Secure Your Stack: The Essential Security Mental Models for Self-Hosters

The Community Spark #

In the r/selfhosted community, nothing prompts a more anxious discussion than exposing a newly deployed service to the public internet. With automated botnets scanning the IPv4 space within minutes of a port opening, a single misconfiguration in your reverse proxy or an unpatched vulnerability in an open-source app can lead to a compromised home lab. The core problem is that many self-hosters jump into deployment without a coherent security framework, relying on a patchwork of tutorials instead of fundamental security principles.

Synthesized Community Perspectives #

Analyzing community discussions reveals three primary security mindsets:

1. The Cloudflare Tunnel Conviction: A large contingent of the community advocates for Cloudflare Tunnels (and similar SaaS-reliant zero-trust options). The appeal is obvious: no open ports on your router, automated SSL certificates, and DDoS protection out of the box. However, critics point out that Cloudflare gets to decrypt and inspect all your traffic, representing a centralization risk that goes against the very spirit of self-hosting.
2. The WireGuard Only Purists: For services meant solely for personal or family use, a massive portion of the community suggests locking everything behind a VPN. WireGuard or Tailscale/Headscale are highly recommended. If there are no open web ports, the attack surface drops to virtually zero. The drawback is friction: family members must have the VPN client installed and active.
3. The Reverse Proxy + OIDC Advocates: When services must be public (e.g., Plex, static blogs, or sharing tools), the consensus favors a robust reverse proxy (Traefik, Nginx Proxy Manager, or Caddy) combined with a central authentication layer (Authelia or Authentik) and CrowdSec for IP ban telemetry.

Key Debate: Direct exposure vs. zero-trust access. While some argue that MFA on the application itself is sufficient, the community strongly recommends fronting your services with an independent identity provider to shield vulnerabilities.

Deep-Dive Actionable Guide: Hardening Your Self-Hosted Entryway #

Let’s build a secure, standard deployment template using Caddy (for automatic SSL and simple syntax) and Authelia (for multi-factor authentication).

docker-compose.yml

version: '3.8'

services:
  caddy:
    image: caddy:2-alpine
    container_name: caddy_proxy
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./caddy_data:/data
      - ./caddy_config:/config
      - ./Caddyfile:/etc/caddy/Caddyfile
    networks:
      - proxy_net

  authelia:
    image: authelia/authelia:latest
    container_name: authelia_auth
    restart: unless-stopped
    volumes:
      - ./authelia_config:/config
    networks:
      - proxy_net

networks:
  proxy_net:
    driver: bridge

Caddyfile configuration template:

(forward_auth) {
    forward_auth authelia:9091 {
        uri /api/verify?rd=https://auth.example.com/
        copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
    }
}

auth.example.com {
    reverse_proxy authelia:9091
}

service.example.com {
    import forward_auth
    reverse_proxy internal_service:8080
}

Comparative Analysis: Exposure Strategies #

The Verdict / Expert Advice #

Choose your strategy based on the audience of the service:

• For Admin/Dashboard tools (Proxmox, Portainer, Pi-hole): Never expose these to the public. Put them behind a local-only WireGuard/Tailscale VPN.
• For Family-shared media/docs (Nextcloud, Jellyfin): Use a reverse proxy (like Caddy) hardened with Authelia or Authentik.
• For Public-facing sites (this blog, portfolios): Use static generators (Hugo) hosted on serverless platforms or behind standard edge proxies.

Frequently Asked Questions (FAQ) #

1. Is direct port forwarding safe if I use a strong password? #

No. Brute-force attacks are only one threat. A vulnerability in the application layer (like an SQL injection or a remote code execution bug) can bypass authentication entirely. Always front public services with a reverse proxy and an independent auth gateway.

2. Are Cloudflare Tunnels fully secure? #

Yes, they are highly secure against network-level attacks, but they require trusting Cloudflare as they decrypt your traffic to inspect it. For highly sensitive personal data, self-hosting your reverse proxy is preferred.

3. How does CrowdSec help self-hosters? #

CrowdSec acts as a collaborative intrusion detection system. It parses your proxy logs for malicious behavior and automatically blocks aggressive IP addresses, sharing the blocklists with other self-hosters in a network-effect security model.