Thats my post so yeah thats how secure it is right now, I have authelia infront of everything, besides some admin only thing which are only accessible over wireguard. I'd like to look into VLANS but have no hardware for it and it seems expensive
this post was submitted on 15 Sep 2026
108 points (97.4% liked)
Selfhosted
62187 readers
778 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil.
-
No spam.
-
Posts are to be related to self-hosting.
-
Don't duplicate the full text of your blog or readme if you're providing a link.
-
Submission headline should match the article title.
-
No trolling.
-
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
-
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 3 years ago
MODERATORS
Insecure enough so I can break in myself, in case I lose access or whatever.
Depends on how secure synology is.
rootless podman containers & apparmor
I don't selfhost secure, is this a new service? I selfhost securo instead, great tool!
Am I missing something here?
I use ssh keys... And some firewall rules.
I do have an internet only and a LAN only VLAN at least.
i don't have many servers exposed publicly other than apache2(+freshrss) and opensshd. server runs freebsd and apache2 runs on a jail. nothing special other than that, so i could theoretically get instantly pwned with a openssh 0day.
I have 3 subnets. One for me, one for family members and one for the publicly accessible services I expose. Each process has limited access to the file system, no root shell and even in the case someone gains full control of it they can't reach other subnets. I use fail2ban too.
For the "me" part, I connect through a VPN. I'd like to run rootless docker services tho, or by using Podman
There are a couple things that are public. Nothing that’s not containerized in an LXC. SSH is only available with VPN. I once locked myself out after not being at home as we had a blackout, I found no way in after two days and had to get there physically. I think I’m fine.
Defense in Depth. I have 4 networks, Home, Testing, Production, Production DMZ. At each layer I use firewalls and NIPS devices. Production and Testing have a SOAR appliance tied to Zeek NDR.
I have a robust maintenance schedule with checks and security patches installed ever 2 weeks. I have everything documented, services are run in their own containers instead of on monolithic servers.
Every system and component are hardened with modified DISA STIGs. Accounts have only the access they need, and everything is well documented for continuity of Operations.