this post was submitted on 15 Sep 2026
110 points (97.4% liked)

Selfhosted

62233 readers
783 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
ayyy@sh.itjust.works
curbstickle@anarchist.nexus
curbstickle_lw@lemmy.world
110
How "secure" is your setup? (lemmy.dbzer0.com)
submitted 5 days ago by soyslurper2@lemmy.dbzer0.com to c/selfhosted@lemmy.world
78 comments fedilink hide all child comments
 

What setups/softwares do you use to secure your server?

All I do is run the process as user with no login shell.

The topic came to mind after reading this post Is Authelia enough without fail2ban or crowdsec?

you are viewing a single comment's thread
view the rest of the comments
[–] tatterdemalion@programming.dev 2 points 1 day ago

Secrets

  • Encrypted secrets file. All repo-managed credentials live in secrets/secrets.yaml, encrypted with SOPS/age.
  • Encrypted OpenTofu state. State and plans are encrypted client-side (PBKDF2 + AES-GCM) with a passphrase from TF_VAR_state_passphrase.

Network perimeter

  • Default-drop firewall on the router. I use a hand-written nftables ruleset with policy drop on both input and forward. Only lo, lan0 and wg0 are trusted. WAN accepts only established traffic, WireGuard UDP and HTTP/HTTPS.
  • No SSH from the WAN. sshd on the router is not exposed to the internet at all.
  • WireGuard for remote access.
  • Forced DNS. NAT redirects all LAN and VPN port-53 traffic to the router's AdGuard. AdGuard uses Quad9 over DoT upstream, with blocklists and safe search.
  • Second-level ACL in nginx. Private .home vhosts and Grafana carry allow LAN; allow VPN; deny all;.
  • TLS everywhere. Every public vhost sets forceSSL with recommendedTlsSettings. Certificates come from ACME DNS-01, so issuance needs no inbound port 80. Cloudflare is DNS-only with no proxy, so no third party sees plaintext.

Host access

  • SSH hardening. Password and keyboard-interactive auth are off, PermitRootLogin = "no", and logins are key-only.
  • Dedicated deployer system user. It uses a CI-only keypair, separate from the interactive keys. Everything it does through sudo is logged with LOG_INPUT/LOG_OUTPUT to /var/log/sudo-deployer.log.