Use authelia for 2fa

Disable root ssh

Disable password authentication for ssh. Keys only.

Set up Fail2ban

That’s about all that’s left; 2fa and brute force protection. Good job.

A few tips off the top of my head, in no particular order:

• do not allow public access to any of this. It’s not trivial to set up a wireguard tunnel so that you can reach your home network from e.g. your phone or laptop when you’re away, but it’s also not highly complicated. Usually your home Internet router can already get you half way there.

• if you must have some service available from the public net, it’s better to e.g. host it on a cheap VPS. That way if your things get hacked again (via no fault of your own), your home network is safe.

• set up automatics updates, at least for minor updates. If you’re fine with waiting for a few days in case an update crashes one of your services, it’s a good idea to just make it all auto update. Crash recovery from a backup is a simpler problem then setting up from scratch because your outdated service got hacked and now attackers own your home server, home router, TV, fridge, LEDs and whatever else is Internet capable at your home.

• use 2fa for any service you expose to public internet. Minor inconvenience, mitigates or avoids a whole series of errors.

• document what you’re doing in a simple doc. Can be a simple doc on your next cloud instance, just at a little note/log entry every time you do something. “added robo vacuum cleaner integration to my home assistant. Had to use version 1.2.3 because my robot is an older gen. Password’s on my phone.” helps a lot when something goes wrong later and you forgot what you did.

• test backup recovery. Just delete everything and see if and how you can get it back. If you’re afraid to do that, you don’t have a backup.

• simple monitori

For monitoring, I’d start with alerts on changes you didn’t make. Save a baseline of listening ports with ss -tlnp and of running containers with docker ps --format '{{.Names}} {{.Image}}', then have a daily cron job compare both against the baseline and push any difference to your phone with ntfy.

Keep the baseline files outside your Docker volumes.

Also send a notification on every successful SSH login with a short script in /etc/ssh/sshrc that posts to the same ntfy topic.

Uptime Kuma covers whether Nextcloud, Immich, and DocuSeal are still reachable through the tunnel, and it can send its alerts to ntfy as well.

Drafted with AI.

What I did was setting up two routers. The outer one is a big filter, and the only packets coming in went through it.

If someone would have managed to take over this outer router, the next step would have been to probe the inner router. For this, they would send packets originating at the outer router to anything on the inside net.

This would trigger an alert on the inner router that switches a relay, cutting the power on the outer router.

Thank you all for your advice and tips. I am very overwhelmed by the sheer amount of information that’s been given and I’m going to spend some time digesting and reading up on these things. Lots of terminology is over my head at this point and I have a lot of learning to do.

My passwords for OS and all admin dashboards are extremely long, unique, random strings managed by Bitwarden.

If you are paying for Bitwarden, or using their free tier, stop and and start hosting vaultwarden. You can still use the Bitwarden app, with vaultwarden but with all the premium features.

Get a firewall you can either install OpenWRT or opnSense on, when making my decision I went with OpenWRT because opnSense has a webpage that tries to upsell you. vLAN the heck out of your place, and set up a VPN to access your services like vaultwarden out side of your home. On a vLAN that cannot access your WAN or anything else put your IoT things, on a vLAN that cannot access anything else setup crowdsec. On the topic of crowdsec it should be your only device that port 22 is ssh!

For your IoT things set up home assistant, which should be on a different vLAN that can reach out to the WAN and into the IoT vLAN to control stuff. I wish I could say I have completly degoogled and deappled, but I am waiting for a year for my iPhone to stop getting updates and whenever for my iPad to stop getting updates. I should probably replace my homepod minis sooner rather than later with the Naebu things for HA. The only thing I still have a Google account for is youtube but once I get a hand me down Mac mini I will install Debian and get a youtube replacement with sponsor block.

One of the things that finally got me off of cPanel was the host I was using decided to rape me over the coals without letting me have a wildcard email address so I got a business plan that I could have unlimited email addresses so if one got spammy I could just turn it off and if I still used the service I just changed the email, or if I wanted to extend a free trial I could just spin up a new address. So I recently moved to a new host that offers wild card addresses.

Get a whole LAN adblocker, let it be pihole or adguard home, there was recently that spyware ad pixel so expect more of those in the future. Me personally use pihole and have it very finally tuned to block a lot. I tried adguard once but liked pihole better, this was years ago even before I had pihole finaly tuned so don’t ask me why I liked pihole more.

Grab OpenBao (Opensource Hashicorp Vault) and begin using key management. You can do things like app roles, TOTP, single use wrapped tokens, key rotation and more to make sure that long lived access doesn’t exist.

Removed by mod