A quieter week on paper, but the top item is one you should act on rather than read: Gitea has a security patch out. Below that, a genuinely rare artifact — a 10,000-mailbox university email migration onto self-hosted Stalwart — and the first real signal that Nextcloud 35 is approaching. Then the usual maintenance train: Traefik, Home Assistant, and a new Go toolchain that will quietly reshape half your container images over the next few months.

This Week's Highlights

Gitea v1.27.2 leads with a SECURITY section. The release notes open with a security block whose first entry is a fix to collaborator access mode and httpsign — in other words, access control on repositories. The release is live on GitHub.

Why this one jumps the queue: Gitea is the default self-hosted Git forge in most homelabs, and for a lot of people it is also the thing holding their infrastructure-as-code, their Docker Compose files, and their deploy keys. A bug class that touches who counts as a collaborator and how signed HTTP requests are validated is not a "next maintenance window" upgrade. If you run Gitea behind a reverse proxy with any external exposure at all, pull the new tag today.

Worth noting the timing, too: this lands in the same week as Go 1.27, and Gitea is a Go binary. Expect the usual staggered rebuild cycle across the Go-based self-hosting stack over the coming months.

Modern server rack with blue lighting in a secure data center environment.
Modern server rack with blue lighting in a secure data center environment.

Someone moved a university's email off IceWarp to Stalwart — and wrote it up. The numbers in the r/selfhosted post: 10,000 mailboxes, roughly $70k/year in IceWarp licensing before the move, and a claimed ~90% cost reduction after.

Self-hosting email is the one thing this community reflexively tells you not to do, and the advice is usually right — deliverability, reputation, and spam handling are genuinely hard problems that don't yield to a good Compose file. Which is exactly what makes a production writeup at this scale worth your attention. This isn't a homelab anecdote about running your own MX for three addresses; it's an operations report from an institution with real users who will file real tickets. If you've been curious about Stalwart as a modern all-in-one mail server, this is the most credible datapoint the sub has produced in a while. Read the operational details, not just the cost headline.

Nextcloud 35 reaches beta3. The beta3 tag is up, which means the next major is moving through its release cycle toward stable.

The practical read for admins: this is your lead time. Nextcloud majors are historically where third-party apps break, and the gap between "beta on GitHub" and "my users are complaining" is entirely made of testing you either did or didn't do. Spin up a copy against your actual app set now rather than discovering the incompatibility on upgrade day. If you're on the current stable branch, the update you'll actually apply this week is further down.

New Releases & Updates

  • Nextcloud v33.0.8 — maintenance release on the current stable branch, which is where most production installs sit. Release notes
  • Home Assistant 2026.8.2 — second patch of the August cycle, including a Teslemetry fix converting streamed tyre pressure and isolation resistance to their declared units. Release notes
  • Traefik v3.7.11 — bug fixes in the fastproxy layer, notably rejecting out-of-range status codes returned by backends. If Traefik fronts your whole stack, proxy-layer correctness is everyone's problem. Release notes
  • Go 1.27 — new toolchain release with a batch of new tooling; it'll propagate into Gitea, Traefik, Caddy, Syncthing and Tailscale images over the coming months. LWN's writeup
  • Meelo v3.12.0 — a music server that leads with UI and metadata handling, the perennial complaint in a space otherwise dominated by Navidrome and Jellyfin. Announcement thread
Close-up of a computer screen displaying an authentication failed message.
Close-up of a computer screen displaying an authentication failed message.

Community Spotlight

The thread worth your time this week is "Is adding a first auth layer a good idea?". The poster runs Caddy as a reverse proxy so only one port is exposed, with each subdomain routing to a different Docker app — Gitea, Immich, Home Assistant, Mealie — and notes that all of those apps already ship their own authentication. The question is whether to put an additional gate in front of everything anyway. It's the exact decision every self-hoster runs into the moment they open a port, and it's the kind of concrete, named-stack question that tends to draw better answers than the generic "just use a VPN" reply. If you've been putting off a decision about forward auth, this is a useful set of arguments to read before you commit to one.