Self-Hosting Weekly — August 15, 2026: Patch your stack, verify backups
This week has a theme, and it isn't subtle: patch things, then go check that your backups actually restore. Gitea shipped its second security release in a matter of days, someone published an honest postmortem of their homelab getting compromised, and a widely-upvoted thread reminded everyone that a nightly dd mirror is not a backup.
On the lighter side, Jellyfin 12.0 is closing in on stable, rsync jumped a major version, and RustDesk finally cracked unattended Wayland access. Let's get into it.
This Week's Highlights
Gitea v1.27.2 is a security release — patch it today. The v1.27.2 release notes lead with a SECURITY section covering fixes to collaborator access mode handling and httpsign. In plain terms: permission enforcement. If you run Gitea as the git server for a team, a home org, or a CI pipeline, that's the category of bug you don't sit on.
What makes this one worth flagging rather than filing under routine maintenance is the cadence. v1.27.1 also carried security fixes, which means this is the second security-tagged release in days for one of the most widely self-hosted Git servers in existence. Two in quick succession usually means someone is actively looking at a subsystem — and that the next finding may not wait for your monthly patch window.
Gitea instances have a habit of quietly accumulating trust: deploy keys, webhook secrets, CI tokens, mirrors of private repos. An access-mode bug in that position is worth an unscheduled restart.
A homelab postmortem worth your twenty minutes. Over on Lobsters, "My Homelab Got Hacked - A Postmortem" is exactly what it says: a detailed writeup from someone in the same position as most readers here — a self-run stack, exposed to the internet, that got compromised.
Postmortems from companies are useful but abstract; the blast radius and the tooling are nothing like yours. This one isn't. It's the rare writeup where the threat model, the budget, and the amount of spare time available to the operator all match the person reading it. If you've been meaning to audit what you actually have exposed, this is the nudge — the comment thread is worth a scroll too.
Jellyfin Server 12.0 RC5 is out. The fifth release candidate of the long-running 12.0 cycle landed this week. It's explicitly a preview release, aimed at people who want to test 12.0 before the final public release — not something to drop onto the box the household watches TV from.
But RC5 is roughly the point where test-migrating becomes worthwhile. The 12.0 cycle has been long, and the two things that reliably bite on a major Jellyfin upgrade are library metadata and plugins. Spin up a copy against a duplicate of your library now, find out which of your plugins haven't been updated, and you get to discover that on your schedule instead of during the GA weekend.
New Releases & Updates
- rsync 3.5.0 — A major-version bump carrying, per LWN, a huge number of security fixes; read the NEWS before it lands in your distro and silently changes a cron job's behavior. LWN coverage · release NEWS
- Nextcloud v34.0.3 — Simultaneous maintenance releases across all three supported branches (v34.0.3, v33.0.8, v32.0.14), which is the usual signal to update whichever line you're on. Release notes
- Home Assistant 2026.8.2 — Second patch of the 8.x cycle, cleaning up integration regressions including Teslemetry unit conversion for streamed tyre pressure and isolation resistance. Release notes
- Portainer 2.39.6 LTS — LTS patch for the default Docker management UI; check the documented known issue with invalid update-schedule dates on Async Edge environments before rolling it out to remote nodes. Release notes
- RustDesk unattended Wayland access — Now supports unattended remote access on Wayland including the login screen and multi-monitor setups, closing the biggest remaining gap for replacing TeamViewer on modern Linux desktops without falling back to X11. Discussion
- QEMU 11.1 — More than 3,200 commits from 285 authors; it's upstream for Proxmox, libvirt and most homelab virtualization, so skim it now for what arrives in your hypervisor in a few months. LWN coverage
Community Spotlight
The most instructive thread of the week is also the most painful: "Well, today I lost all my data." The setup was two disks — one for the OS and files, one as the backup — with a nightly dd copying everything across. The logic seems airtight: if one disk fails, switch to the other. The flaw is that a mirror has no memory. Whatever happens to the source at 11pm is faithfully reproduced on the destination by midnight, deletions and corruption included. There is no yesterday to go back to.
Redundancy answers exactly one question — what happens when a disk dies — and a nightly block-level copy answers it reasonably well. It does not answer the other three: what happens when you delete the wrong directory, when a filesystem quietly corrupts a file you won't open again for six months, or when something running on the box encrypts everything it can reach. Those failures all need history, and history is precisely what a mirror throws away by design.
The fix isn't exotic. Use a tool that keeps versions rather than one that overwrites, keep at least one copy somewhere the source machine can't write to, and — the step almost everyone skips — actually perform a restore. A backup you have never restored from is a hypothesis, not a backup.
The Takeaway
Two jobs this week, and neither takes long. Patch Gitea, then Nextcloud and Home Assistant while you're already in there. After that, pick one directory you would genuinely miss, restore it from your backups into a scratch location, and diff it against the original. If that goes badly, you've found this week's real project — and you've found it on a quiet afternoon instead of on the morning a disk dies.
