The XDA piece making the rounds this week makes an unfashionable case: self-host what you can, but keep paying for a short list of cloud services that a home rack genuinely cannot replace. It is a healthy correction to the maximalist self-hosting posts. Some jobs are better done by someone with a redundant power grid, a real anycast network, and a working out-of-band route to your data when your Proxmox host is on fire. We looked at the best cloud services for a home lab in 2026 and picked seven that keep earning the line item, even after you have moved Immich, Jellyfin, Nextcloud, and the rest onto your own hardware.
The seven below are the ones that survive an honest cost-of-time audit. Each replaces a self-hosted piece that either fails at the wrong moment (email deliverability, offsite backup, uptime probes), needs infrastructure you cannot practically own (anycast DNS, a public edge in front of a residential IP), or is the exact escape hatch you need when the home lab itself is unreachable.
What to look for in a cloud service that pairs with a home lab
Not every SaaS deserves a slot. The picks below all share a short list of properties:
- The failure mode is off-site. If a lightning strike takes out the rack, the service still answers. That rules out anything that lives entirely inside your LAN.
- Standard protocols, exportable data. IMAP, S3, WireGuard, DNS-over-HTTPS, Git. If the vendor disappears, you migrate in an afternoon, not a quarter.
- A meaningful free or personal tier. Paying is fine, but the free tier tells you whether the vendor still cares about individuals and homelabbers, or has fully pivoted to enterprise.
- Boring reliability over feature volume. For an email host or a backup target, we would rather read a five-year uptime history than a shiny AI feature reel.
- Composes with your stack. Bonus points if the service is designed to sit next to Docker, Proxmox, restic, or Traefik rather than replace them.
Quick comparison
| Service | Best for | Platforms | Free plan | Starting price |
|---|---|---|---|---|
| Fastmail | Reliable hosted email with custom domains | Web, Windows, macOS, Linux, mobile | 30-day trial | Individual around $6 per month |
| Backblaze B2 | Cheap offsite object storage for restic and Kopia | Any S3-compatible client on Windows, macOS, Linux | 10 GB free | Around $6 per TB per month |
| Cloudflare | DNS, tunneling, and a public edge for home services | Web dashboard, cloudflared on Windows, macOS, Linux |
Generous free tier | Free for the parts most homelabs need |
| Tailscale | Mesh VPN and coordinator you do not want to run yourself | Windows, macOS, Linux, iOS, Android | Personal plan free up to 6 users | Starter around $6 per user per month |
| NextDNS | Filtering DNS with anycast and per-device profiles | Router, Windows, macOS, Linux, mobile | 300k queries per month free | Pro around $1.99 per month |
| GitHub | Offsite Git remote and escape hatch for local Gitea | Web, Windows, macOS, Linux, CLI | Unlimited private repos free | Pro around $4 per month |
| Better Stack | External uptime monitoring for services behind your firewall | Web, native alerts, Slack, mobile | 10 monitors free | Team plan around $29 per month annually |
1. Fastmail — best for hosted email you never have to think about
Running your own mail server is the classic homelab trap. Deliverability is a moving target, IP reputation is fragile, and the failure mode is that important mail silently lands in spam for months before anyone tells you. Fastmail is the pragmatic exit. It gives you real IMAP and JMAP, custom domains, calendars and contacts over CalDAV and CardDAV, and a support team that answers when you email them from a broken client. Paired with a self-hosted mail client or Thunderbird, it feels like the mail server you would build if you could, without any of the maintenance.
Where it falls short: No end-to-end encryption at rest, and the desktop experience leans on the web app rather than a native client. If threat-model-driven encryption matters more than everyday reliability, Proton Mail is the natural cross-shop.
Pricing: No permanent free tier. Individual plans start in the low single digits per month, with Duo and Family plans priced per additional mailbox. A 30-day trial is available.
Platforms: Web plus first-party apps for iOS and Android, IMAP and JMAP for any desktop client on Windows, macOS, and Linux.
Download: Fastmail · Apps and clients
Bottom line: Delete mail.yourdomain.com from your compose file, point the MX at Fastmail, and move on to a more interesting problem.
