The "safest" way of self hosting

You're going to get a lot of bad or basic advice with no reasoning (use a firewall) in here... And as you surmised this is a very big topic and you haven't provided a lot of context about what you intend to do. I don't have any specific links, but I do have some advice for you:

First - keep in mind that security is a process not a thing. 90% of your security will come from being diligent about applying patches, keeping software up-to-date, and paying attention to security news. If you're not willing to apply regular patches then don't expose anything to the internet. There are automated systems that simply scan for known vulnerabilities on the internet. Self-hosting is NOT "set it and forget it". Figuring out ways to automate this help make it easy to do and thus more likely to be done. Checkout things like Ansible for that.

Second is good authentication hygiene. Choose good passwords. Better yet long passphrases. Or enable MFA and other additional protections. And BE SURE TO CHANGE ANY DEFAULT PASSWORDS for software you setup. Often there is some default 'admin' user.

Beyond that your approach is"security in depth" - you take a layered approach to security understanding what your exposure is and what will happen should one of your services / systems be hacked.

Examples of security in depth:

• Proper firewalling will ensure that you don't accidentally expose services you don't intend to expose (adds a layer of protection). Sometimes there are services running that you didn't expect.
• Use things like "fail2ban" that will add IP addresses to temporary blocklists if they start trying user/passwords that don't work. This could catch a bot from finding that "admin/password" user on your Nextcloud server that you haven't changed yet...

Minimize your attack surface area. If it doesn't need to be exposed to the internet then don't expose it. VPNs can help with the "I want to connect to my home server while I'm away" problem and are easy to setup (tailscale and wireguard being two popular options). If your service needs to be "public" to the internet understand that this is a bigger step and that everything here should be taken more seriously.

Minimize your exposure. Think though the question of "if a malicious person got this password what would happen and how would I handle it?" Would they have access to files from other services running on the same server (having separation between services can help with this)? Would they have access to unencrypted files with sensitive data? It's all theoretical, until it isn't...

If you do expose services to the internet monitor your logs to see if there is anything "unusual" happening. Be prepared to see lots of bots attempting to hack services. It may be scary at first, but relatively harmless if you've followed the above recommendations. "Failed logins" by the thousands are fine. fail2ban can help cut that down a bit though.

Overall I'd say start small and start "internal" (nothing exposed to the internet). Get through a few update/upgrade cycles to see how things go. And ask questions! Especially about any specific services and how to deploy them securely. Some are more risky than others.

I’m not expert but for the sake of getting some discussion going:

Don’t open ports on your router to expose services to the open internet.

Use a vpn when torrenting and make sure your torrent client is set to only use the vpn’s network adapter. This way, if your vpn drops out the torrent client can’t reach the internet.

I keep everything local and use Tailscale to access things while I’m away from home.

Your basic requirements are:

• Some kind of domain / subdomain payed or free;
• Preferably Home ISP that has provides public IP addresses - no CGNAT BS;
• Ideally a static IP at home, but you can do just fine with a dynamic DNS service such as https://freedns.afraid.org/.

Quick setup guide and checklist:

1. Create your subdomain for the dynamic DNS service https://freedns.afraid.org/ and install the daemon on the server - will update your domain with your dynamic IP when it changes;
2. List what ports you need remote access to;
3. Isolate the server from your main network as much as possible. If possible have then on a different public IP either using a VLAN or better yet with an entire physical network just for that - avoids VLAN hopping attacks and DDoS attacks to the server that will also take your internet down;
4. If you're using VLANs then configure your switch properly. Decent switches allows you to restrict the WebUI to a certain VLAN / physical port - this will make sure if your server is hacked they won't be able to access the Switch's UI and reconfigure their own port to access the entire network. Note that cheap TP-Link switches usually don't have a way to specify this;
5. Configure your ISP router to assign a static local IP to the server and port forward what's supposed to be exposed to the internet to the server;
6. Only expose required services (nginx, game server, program x) to the Internet us. Everything else such as SSH, configuration interfaces and whatnot can be moved to another private network and/or a WireGuard VPN you can connect to when you want to manage the server;
7. Use custom ports with 5 digits for everything - something like 23901 (up to 65535) to make your service(s) harder to find;
8. Disable IPv6? Might be easier than dealing with a dual stack firewall and/or other complexities;
9. Use nftables / iptables / another firewall and set it to drop everything but those ports you need for services and management VPN access to work - 10 minute guide;
10. Configure nftables to only allow traffic coming from public IP addresses (IPs outside your home network IP / VPN range) to the Wireguard or required services port - this will protect your server if by some mistake the router starts forwarding more traffic from the internet to the server than it should;
11. Configure nftables to restrict what countries are allowed to access your server. Most likely you only need to allow incoming connections from your country and more details here.

