第5話Chapter 5
The server with one door
扉が一つの要塞
A self-hosted VPS where the only way in is a WireGuard tunnel, with a default-deny firewall and CrowdSec watching the front.
My own server at kyro.ninja. Wiki, documents, mail, a blog and more.
Everything online is being poked, all day.
Self-hosting means being your own security team.
Expose only what has to be public.
Deny everything first, then open doors one at a time.
Default deny.
The locks:
SSH and admin panels reachable only over WireGuard.
A default-deny nftables ruleset that survives reboots.
CrowdSec with a firewall bouncer, plus rootless Docker.
Docker Compose services behind Nginx Proxy Manager, with Authelia single sign-on and two-factor in front.
One door!
Public traffic reaches the web apps. Everything else needs the tunnel.
Sleeps well.
Firewall rules are saved from the live ruleset, never hand-edited.
End of chapter 5
To be continued. Read the afterword