AltFreeStack
ESEN
Security

The Privacy & Personal Security Stack

Passwords, a private network, ad-blocking DNS and encrypted notes — the personal security kit to take control of your credentials, your network traffic and your browsing.

Combined minimum RAM

~2.3GB

Estimated savings

Full control over your credentials, DNS and encrypted browsing

Customize this stack in the Stack Builder →

Overlapping tools

  • Alternatives to each other for NextDNS: Pi-hole, AdGuard Home. You may only need one of them.

Tools in this pack (6)

Vaultwarden

Lightweight Rust Bitwarden server, a self-hosted alternative to 1Password.

Password Managers100% FOSS🟢 Lightweight · ~256MB
Alternative to 1PasswordAlternative to LastPassSQLite / MySQL / PostgreSQL
docker-compose.yml
version: "3.9"
services:
  vaultwarden:
    image: vaultwarden/server:1.37.3-alpine
    restart: unless-stopped
    ports:
      - "8080:80"
    environment:
      - DOMAIN=https://vault.yourdomain.com # CHANGE THIS TO YOUR DOMAIN (required for the web vault and apps to work correctly)
      - ADMIN_TOKEN=change-me-super-secret # REQUIRED: generate a random secret before first run
      - SIGNUPS_ALLOWED=false
    volumes:
      - vaultwarden_data:/data
volumes:
  vaultwarden_data:
View Vaultwarden's full profile
Headscale

Self-hosted coordination server compatible with Tailscale.

Auth & Identity100% FOSS🟢 Lightweight · ~256MB
Alternative to TailscaleSQLite / PostgreSQL
docker-compose.yml
# Headscale necesita un archivo config.yaml montado además de las
# variables de entorno — copia el config-example.yaml oficial antes de
# arrancar:
services:
  headscale:
    image: headscale/headscale:0.29.4
    restart: unless-stopped
    command: serve
    ports:
      - "8080:8080"
    volumes:
      - ./config:/etc/headscale
      - headscale_data:/var/lib/headscale
volumes:
  headscale_data:
View Headscale's full profile
WireGuard Easy

Web panel for your own WireGuard server, no command line needed.

Auth & Identity100% FOSS🟢 Lightweight · ~256MB
Alternative to NordVPN TeamsAlternative to OpenVPN Access ServerNone / File-based
docker-compose.yml
services:
  wg-easy:
    image: ghcr.io/wg-easy/wg-easy:15.4.0
    restart: unless-stopped
    environment:
      WG_HOST: vpn.yourdomain.com # CHANGE THIS TO YOUR DOMAIN
      PASSWORD_HASH: change-me-bcrypt-password-hash # REQUIRED: generate a random secret before first run
    volumes:
      - wg_easy_data:/etc/wireguard
    ports:
      - "51820:51820/udp"
      - "51821:51821/tcp"
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1
volumes:
  wg_easy_data:
View WireGuard Easy's full profile
Pi-hole

Network-wide DNS ad-blocking, an alternative to NextDNS.

Monitoring, Logs & Errors100% FOSS🟢 Lightweight · ~256MB
Alternative to NextDNSNone / File-based
docker-compose.yml
services:
  pihole:
    image: pihole/pihole:2026.09.0
    restart: unless-stopped
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "80:80"
    environment:
      TZ: UTC
      WEBPASSWORD: change-me-admin-password # REQUIRED: generate a random secret before first run
    volumes:
      - pihole_data:/etc/pihole
      - pihole_dnsmasq:/etc/dnsmasq.d
    cap_add:
      - NET_ADMIN
volumes:
  pihole_data:
  pihole_dnsmasq:
View Pi-hole's full profile
AdGuard Home

Network-wide DNS ad-blocking with native DoH/DoT, an alternative to NextDNS.

Monitoring, Logs & Errors100% FOSS🟢 Lightweight · ~256MB
Alternative to NextDNSNone / File-based
docker-compose.yml
services:
  adguardhome:
    image: adguard/adguardhome:v0.107.77
    restart: unless-stopped
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "3000:3000"
      - "80:80"
    volumes:
      - adguard_work:/opt/adguardhome/work
      - adguard_conf:/opt/adguardhome/conf
volumes:
  adguard_work:
  adguard_conf:
View AdGuard Home's full profile
Joplin

Cross-platform encrypted notes, a free alternative to Evernote.

Productivity100% FOSS🟡 Standard · ~1GB
Alternative to EvernoteAlternative to OneNotePostgreSQL / SQLite
docker-compose.yml
services:
  joplin-server:
    image: joplin/server:3.7.2
    restart: unless-stopped
    ports:
      - "22300:22300"
    environment:
      APP_BASE_URL: http://localhost:22300 # CHANGE THIS TO YOUR DOMAIN
      DB_CLIENT: pg
      POSTGRES_HOST: joplin-db
      POSTGRES_DATABASE: joplin
      POSTGRES_USER: joplin
      POSTGRES_PASSWORD: change-me-postgres-password # REQUIRED: generate a random secret before first run
    depends_on:
      - joplin-db
  joplin-db:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: joplin
      POSTGRES_PASSWORD: change-me-postgres-password # must match POSTGRES_PASSWORD above
      POSTGRES_DB: joplin
    volumes:
      - joplin_pg_data:/var/lib/postgresql/data
volumes:
  joplin_pg_data:
View Joplin's full profile
← View all stacks