I recommend that you look into nagios and zabbix before you get started. Both have free selfhosted open source solutions. And both are used professionally on the enterprise level so you even gain a skillset that can earn you money!

https://www.zabbix.com/download?zabbix=7.0
https://www.nagios.org/downloads/nagios-core/thanks/

(do we still call it that?)

Primary and secondary is what it is usually called today. I know both Microsoft and Cloudflare does at least.
https://www.cloudflare.com/learning/dns/glossary/primary-secondary-dns/

Check if you need a flag when starting it to bind 0.0.0.0 instead of 127.0.0.1

Depending on the use and the size of your graphics card you might be better of trying Gemma 4 12B too.
On my Nvidia 5060 Ti 16GB I can use either Gemma 4 A4B IQ3_M (larger model but highly compressed) or Gemma 4 12B Q8_0 (smaller model but much less compression) and after a night of testing with the Gemma 4 12B Q8_0 I’d say it’s a better helper when it comes to coding but a worse gm for my dnd inspired fantasy world roleplaying adventure.

I imagine your “setup a selfhosted environment” is closer to the first.

Easy setup would be to use koboldcpp + SillyTavern + Gemma 4 26B A4B GGUF of the largest quant your graphics card can fit together with your context.
Remember to setup SillyTavern to allow network connections and create a user and password, default installation is localhost only.
Set the temperature to 0.3 if using IQ3_M, higher quants allow higher temperature, and make sure all the formatting templates inside Advanced Formatting are set to Gemma 4.

Then use either Gemma 4 itself or the free google.com AI to create some “W++ Denze with Horizontal Lines summaries for Gemma 4” of the relevant documentation of the latest version of the home server apps your friends are gonna install.
You should ensure the resulting lorebook entries are no more than 1k tokens each to leave some context for your friends chats, add it to a character card in SillyTavern and set some keywords to allow them to load dynamically and not stay in context memory all the time.

Regarding the character card you can ask Gemma 4 to write that for you too, I find “Write a character card in W++ Denze with Horizontal Lines style for Gemma 4 with this name, personality, attitude and skillset” works well for that.
Then ask it to write a “First message prompt that starts with X, continues with Y and ends with Z for that character card” and you get a first draft to rewrite and paste into the “First Message” of the character card. The first message works as a template that Gemma 4 will imitate when you chat with it. Then simply try the chatbot out before letting others use it.

I find my own Gemma 4 26B A4B IQ3_M works well for practicing hiragana and katakana, discussing programming or troubleshoot existing code or writing a small function but it can’t be expected to write a correct DatabaseService.cs from scratch and stuff like that.

Oh and forget about finding good cards and lorebooks for SillyTavern use online, most users use it for NSFW Roleplaying chats. It is a very easy UI to use to create harnesses for your local LLM though.

There are ton of great selfhosted tools for tts and similar interfaces.
I used https://github.com/resemble-ai/chatterbox to make my own voice read my epubs, albeit with an american accent which I definitely don’t have in real life. It was close enough to put the voice in the uncanny valley according to my wife.

I think most end users will go for a cloud app or website for their needs though, playing around with self-hosting isn’t for everyone.

While it is a bit of work to rename the files that would still be my recommendation. I find jellyfin to be a great match for my anime that way.

The main thing I see you can avoid with locking down the docker images into a separate low permission user that can only access what they really need is if someone successfully attacks a project and you get infected with some shit when your Synology pulls image:latest.
It could limit the traversal of a ransomware that successfully breaks free of the container but ends up having no permissions outside as an example.
I would probably purge the whole NAS and setup from my backup for my own peace of mind even with the user separation though.

edit: updating “low user” to “low permission user”, amazing how the brain can fill in words for you when reading your own texts.

I mean unless specified otherwise most Synology container management dockers will run as root. With that said, if you want to secure things then there are guides.

An alternative path would be to setup a specific docker user and use docker compose to use that user when installing images
https://drfrankenstein.co.uk/step-2-setting-up-a-restricted-docker-user-and-obtaining-ids/

Jellyfin example
https://drfrankenstein.co.uk/jellyfin-in-container-manager-on-a-synology-nas-hardware-transcoding/

From there you could go further and use the guides above to create one user per docker image and give them different permissions depending on need.

Kinda the opposite, NAT Hairpinning allows you to use the external domain and public IP from the inside.
https://docs.opnsense.org/manual/how-tos/nat_reflection.html#reflection-and-hairpin-nat

Look into NAT hairpinning on your router/firewall and see if you can use the external ip. :)

The only thing I can think of then is to get your family members to start curating the photos into different albums using the Immich app. That way the sync gets to work and you get the usage statistics of the app up higher allowing the background task to run. If you create some shared albums and ask them to contribute photos to them f.e.
Or simply telling them about your shared album and getting them to check it out using the app.

After checking the german datacenter vps offerings I realize that Glesys can’t compete.

Have you tried keeping immich active for the initial large photo backup so that the background task backup only has the newly taken photos to take care off?
I imagine you’ve checked the Immich faq already:
https://docs.immich.app/FAQ/#why-is-background-backup-on-ios-not-working

Glesys (Sweden) has some affordable vps options.
https://glesys.com/products/compute-category-page/kvm-vps/

I usually end up doing it very simple with huge /24 ipv4 networks, f.e.
10.100.10.0/24 = VLAN 10 = User devices and purely internal servers
10.100.20.0/24 = VLAN 20 = IoT
10.100.30.0/24 = VLAN 30 = Servers that are reachable from outside
10.100.40.0/24 = VLAN 40 = Guests

The main thing for me is to ensure that traffic that wants to pass between VLANs go through my firewall/router and allow Suricata to do its IPS work.

If you want a webui for the debian server that gives you logs, services, ssh terminal and more then I can recommend checking out Cockpit
https://cockpit-project.org/

If you decide you want to you can install KVM/Qemu on the debian host to get into full virtualization that way. The webui can be used to configure and manage the VMs too with https://github.com/cockpit-project/cockpit-machines

edit: Cockpit also has a Docker manager, though I feel it isn’t full featured yet. I mostly used it to stop and start dockers from my phone.
https://github.com/chrisjbawden/cockpit-dockermanager

Now I can start throwing more stuff on there once I figure out backup for the game world incase I bork it.

Step 1. Find out where the docker image you run saves the volumes
F.e. https://github.com/mornedhels/icarus-server saves here:
Volumes
Volume Description
/home/icarus/drive_c/icarus Server config files and saves
/opt/icarus Game files (steam download path)

Step 2. Find a backup tool you like, f.e. https://docs.borgui.com/

Thanks for mentioning the game, saved it to my wishlist and hope to grab it for some co-op gaming come autumn. :D

Hah! Yes, that one!

I bet that if they added pavement for the user path then a new path that’s cutting the corner even more would emerge.