Realistically speaking if you're doing this just for a few friends why not require them to access the server through WireGuard VPN? This will reduce the risk a LOT and won't probably impact the performance. Here a decent setup guide and you might use this GUI to add/remove clients easily.

Don't be afraid to expose the Wireguard port because if someone tried to connect and they don't authenticate with the right key the server will silently drop the packets.

Now if your ISP doesn't provide you with a public IP / port forwarding abilities you may want to read this in order to find why you should avoid Cloudflare tunnels and how to setup and alternative / more private solution.

Are you taking about security for your homelab? It essentially comes down to good key hygiene, network security and keeping everything updated.

Don't open ports, use a good firewall at the border of the network, use a seedbox for torrenting. Use ACLs alongside VLANs in your network. Understand DNS in terms of how your requests are forwarded and how they are processed.

Check out the "Open Source Security Podcast" with Kurt Siegfried and Josh Bressers. It's not about specifics so much as how to build a mindset around security for IOT and hosting, generally dealing with opensource offerings.

Don't let it out onto the net...

It's true that you shouldn't open ports to the internet. If you still want your services to be accessible from outside the local network you can install a wireguard server on your thin client that has access to the services you want. And if you really want to harden it you can restrict wireguard clients from ssh and other admin things.

You will need to open one port on the router to your wireguard server though. Wireguard is UDP though and ignores packages without an established connection, so attackers will not even know there is an open port on your router.

Edit: tailscale and zerotier are good external solutions to this as well without needing to open a port at all.

I've setup wireguard, because it's only me and an employee using the services. But with that, externally I don't even seem to have a port open. But wireguard is so fast to be online, that I'm just always connected as soon as I'm online - using a domain and an IP update script

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

11 acronyms in this thread; the most compressed thread commented on today has 7 acronyms.

[Thread #462 for this sub, first seen 29th Jan 2024, 15:25] [FAQ] [Full list] [Contact] [Source code]

I'll assume you mean what I mean when I say I want to be safe with my self hosting -- that is, "safe" but also easily accessible enough that my friends/family don't balk the first time they try to log in or reset their password. There are all kinds of strategies you can use to protect your data, but I'll cover the few that I find to be reasonable.

1. Port Forwarding -- as someone mentioned already, port forwarding raw internet traffic to a server is probably a bad idea based on the information given. Especially since it isn't strictly necessary.

2. Consumer Grade Tunnel Services -- I'm sure there are others, but cloudflare tunnels can be a safer option of exposing a service to the public internet.

3. Personal VPN (my pick) -- if your number of users is small, it may be easiest to set up a private VPN. This has the added benefit of making things like PiHole available to all of your devices wherever you go. Popular options include Tailscale (easiest, but relies on trusting Tailscale) or Wireguard/OpenVPN (bare bones with excellent documentation). I think there are similar options to tailscale through NordVPN (and probably others), where it "magically" handles connecting your devices but then you face a ~5 device limit.

With Wireguard or OpenVPN you may ask: "How do I do that without opening a port? You just said that was a bad idea!" Well, the best way that I have come up with is to use a VPS (providers include Digital Ocean, Linode to name a few) where you typically get a public IP address for free (as in free beer). You still have a public port open in your virtual private network, but it's an acceptable risk (in my mind, for my threat model) given it's on a machine that you don't own or care about. You can wipe that VPS machine any time you want, the cost is time.

It's all a trade-off. You can go to much further lengths than I've described here to be "safer" but this is the threshold that I've found to be easy and Good Enough for Me™.

If I were starting over I would start with Tailscale and work up from there. There are many many good options and only you can decide which one is best for your situation!

Software:

• firewall, no inbound and do outbound restrictions
• use immutable OS
• full disk encryption (keep in mind that in many setups you will need to be beside the computer after restart)

Hardware:

• put it in the trusted datacenter (home stuff is not safe from teenagers and people that need computer's electrical socket for a vacuum cleaner)

One "hammer" mitigation to most threats could conceivably face when self-hosting is to never expose your services to the internet using a firewall. "Securing" your services against a small circle of guests/friends/family members in your home network is a lot simpler than securing against the entire world.
If you need to access your services remotely, there are ways to achieve that without permanently opening a single port to the internet such as Tailscale or ZeroTier.

Otherwise, commonly used tools in self-hosting such as Docker or VMs usually offer quite decent separation even if a service is compromised.

Nothing replaces good security hygiene though. Keep your stuff up-to-date. Use secure methods of authentication such as hard to guess passwords or better. Make frequent backups (3-2-1). The usual.