How "secure" is your setup?

For my server, secure enough. Just the basic recommendations, non-standard ssh port, default deny on firewall, fail2ban, etc. It doesn’t need a lot of security because its just a static website. For most projects this is enough.

I will say, a honeypot can be useful and I’m getting one set up but its a low priority for me.

Secrets

• Encrypted secrets file. All repo-managed credentials live in secrets/secrets.yaml, encrypted with SOPS/age.
• Encrypted OpenTofu state. State and plans are encrypted client-side (PBKDF2 + AES-GCM) with a passphrase from TF_VAR_state_passphrase.

Network perimeter

• Default-drop firewall on the router. I use a hand-written nftables ruleset with policy drop on both input and forward. Only lo, lan0 and wg0 are trusted. WAN accepts only established traffic, WireGuard UDP and HTTP/HTTPS.
• No SSH from the WAN. sshd on the router is not exposed to the internet at all.
• WireGuard for remote access.
• Forced DNS. NAT redirects all LAN and VPN port-53 traffic to the router’s AdGuard. AdGuard uses Quad9 over DoT upstream, with blocklists and safe search.
• Second-level ACL in nginx. Private .home vhosts and Grafana carry allow LAN; allow VPN; deny all;.
• TLS everywhere. Every public vhost sets forceSSL with recommendedTlsSettings. Certificates come from ACME DNS-01, so issuance needs no inbound port 80. Cloudflare is DNS-only with no proxy, so no third party sees plaintext.

Host access

• SSH hardening. Password and keyboard-interactive auth are off, PermitRootLogin = “no”, and logins are key-only.
• Dedicated deployer system user. It uses a CI-only keypair, separate from the interactive keys. Everything it does through sudo is logged with LOG_INPUT/LOG_OUTPUT to /var/log/sudo-deployer.log.

I’m a little paranoid, so this is my security set up.

SSH, blocked at firewall level, only allowing specific local IP to access port 22. Also authentication is done by key, with password disabled.

Most services are local only and I access them through wireguard VPN when I’m outside my home.

For services that need a domain name and be public facing, I use a reverse proxy, with the following protections:

• Very restrictive geoIP block, only my country can access.
• Restrictive rate limiting.
• Crodwsec, with community lists, a pluging for open lists, community rules and my own very restrictive set of rules for banning attackers. (For instance as soon as the requested path contains “.env” that’s an instant ban, no second chances).
• Monitoring through grafana.
• Some complex services that need a valid tls handshake but I only want to use them myself have a setup when they are technically open to the net, to get let’s encrypt, but the server rejects every IP request but mine.

Recently I also reduced some noise, surface attack, deleting the A register from my second level domain and using an obscured target for the CNAME records. I also want to delete the www subdomain as it gets a lot of uneeded noise.

Seperate servers (with different locations - one in LAN,one with Hetzner, one with OVH) that provide intranet (only available in the HomeLAN or via Wireguard), extranet(“public” services as in “to friends and family”) and Backup/Monitoring services.

Everything behind OPNsenses, with strict firewall rules, crowdsec and acting as a reverse proxy. Additionally certain things are locked down via hosting provider based firewalls (as I have the luxury to have a static IP at home I can easily do limit ingress for some extranet services)

VLAN seperation both within HomeLAN and Proxmox. Proxmox firewall rules to limit intra VLAN access. Unpriviliged LXC containers - seperated per service. Anything needing docker runs in rootless podman within an unpriv. LXC. (If it does not run like that it won’t run. End of discussion) Authentik for OIDC. If it does not do OIDC/SAML is does not run. (Only exception is LDAP in HomeNet as I am running free IPA anyway) Also acts as Jumpserver via VNC/RDP.

As I am using ansible/Terraform (via Semaphore) for everything I also strictly enforce fail2ban and certain monitoring components. (Namely Zabbix and Wazuh)

Wireguard VPN. I actually have a public hosted Oracle server that when authentic opens port 443 for that source IP temporary so no VPN will be needed. Computer visit free pub Oracle VM. Android Phone scan QR, start Wireguard and auth that user. Computer can now reach my home server on port 443 and 22 for 24 hours as the source IP is allowed.

I do this instead of crowdsec etc. I expect zero days vulnerabilities that someone will utilize so dont trust nginx and ssh to be wide open.

Reverse proxy for services for friends and family

Tailscale for my remote services

Basically everything is in docker containers.

Rootless LXC containers, TLS. In my case, I have both VPS and my own hardware, so every sensitive data is hosted on the hardware only.

If you’re talking about remote access specifically, I use tiers.

“Public” is open, but goes through crowdsec and anubis, and is on a DMZ network. This is my website, blog, Fediverse, etc.

“Private” is either secured with mtls or wireguard. This is stuff that’s only for me or family, like media or home assistant.

“Sensitive” is wireguard only. This is infrastructure management, Paperless, etc.

I don’t have anyone to share it with, so it’s not open.

Nothing to protect if you don’t expose it.

Plain and simple - Wireguard.

All services run as separate services user in rootless podman containers.

Only one nginx exposed to the open internet acting as reverse proxy to stuff where Wireguard requirement would be too inconvenient to be useful (shared calendar).

I tend to go overboard on security, or so I’ve been told.

https://lemmy.world/post/43533409

I have 3 subnets. One for me, one for family members and one for the publicly accessible services I expose. Each process has limited access to the file system, no root shell and even in the case someone gains full control of it they can’t reach other subnets. I use fail2ban too.

For the “me” part, I connect through a VPN. I’d like to run rootless docker services tho, or by using Podman

Walking to the setup you would stub your small toe a few times, that alarm is enough.

Secure enough I suppose.

f2b at the FW, auth with MFA for anything exposed, anything local only has restricted access at the FW level, with exposed (via proxy) and local-only (separate proxy) on different vlans. Each service is (typically, with some exceptions) an LXC, with additional rules and templated out based on use case. The few cases where docker is involved is local-only and that has its own vlan with additional rules.

It’s powered off.