2. Backblaze B2 — best for cheap, boring offsite backup
Every 3-2-1 backup plan needs a third copy that lives in a different building. Backblaze B2 is the least fussy way to buy one. It speaks the S3 API, so restic, Kopia, Duplicati, and rclone all target it without special adapters. Pricing is flat per terabyte with no tiered storage classes to reason about, and free egress through Cloudflare and a handful of other partners means the “what if I have to restore all of it” number stays sane.
Where it falls short: No compute or serverless functions on top, so if you want to run application logic next to the data, S3-plus-Lambda still wins. Regional footprint is smaller than the hyperscalers, which matters if you have a strict data-residency rule.
Pricing: 10 GB free forever, then a low single-digit dollar amount per terabyte per month for standard storage. Egress up to three times your average stored data per month is free, and additional egress is priced per gigabyte.
Platforms: Any S3-compatible client on Windows, macOS, and Linux, plus the official CLI and desktop apps.
Download: Backblaze B2 · B2 CLI and clients
Bottom line: The offsite copy of the 3-2-1 rule, priced so you actually keep it.
3. Cloudflare — best for DNS, tunnels, and a public edge in front of home services
You can self-host authoritative DNS, but you cannot self-host anycast. Cloudflare gives you a fast global resolver, free DNS hosting with API-driven updates, and, more importantly, Cloudflare Tunnel: an outbound-only tunnel from your home lab to Cloudflare’s edge that exposes a service on the public internet without opening a port on your router. Layer Cloudflare Access on top and you get SSO in front of Grafana, Portainer, or whatever else you would rather not expose raw.
Where it falls short: You are handing termination of your traffic to a third party, which is a valid concern if your threat model excludes that. And the free tier’s rules on non-HTTP traffic and large media caching have real limits.
Pricing: DNS, Tunnel, and the WAF basics are free. Zero Trust Access is free for up to 50 users. R2 object storage and higher-tier features are priced per usage.
Platforms: Web dashboard, plus cloudflared for Windows, macOS, and Linux, and container images for anything running Docker.
Download: Cloudflare · cloudflared releases
Bottom line: The public-facing half of the home lab, for free.
4. Tailscale — best for a mesh VPN that stays up when your lab does not
Tailscale is the coordinator you do not want to run yourself. WireGuard handles the crypto, and Tailscale handles the coordination server, the NAT traversal, the ACLs, and the DERP relays for the awkward networks. The 2026 pricing update made this an easier call for home users: the Personal plan now covers up to six users with unlimited devices, so a household or small friend group can share access to home services without paying at all.
Where it falls short: SSO on the paid tiers is opinionated about identity providers, and full self-hosting means running Headscale, which is a real project rather than a checkbox. If you have to own every piece of the stack, that is a fair reason to skip.
Pricing: Personal plan is free for up to six users with unlimited devices. Starter plans are priced around $6 per user per month, Premium higher.
Platforms: Native clients for Windows, macOS, Linux, iOS, Android, and small hardware such as Synology NAS units.
Download: Tailscale · Download page
Bottom line: The one piece of home lab networking most people should stop trying to run themselves.
5. NextDNS — best for filtering DNS with anycast you do not have to run
Pi-hole and AdGuard Home are excellent inside the house. They also stop working the moment you walk out the door with a phone or a laptop. NextDNS covers the gap: it runs anycast DNS-over-HTTPS on your router and on every device, with per-profile blocklists, per-device analytics, and rewrites you can push in seconds. You keep the Pi-hole for LAN-only device blocking if you like, and NextDNS covers roaming.
Where it falls short: Log retention past the standard window is a paid feature, and the free plan has a monthly query cap that a household with a lot of devices can hit. Custom rules are powerful but require some DNS literacy.
Pricing: Free for up to 300,000 queries per month per profile with all features unlocked. The Pro tier is priced in the low single digits per month for unlimited queries.
Platforms: Any router that supports DoT or DoH, plus first-party apps for Windows, macOS, Linux, iOS, and Android.
Download: NextDNS · Setup guides
Bottom line: Home-lab filtering that follows you off the LAN, at pocket-money prices.
6. GitHub — best for an offsite Git remote and an escape hatch for local Gitea
Running Gitea or Forgejo at home is fun until the disk that holds every side project you have ever started decides to click. GitHub is the boring second remote. Push to your local Gitea, mirror to GitHub on a cron, and you have off-site history plus a functioning URL to share with people who do not have Tailscale. Free accounts get unlimited private repositories, Actions minutes for CI, and Packages for container images, so you rarely have to open the wallet.
