Hi all, some months ago I had an accident that required surgery, long story short, found this sub and it helped me go through the slow recovery process. I have been learning a lot with you and now I want to share my experience so far, I put together a post about self-hosting my website at home, the hardware I’m using, the software, tools, etc. I hope you find it useful or even inspirational if you haven’t started yet, and I would love to hear your comments.
https://proderror.eu/blog/self-hosting-my-website-at-home-2023-11-25.md
I would add cloudflare tunnels to avoid showing your ip to the world and easily setup some access rules
Cloudflare It’s definitely something I’ll consider. Thx
Why cloudflare tunnels? If you already have a domain, and are going to use cloudflare, why add their dns nameservers to your registrar admin page, and use their dns for free?? That solves the issue of hosting at home and showing your ip to the world via any method using your domain name, all they’ll see is cloudflare.
Very cool site! You’re so right, hosting at home is so fun and actually super useful! My setup is soooo much easier to access and control now, and I’ve learned so much.
My self hosted site is at https://nintenuendo.tv heh, cheers to many more years of open-source!
Man that’s sick! You have lot’s of exposed services, can you expand what app you are running in https://shell.nintenuendo.tv/ ? Do you have any blog? Cheers
for the shell, that’s an easy one, shellinabox, with a custom dark mode.
for the exposed services you describe, none are “exposed”, they are hosted in nginx (meant to face the WAN, subdomained and not port forwarded) with fail2ban setup for custom filtering, and beyond that are proxied through cloudflare and their filtering for ddos etc. Most of my services are behind htpasswd hashed/salted pw’s or ldap (right now just htpasswd for the local site), and the ones that arn’t use token logins like plex, overseerr, etc. I’ll be ok :)
The choice of router doesn’t do much as most if not all home routers these days have built-in firewalls enough to block most intrusions on network without open ports. If self-hosting a website at home then make sure to secure the two web hosting ports (TCP port 80/443) with UFW, Fail2Ban, or even Port Knocking on for ex. Linux. Don’t forward but limit access (locally) to SSH port. Encrypt your DNS (DoH, DoT, etc.) at home by running either AdGuard Home or Pi-hole.
Proxy DNS via Cloudflare & make sure to use full (strict) end-to-end SSL encryption (DNSSEC enabled). Also, use stronger security headers & SSL encryption parameters (minimum TLSv1.2, SSL ciphers, stapling & ECDH curve, etc.). Use a software firewall on your websites such as Wordfence, Sucuri, or BBQ Pro on Wordpress.
Don’t overkill with your network setup. If you’re just gonna be running a website that serves primarily cached & preloaded static pages then no use spending hundreds of dollars for it. Even a wireless Rasp. Pi Zero W is an overkill for such a setup.