Simple · Secure · Free forever
Self-host your homelab on the internet.
Selfie Proxy gives everything running at home — your NAS, your photo library, your Home Assistant dashboard — a friendly, secure address on the internet. Point one small server at your domain, connect your home network, and you're done.
Free and open source, forever.
The problem
Home internet was never built to be reached from outside.
It used to be easy to expose your homelab to the internet, but that doesn't work today: internet providers use CGNAT and shared addresses to protect consumers and save cost — and that's exactly why the thing you built at home stays stuck at home.
There are tools that solve this properly for a living: Cloudflare Tunnel, Tailscale, Pangolin, and others. They work well, but their setup and interfaces are designed for enterprise network engineers. Selfie Proxy instead focuses on usability and simplicity for the self-hoster.
Selfie Proxy is built for exactly one person: you, running your own stuff.
What you get
Everything a homelab needs.
Six things, each solving a real problem you've probably already hit.
One simple admin portal
Every homelab and every exposed app, managed from a single page — in light or dark, your call. A web form to fill in, not a config file to get right.
Authentication built in
The admin portal is protected out of the box, and a checkbox puts the same login in front of any app you expose. Separate user accounts add security too: everyone can reach the apps, only you can reach the portal.
Remote desktop and terminal, right in your browser
Open a homelab machine's desktop or command line from any tab. No VPN, no extra software to install.
Automatic certificates
Every app you add gets a real, auto-renewing HTTPS certificate the moment you save it. No certbot, no expired-cert surprises at 2am.
Add an app in seconds, from any homelab
Pick a subdomain, point it at your app's local address, save. Connect your house, a parents' house, a friend's rack — all from one portal.
Back up your setup, or move it to a new server
Every homelab, application, and static site, down to the files, in one ZIP you can restore anywhere. Other solutions lock this behind a paid enterprise plan.
What this isn't
Deliberately not for the enterprise
Selfie Proxy skips high availability, load balancing, role-based access, managed SaaS offerings, and auditing/enterprise compliance tooling. Those things matter for business continuity — and they're notoriously easy to misconfigure. For a homelab, they're just bloat waiting to bite you. If you're running this for a company, use a properly supported commercial product instead.
- No high availability and clustering
- No load balancing across replicas
- No role-based access control
- No managed, hosted SaaS offering
- No auditing and enterprise compliance
Questions
Before you install it
Is this actually secure?
Yes. Traffic between your homelab and the server always travels through an encrypted tunnel, to a server that's entirely under your own control rather than a third party's. Every exposed app gets HTTPS automatically, and the admin portal — optionally any app — is protected by a built-in login screen that automatically slows down repeated wrong-password attempts. It's open source, so the code is there for anyone to check.
Is this free?
Yes. Selfie Proxy is free and open source under the MIT license, usable in any environment, hobby or professional, without limitations. That said, if your business depends on it, you're probably better served by a supported enterprise solution — see "What this isn't" above.
Does it run on macOS or Windows?
The server needs Linux — it relies on Docker's host networking, which macOS and Windows don't support. The homelab agent has no such restriction: it runs fine in Docker's default bridge mode on macOS and Windows too, with one limitation — no local DNS server support, so you'll enter an IP address rather than a hostname when setting it up.
I already run NGINX at home with a valid certificate — can Selfie Proxy just use that?
No. Point Selfie Proxy directly at the web application itself, over HTTP or HTTPS with a self-signed certificate — not at the NGINX reverse proxy in front of it. Connecting straight to the application is what lets Selfie Proxy manage certificates for you automatically and protect the app with its own login, neither of which is possible if it's only forwarding to another reverse proxy.
See it in action
Selfie Proxy, in five screens
Every screenshot below is the real thing — no mockups.
Homelabs
See every home network you've connected — and whether it's actually online
A green dot means the tunnel is up right now. A red one means it isn't. No guessing, no SSH-ing in to check.
Remote desktop
Open a homelab machine's full desktop, right in the browser
No RDP client to install, no VPN to dial in first — just a tab.
Terminal access
Or skip the desktop — a real SSH session, in the browser
Type actual commands, see actual output. No terminal app to open, no key to copy around.
Edit application
Point it at an IP, pick HTTP or HTTPS, decide if it needs a login
That's the whole form. No YAML, no restarting a reverse proxy by hand to pick up the change.
Local websites
Serve a plain static site under your own domain
A homepage, a resume, a small landing page — hosted straight from the server you already pay for, no separate hosting bill. Or skip the files entirely and point the domain straight at another address you manage.
How it works
From zero to a public URL, in one afternoon
-
01
Point your domain at the server
Add an
Arecord for your domain and a wildcard*.yourdomain.com, both pointing at your server's IP. -
02
Download two files
docker-compose.yamland.env— that's the entire install package, both grabbed with a singlecurl. -
03
Fill in three values
Your domain, an admin username, and a one-time bootstrap password you'll be asked to change on first login.
-
04
Start it
docker compose -f docker-compose.yaml up -d. That's the install command. It's also the update command. -
05
Log in and connect your first homelab
Visit
selfieproxy.yourdomain.com, set your real password, and the portal walks you through the rest.
The parts list
What you actually need
Under the hood
One outbound tunnel. Nothing opened at your router.
For the curious: here's the whole connection, end to end.
One encrypted tunnel out. Everything else stays home.
Your server. Your domain. Your rules.
No account to create, no vendor to trust with your traffic. Just your own small server, doing exactly one job.