What setups/softwares do you use to secure your server?
All I do is run the process as user with no login shell.
The topic came to mind after reading this post Is Authelia enough without fail2ban or crowdsec?
How "secure" is your setup?
English
You must log in or register to comment.
- daniskarma@lemmy.dbzer0.comEnglish2 days
I’m a little paranoid, so this is my security set up.
SSH, blocked at firewall level, only allowing specific local IP to access port 22. Also authentication is done by key, with password disabled.
Most services are local only and I access them through wireguard VPN when I’m outside my home.
For services that need a domain name and be public facing, I use a reverse proxy, with the following protections:
- Very restrictive geoIP block, only my country can access.
- Restrictive rate limiting.
- Crodwsec, with community lists, a pluging for open lists, community rules and my own very restrictive set of rules for banning attackers. (For instance as soon as the requested path contains “.env” that’s an instant ban, no second chances).
- Monitoring through grafana.
- Some complex services that need a valid tls handshake but I only want to use them myself have a setup when they are technically open to the net, to get let’s encrypt, but the server rejects every IP request but mine.
Recently I also reduced some noise, surface attack, deleting the A register from my second level domain and using an obscured target for the CNAME records. I also want to delete the www subdomain as it gets a lot of uneeded noise.
- silfer@lemmy.worldEnglish2 days
Reverse proxy for services for friends and family
Tailscale for my remote services
Basically everything is in docker containers.
- zenforyen@feddit.orgEnglish3 days
Nothing to protect if you don’t expose it.
Plain and simple - Wireguard.
All services run as separate services user in rootless podman containers.
Only one nginx exposed to the open internet acting as reverse proxy to stuff where Wireguard requirement would be too inconvenient to be useful (shared calendar).
- 4 days
it’s so secure not even I, the owner can get in
(I forgot the password to truenas scale) - grue@lemmy.worldEnglish4 days
My stuff is only accessible from my LAN (because I haven’t figured out how to set up a tunnel or reverse proxy yet).
- Solrac@lemmy.worldEnglish3 days
Screw Tailscale, ZeroTier and specially cloudflare, all centralized, all with changable terms.
Use a VPS, lowest spec but good bandwidth, and use Wireguard VPN for your VPS and homeserver, and nginx or caddy to make a Reverse Proxy
- reddit_sux@lemmy.worldEnglish3 days
All agreed but not every homelabber can spend money for something that is not the main job or contributed to work. Tailscale for now works well enough for free.
Cloudflare agreed is not something I would trust.
- 8 hours
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters CGNAT Carrier-Grade NAT DNS Domain Name Service/System Git Popular version control system, primarily for code LXC Linux Containers NAT Network Address Translation SSH Secure Shell for remote terminal access TLS Transport Layer Security, supersedes SSL VNC Virtual Network Computing for remote desktop access VPN Virtual Private Network VPS Virtual Private Server (opposed to shared hosting) nginx Popular HTTP server
10 acronyms in this thread; the most compressed thread commented on today has 6 acronyms.
[Thread #105 for this comm, first seen 16th Sep 2026, 06:30] [FAQ] [Full list] [Contact] [Source code]
