Selfhosted

There are ways to host things from home without opening ports in your router at all, this usually involves running something that calls/tunnels out of your network and back to some service and accepts incoming connections and sends them "baskward" over that connection. Cloudflare offers something called Tunnel, ngrok does something similar (though mainly aimed at development and not production hosting), and you can even host something yourself using something like frp (which is what I use, even for the Lemmy instance I am writing this from).

I haven't looked too closely at it, but there is an awesome-tunneling page someone put together that goes over these options and more.

Let me know if you want a bit more details on these options or specifics of how I've set up frp.

The most secure one would be not opening anything out, and using Tailscale to VPN into your home network.

If you want to open stuff, Cloudflare + letsEncrypt + good router/firewall will be a start.

Cloudflare yes. Even if you aren’t using tunnels it will help obfuscate your real ip. If you are hosting personal services you can also block access from countries you don’t expect to access them from.

Also it seems most bots scanning domains are checking www and the base domain url. I recommend pointing those at a vps or something like GitHub or substack if you don’t need it for something else.

Use a reverse proxy that 404s anything besides the subdomains you are actually using. Always use wildcard certs to avoid exposing subdomains and obfuscate your subdomains for common services to make them hard to guess.

Isolate your servers from the rest of your network with vlans if possible.

You will never be fully immune so all you can do is add more layers and roadblocks.

Tailscale, super easy install, sets up a VPN into your services, no port opening needed

Assuming you use Docker or some kind of container runtime I found a list of best practices: https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html

One way to think of being secure is "how can this be abused"

Its a good way to think of how you can secure stuff

I think the safest option is to not host from your home network. If you aren’t up to date on security patches, you could potentially expose a lot of data from an insecure server running inside your network.

There are precautions you can take, like isolating any external facing servers from the rest of your network, for example, but I generally recommend using a hosted service instead.

From what I understand, opening a port isn’t a risk in and of itself — it’s only a risk if the software using the port is insecure! So long as you use reliable software and take care to configure things properly (following through with instructions from a site like ArchWiki or the official documentation helps), you’re good.

CloudFlare is more for DDOS protection, which you almost certainly don’t need . You could always set up DDOS protection later on, if the need ever arises.

This is very much a choose your own adventure that depends on a number of factors such as the services you're hosting, ease of access for other household members, your hosting setup, additional privacy concerns, ect.

Here a couple of resources for different methods:

Techno Tim's overview, reverse proxy through cloudflare https://www.youtube.com/watch?v=Cs8yOmTJNYQ

Cloudflare proxy straight to the hosted service https://www.cloudflare.com/products/tunnel/

Create a peer to peer vpn sidestepping opening ports: https://tailscale.com/blog/how-tailscale-works/

As an addition to the options the others have given you, you could achieve a really secure setup with a VPN either on your home router, or on a Raspberry pi / VM / Container / Whatever using e.g. PiVPN. You would have to open a port on your router and forward it to the PiVPN. When logging into the pivpn, your device will behave just like you're inside your home network (if you want it to). If you use wireguard and secure the machine with fail2ban you should be good. Wireguard uses UDP only, this means malicious packets coming to your VPN will simply be disregarded. This means the attacker won't see / recognise any open ports at all. I did the same in the past and configured my raspberry pi to check if my IP has changed (global IPv6, b.c. my ISP doesn't hand out native/routable IPv4 adresses) and then update a DNS entry pointing to my pi.

Using Cloudflare Tunnel is a pretty common option for several reasons:

• it’s in the free tier so the tunnels cost nothing to run
• from the network perspective, exposing a service using a CF tunnel doesn't require an open port on your router
• CF also offers authentication for web apps which can be a nice addition to some types of services, especially the ones that lack their own auth

I personally use it to expose FreshRSS, Transmission, and some other stuff, it works really well.

First you've got to determine where threats can come from, then which surfaces are vulnerable and eventually the reach. In short what I mean:

SSH port (default 22) is high on the threat encounter level. Lots of bots try to scan every host they can find for an open SSH port. The risk is high because this is a doorway to your network. There's honestly no good reason to have port 22 open to your home. Get tailscale vpn. There are alternatives, I use tailscale, it's great.

When youre hosting apps, they can also be vulnerable. Keep them updated and you'll mostly be fine. There are levels of security. Super super secure is creating seperate networks for these apps so they can't access others. Bit much imo. Use non-rooted docker, enough of a sandbox.

In the end you're a small fish in a big pond, not saying you should be a cowboy but with a few decent measures you should be OK.

Tl;dr

• don't open port 22
• use a VPN (tailscale)
• update apps
• non-rooted docker