I’ve been doing small hosting off and on for a while. Mainly for accessing files at home and the occasional Minecraft server. Not smart, as I’ve never used a specialized router. I used to use ddwrt, but now it’s impossible to flash most consumer grade routers.

id like to learn more stuff about cyber security, host other stuff, maybe host a website, but I’m just a guy who lives in an apartment. I’m stuck with 1 Internet service that claims it will terminate my service if they find me to be hosting anything. They must be semi-lax with that rule, because i haven’t gotten terminated for using ssh and cockpit.

Do you guys own a house, or are just fortunate enough to have access to an ISP that will let you host your own stuff?

  • or4n@kbin.social
    1·
    1 year ago

    Home

    Firewall / OpenBSD running on APU2

    • Wireguard (only thing open to the public)
    • IPSec site-to-site to Oracle cloud (only open for Oracle VPN GW IP)
    • NSD for authoritative DNS
    • Unbound for DNS filtering (unbound adblock script)
    • script that updates my public IP to DNS provider should it change

    Containers / Debian running on Asus PN62

    • Portainer for controlling local Docker as well as one in the Oracle Cloud
    • certbot with DNS auth to get certificate for local services, this way I don’t need to open anything to the Internet
    • Traefik as reverse proxy configured via labels

    Cloud

    Cloudflare

    • This is in front of public services
    • Public DNS

    Oracle Cloud

    • Free tier server (4x vCPU, 24GB RAM) with Docker, Traefik, Portainer agent
    • IPSec from home so I can control Docker on my cloud server

    Azure

    • Azure blob storage for backups (Restic)

    Everything is separated as much as I can. All stacks are on separate networks with strict firewall rules (iptables) on host to control which container can talk to others. For example Traefik can talk to Gitea but not vice versa. Everything on physical network is separated by VLANs.