Where it falls short: It is not open source, the data lives with a single vendor, and both governance and content moderation are outside your control. If any of those are dealbreakers, Codeberg is the direct swap and follows the same Git workflow.
Pricing: Free plan with unlimited public and private repositories. GitHub Pro is priced in the low single digits per month and adds Codespaces and larger runners.
Platforms: Web plus the gh CLI for Windows, macOS, and Linux. GitHub Desktop covers Windows and macOS.
Download: GitHub · GitHub CLI · Codeberg as the alternative
Bottom line: The offsite Git copy your local Forgejo needs, plus the URL you already send to collaborators.
7. Better Stack — best for external uptime monitoring that survives your home going dark
Uptime Kuma is a great dashboard, but it cannot tell you your home lab is offline when it is running on the same machine that just crashed. External uptime monitoring has to be somewhere else, and Better Stack (formerly Better Uptime) is a friendly place to start. Free-tier monitors run at three-minute intervals with Slack and email alerts, incident escalation is sane, and public status pages are one click away for anyone in the household who wants to check before filing a ticket with you.
Where it falls short: The paid tiers scale by responder and by monitor pack, so heavy users add up faster than the sticker price suggests. Log management and telemetry are separate product lines with their own bills.
Pricing: Free plan covers up to 10 monitors with three-minute checks and a single status page. Team plans start around $29 per month billed annually.
Platforms: Web, plus mobile apps for iOS and Android, and integrations with Slack, PagerDuty, and email. Nothing to install on your servers beyond a heartbeat script if you want one.
Download: Better Stack · Better Uptime docs
Bottom line: The pair of eyes that watches when your own monitoring is the thing that broke.
How to pick the right cloud services for your home lab
Start with the two failure modes that hurt the most. If your bank uses email to send fraud alerts, host the mail somewhere that has a full-time deliverability team. Fastmail is the safe default. If Proton Mail’s encryption model matters more to you, pay for that instead and forward the low-value inboxes to it.
Then plug the offsite gap. Backblaze B2 plus restic or Kopia is the cheapest working setup for a household. Aim the same backup at a local NAS and B2 with the same client, and the 3-2-1 plan writes itself.
For networking, treat Tailscale and Cloudflare as complements, not competitors. Tailscale is the private path between your devices and services; Cloudflare Tunnel is the public path for the few things you want anyone to reach. NextDNS sits under both and follows the devices around.
GitHub is the small monthly bill that is almost never worth cancelling, particularly with unlimited free private repos. Better Stack earns its slot once you have more than a couple of services or someone other than you depends on them being up. If you are still solo and hobby-scale, an external Uptime Kuma on a $5 VPS covers the same ground for less; Better Stack is where you land when you get tired of babysitting that VPS.
FAQ
Is it worth self-hosting email in 2026? For most people, no. Deliverability against Google and Microsoft has only gotten harder, and the failure mode is silent. A hosted provider like Fastmail or Proton Mail costs less per month than the electricity to run the server, and you get someone else’s IP reputation and abuse team.
Why pay for offsite backup when I already have a NAS? A NAS in the same building fails to the same fire, flood, or theft as the primary machine. Backblaze B2 gives you a copy that survives the building, priced so you do not delete it in a spring clean.
Do I still need Cloudflare if I have Tailscale? Yes, for different jobs. Tailscale is the private mesh between devices you control. Cloudflare Tunnel and DNS are the public face for the small set of services you want unauthenticated visitors to reach without opening ports on your router.
Is Tailscale still free for a small home lab? The Personal plan covers up to six users with unlimited devices at no cost. Most households and small friend groups fit inside that, and the paid tiers only start to matter when you need enterprise SSO or larger user counts.
Where does Codeberg fit next to GitHub? Codeberg is a solid free alternative for open-source projects that want to keep code with a European non-profit. GitHub still wins on integrations, CI minutes, and the audience already there. Nothing stops you from pushing to both.
Do these services work on Linux desktops as first-class citizens?
All seven do. Fastmail, GitHub, and Better Stack are protocol-first, so any Linux client works. Tailscale, Cloudflare’s cloudflared, and NextDNS ship native Linux packages and containers. Backblaze B2 is S3-compatible, which is Linux-native by default.
