Syncloud: self-hosting without Docker and configs

Syncloud: How an Open Source Go Platform Solves Self-Hosting Pain Without Docker or Manual Configs

Syncloud isn’t just another UI wrapper for Docker. It’s a full-fledged operating platform for self-hosting, built from the ground up in Go and designed for reliability, isolation, and zero-configuration operation. It eliminates the biggest pain point of home servers: having to tweak Nginx configs every weekend, renew Let’s Encrypt certificates, and debug port conflicts after updates. Instead, it offers a single interface, out-of-the-box SSO, automatic routing, and over 40 apps ready to install with one click.

Architecture Without Compromises: Why Snap Instead of Docker

Syncloud rejects Docker as its primary container runtime—not out of ideology, but for technical reasons. Snap packages provide strict filesystem isolation, access control via security profiles, and atomic updates without downtime. Unlike Docker images, Snap packages in Syncloud include:

• Predefined interfaces (network, home, removable-media)—no manual --cap-add or --privileged
• Automatic service re-registration in systemd upon updates
• Built-in rollback mechanism: if a new app version fails to start, the system rolls back to the previous version in just 2 seconds

The platform’s backend is written in Go and consists of three key components:

• Platform Daemon—the core that manages application lifecycles, DNS settings, and certificates
• Web UI (Vue.js)—an admin panel with an app store, network settings, and status monitoring
• Snapd integration layer—an intermediary layer that converts installation requests into snap commands with the correct environment parameters

Nginx here isn’t just a reverse proxy—it’s fully managed: the config is dynamically generated each time an app is installed or removed, taking into account TLS mode (Let’s Encrypt or custom cert), SNI routing, and security headers (HSTS, CSP, X-Frame-Options). No manual edits to /etc/nginx/sites-enabled/—everything happens through the API.

How Authentication Works: Authelia + OpenLDAP in Production

A unified authentication system isn’t optional—it’s fundamental. Syncloud integrates Authelia as an intermediate proxy in front of all applications. Upon first login, users go through a centralized login form, and Authelia verifies credentials against the OpenLDAP backend. After successful authentication, a JWT token is issued and transparently passed in the X-Forwarded-User header to each application.

Importantly, the LDAP server isn’t used solely for authorization. It also manages:

• User groups (e.g., admin, media, dev)—with differentiated access to applications
• Attributes like mail, displayName, and sshPublicKey—for integration with email and Git servers
• Password policies (min-length, history, expiration)—via the slapd overlay ppolicy

This allows, for example, configuring access so that only members of the media group can access Jellyfin, while dev has access to Gogs and MeshCentral. Users enter their password once and gain access to all permitted services without needing to log in again.

Practical Installation: From SD Card to a Working Nextcloud

The deployment process is streamlined to the extreme. Here’s the actual sequence of steps on a Raspberry Pi 5 (64-bit):

• Download the official image syncloud-os_24.04_arm64.img.xz from syncloud.org
• Write it to a microSD card using dd or Balena Etcher
• Connect the PC to the network and power it on
• Wait 90 seconds, then open http://syncloud.local in your browser
• Create an account—this triggers the generation of a Let’s Encrypt certificate via ACME v2
• In the “App Store” section, find Nextcloud → click “Install”
• About 80 seconds later, you’ll see the link https://nextcloud.syncloud.local, already with a valid certificate and active SSO

During this process:

• Nginx automatically assigned port 8080 to the Nextcloud service (internal)
• Configured a location block with proxying and headers like X-Real-IP and X-Forwarded-Proto
• Added a user from LDAP to the Nextcloud database via a SCIM-like API
• Set up a cron job for regular certificate renewal

No docker-compose up -d, no certbot --nginx, no sudo systemctl restart nginx. Everything is done through the HTTP interface.

What Matters

• Syncloud is an OS-like platform, not a UI wrapper: it replaces the system init, package manager, and network stack
• Snap isolation ensures security and predictable updates—no risk of “breaking the whole system” when updating a single app
• Authelia + OpenLDAP deliver enterprise-grade SSO with support for groups, password policies, and attribute-based access
• Support for ARM64, amd64, and armhf means compatibility with Raspberry Pi, mini-PCs on Intel/AMD, and even older ARM servers (e.g., Scaleway C2)
• Fully open source (GPL-3.0), with no cloud dependencies: DNS, certificates, and authentication all run locally

Comparison with Alternatives: Where Syncloud Fits

| Criterion | Syncloud | YunoHost | CasaOS |

|----------|----------|----------|--------|

| Runtime | snapd | chroot + shell scripts | Docker |

| SSO | Built-in Authelia + LDAP | SSO via YunoHost SSO | None (only basic auth) |

| HTTPS | Let’s Encrypt / custom cert, auto-config in Nginx | Let’s Encrypt, manual enablement | Let’s Encrypt, requires manual reverse-proxy setup |

| Updates | Atomic, with rollback | Through apt + scripts, no guarantees | Via Docker Hub, no version control |

| Control | High level of abstraction, “platform with a voice” | Flexible, but requires Debian knowledge | Low level—just a UI on top of Docker |

For middle/senior developers, Syncloud is especially valuable because it doesn’t hide complexity—it structures it: all code is accessible, all interfaces are documented, and CI includes tests on real hardware (Raspberry Pi 4/5, x86 mini-PC). It’s not a “black box,” but a transparent system that can be audited, forked, and modified—while maintaining compatibility with the app store.

Scalability and Limitations

Syncloud isn’t positioned as a solution for thousands of users. Its sweet spot is between 1 and ~50 active accounts and up to 15 concurrently running applications. Tests show that on a mini-PC with an Intel N100 processor and 8 GB RAM, the following run stably:

• Nextcloud (with Collabora Online and full-text search)
• Jellyfin (real-time 1080p transcoding)
• Home Assistant (with 200+ devices)
• Gogs (with CI integration)
• Bitwarden + Authelia + OpenLDAP

Power consumption is 9–12 W under load, with no fan. For heavier scenarios (e.g., Plex with hardware transcoding or Matrix with 500+ users), an external server or clustering is required—which Syncloud doesn’t yet support. But for most home and small-office use cases, it strikes the perfect balance between simplicity and control.

— Editorial Team