Wireguard VPN. I actually have a public hosted Oracle server that when authentic opens port 443 for that source IP temporary so no VPN will be needed. Computer visit free pub Oracle VM. Android Phone scan QR, start Wireguard and auth that user. Computer can now reach my home server on port 443 and 22 for 24 hours as the source IP is allowed.

I do this instead of crowdsec etc. I expect zero days vulnerabilities that someone will utilize so dont trust nginx and ssh to be wide open.

Reverse proxy for services for friends and family

Tailscale for my remote services

Basically everything is in docker containers.

If you’re talking about remote access specifically, I use tiers.

“Public” is open, but goes through crowdsec and anubis, and is on a DMZ network. This is my website, blog, Fediverse, etc.

“Private” is either secured with mtls or wireguard. This is stuff that’s only for me or family, like media or home assistant.

“Sensitive” is wireguard only. This is infrastructure management, Paperless, etc.

I don’t have anyone to share it with, so it’s not open.

Nothing to protect if you don’t expose it.

Plain and simple - Wireguard.

All services run as separate services user in rootless podman containers.

Only one nginx exposed to the open internet acting as reverse proxy to stuff where Wireguard requirement would be too inconvenient to be useful (shared calendar).

I tend to go overboard on security, or so I’ve been told.

https://lemmy.world/post/43533409

i try to keep it secure by minimalism because the less complicated is the software the smaller is the chance of a vulnerability

so everything related to file transfer/access uses sftp (with accounts with no ssh permissions because: 1. i dont want the password to my server to be stored anywhere in some sftp software 2. im not the only user of this server) and for other services i just run a small local program and remote access it with ssh

i guess the biggest secuity threat is someone physically stealing the backup disk or the main hard drive because theyre both unencrypted

Walking to the setup you would stub your small toe a few times, that alarm is enough.

Secure enough I suppose.

f2b at the FW, auth with MFA for anything exposed, anything local only has restricted access at the FW level, with exposed (via proxy) and local-only (separate proxy) on different vlans. Each service is (typically, with some exceptions) an LXC, with additional rules and templated out based on use case. The few cases where docker is involved is local-only and that has its own vlan with additional rules.

Depends on how secure synology is.

It’s powered off.

i don’t have many servers exposed publicly other than apache2(+freshrss) and opensshd. server runs freebsd and apache2 runs on a jail. nothing special other than that, so i could theoretically get instantly pwned with a openssh 0day.

It’s more difficult to steal my data when it’s only stored in a single place without backups.

Insecure enough so I can break in myself, in case I lose access or whatever.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

[Thread #105 for this comm, first seen 16th Sep 2026, 06:30] [FAQ] [Full list] [Contact] [Source code]