Security
Every self-hosted service is an internet-facing liability until configured otherwise. These guides cover the hardening baseline: SSH configuration, firewalls and fail2ban, secrets management, TLS, VPN overlays like WireGuard and Tailscale, and the reverse-proxy patterns that keep internal services internal. Defense in depth, sized for one operator.
cert-manager for Self-Hosted Kubernetes: A Practical Guide
Learn what cert-manager does in Kubernetes, when to use it, and how to run certificate automation sanely in a self-hosted cluster.
Read the guide →
Docker Security Best Practices
A practical Docker security guide covering least privilege, image trust, secrets handling, network exposure, and host-container boundaries.
Read the guide →
Fail2ban Setup for Self-Hosted Services
Learn how to use Fail2ban to reduce brute-force noise on self-hosted services, including SSH protection, jail scope, and operational limits.
Read the guide →
pfSense vs OPNsense: Which Self-Hosted Firewall Fits a Small Team or Home Lab?
A practical comparison of pfSense and OPNsense covering interface design, update style, plugins, hardware planning, and how to choose between them.
Read the guide →
Self-Hosted Infisical: A Practical Secrets Manager for Small Teams
Learn when self-hosted Infisical makes sense, what problems it solves, and how to approach secrets management more safely in a small team environment.
Read the guide →
Self-Hosted Vaultwarden Password Manager: A Practical Guide
Learn when and how to self-host Vaultwarden for private password management, including deployment basics, security considerations, and operational advice.
Read the guide →
Self-Hosted WireGuard Setup Guide for Home Labs and VPSs
Learn how to plan, deploy, and secure a self-hosted WireGuard VPN with practical advice for home labs, VPS deployments, and remote access.
Read the guide →
SSH Hardening Guide for Linux Servers
A practical SSH hardening guide for Linux servers covering authentication, access restrictions, logging, and safer administration habits.
Read the guide →
Tailscale vs WireGuard: Which One Makes More Sense for Self-Hosted Access?
A practical comparison of Tailscale and WireGuard covering setup, control, reliability, identity, and when each option fits best.
Read the guide →
Ubuntu Server Hardening Checklist
A practical Ubuntu Server hardening checklist covering updates, least privilege, SSH protection, firewalling, logging, and service reduction.
Read the guide →
How to Secure a Self-Hosted AI Stack on Ubuntu
A practical baseline security guide for small self-hosted AI deployments on Ubuntu, covering SSH, firewall, Docker, and secrets management.
Read the guide →