updates across my self-hosted VPN and local AI open source projects. Self-Hosted AI Stack is the new name for the project previously called Docker AI Stack. I’ll keep these emails short and practical, focused on important fixes, safer defaults, deployment notes, and updated guides when there is something useful to share.
June highlights
The biggest VPN update this month is the move to Libreswan 5.3.1 for both the IPsec VPN Docker image and the Setup IPsec VPN project. Libreswan 5.3.1 is a security release that fixes three CVEs, so if you run one of the IPsec VPN projects, updating is recommended. The install and upgrade scripts now use 5.3.1, and the Docker IPsec images have been updated as well.
On the AI side, several services were hardened for safer self-hosting. Whisper, WhisperLive, Kokoro, Embeddings, and Docling now document generated API keys for fresh persistent installs, along with clearer guidance for reverse proxies, localhost binding, upload and request limits, logging, CORS, and rate limiting. The goal is simple: keep local services easy to run, but make them harder to accidentally expose without protection.
The Self-Hosted AI Stack also received a lot of deployment polish. AnythingLLM now starts password-protected on fresh installs, its environment is persisted more safely, PostgreSQL credentials are generated for new Compose deployments, LiteLLM health checks were improved, and stack-check.sh now covers more of the generated credential wiring. There is also a new troubleshooting guide and expanded backup and restore documentation covering generated keys, Caddy volumes, and the shared stack volume used for credentials.
A few service-specific fixes landed too:
Whisper now rejects unsupported OpenAI-only options more clearly, validates audio temperature values, limits upload size, and includes related test coverage.
Kokoro improved voice compatibility, fixed PCM output details, and now handles SSE WAV streaming correctly.
MCP Gateway now generates its MCPHub configuration using a real JSON encoder, with updated filesystem server setup and tests.
Headscale was updated to 0.29.1, and the docs now clarify registration by auth ID / node key.
There were also many documentation updates across the repos, including clearer upgrade steps, more accurate OpenAI-compatible API wording, better CUDA requirements, Podman notes, pgvector-backed RAG guidance, and standardized issue templates so bug reports include the details needed to reproduce problems.
Updated deployment guides
You can download the latest June versions of the deployment guides:
VPN Deployment Guide
IPsec/IKEv2, WireGuard, OpenVPN, and Headscale on bare metal and Docker.
AI Stack Deployment Guide
Ollama, LiteLLM, Whisper, Kokoro, and more.
These are the same guides offered as the welcome incentive, but several readers subscribed before the latest versions were ready. These guides are for subscribers’ personal use, so please don’t redistribute or republish them.
If you try the guides, I’d love to hear what was unclear, what worked well, or what you’d like covered next. Just reply to this email.
Thanks again for following the projects.
- Lin
Browse all projects: github.com/hwdsl2
Join the community: r/selfhostedstack