Selfhosted

60253 readers

571 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

Be civil.
No spam.
Posts are to be related to self-hosting.
Don't duplicate the full text of your blog or readme if you're providing a link.
Submission headline should match the article title.
No trolling.
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago

MODERATORS

curbstickle@anarchist.nexus

curbstickle_lw@lemmy.world

-54

DepthSight - a self-hosted, federated algorithmic trading platform with a visual strategy builder (AGPL) (europe.pub)

submitted 1 week ago* (last edited 1 week ago) by DepthSight@lemmy.world to c/selfhosted@lemmy.world

22 comments fedilink hide all child comments

I've been building DepthSight for the past year - a self-hosted algorithmic trading platform that you run entirely on your own hardware, so your API keys and trading logic never touch a third-party server (like 3Commas or Veles).

Instead of writing code, it features a drag-and-drop node editor (40+ logic blocks) where you can build complex strategies, cross-reference indicators, and manage risk dynamically. It also includes an AI assistant that can generate strategy structures from text prompts or even screenshots of chart setups.

Since Lemmy is built on federation, I thought you guys might appreciate the architecture: DepthSight nodes can opt-in to connect to a central Federation Hub. This creates a community network where self-hosted nodes can share verified strategy templates, discuss trading ideas, and form a global node topology map.

Features out of the box:

Visual strategy builder
Federation Hub
Dual backtesting engines
Dynamic risk management that adapts per trading pair
Multi-tenant support (JWT, Redis quotas) if you want to host it for others

Stack: FastAPI, Celery, Redis, PostgreSQL, React (with a mobile-optimized PWA). AGPLv3 licensed. Runs with a single deployment script (curl | bash).

Github: https://github.com/DepthSight-Pro/DepthSight

Built this solo (heavily leveraging LLMs for the heavy lifting in code generation). Would love to get some feedback from the self-hosted community, especially on the architecture or features you'd want to see added!

you are viewing a single comment's thread
view the rest of the comments

[–] moonpiedumplings@programming.dev 7 points 6 days ago

Calling an enterprise-grade platform

Except you use JWT's for auth, which is idiotic and a security nightmare. No enterprise that cares about security would ever accept this.

More info: https://gist.github.com/samsch/0d1f3d3b4745d778f78b230cf6061452

There are other problems, some of which I can see... and some of which I can't. The problem is that I am not a comprehensive expert, I can only spot a few things here and there. Even if I was an expert, why would I audit your software for free lmao? Pay me for that shit.

What I do know, is that vibecoded apps are bad at security. Many, many vibecoded apps have been hit by horrific security bugs like remote code execution, xss, or authentication bypasses. That shit is simply unacceptable and should be extremely rare in modern apps. The fact that I'm not skilled enough to find them reliably makes me even more cautious and concerned around apps like yours.

It's not just about the app architecture, but also about you. When a known community figure creates an app, I have confidence that they will have a good security posture and architecture. With vibecoding... not so much.

If you have an actual architectural critique

Nice bait, but the problem is this: Just because you get people to ~~audit~~ "critique" your software, doesn't fix the root cause of those problems — you. Just because you manage to re-vibecode the app to not use JWT's or to fix any other number of issues someone would point out, doesn't actually mean more issues exist that that person missed. Like if someone specialized in python, then they might miss database issues, and so on. The second problem is that inevitably, you will expand this software, adding more features... and vulnerabilities. That is to say, even if you manage to fix the architecture and security now, you have not demonstrated the requisite skill needed in order to keep it fixed.