So I’m relatively new to server hosting. (But experienced with remote web hosting from providers.) After about a year of fighting to run Nextcloud on a hosting company and finally losing everything from the cPanel vulnerability a few months ago, I broke down and launched my own home server. I’m looking for advice to maximize security.
CachyOS Linux with ClamAV Docker via Portainer Nextcloud (E2EE), Immich, DocuSeal and NoteTrace Routed through a domain and subdimains via Zero Trust Cloudflare Tunnel and Cloudflare DNS.
I have regular redundant backups both onsite and offsite with Duplicati.
My passwords for OS and all admin dashboards are extremely long, unique, random strings managed by Bitwarden.
I know just enough about this stuff to get into trouble. What else should I setup? I have little to no monitoring going on and don’t know much about that direction.
Have you read the TOS of your ISP, are you allowed to run a home server exposed to the internet?
It might be a good idea to at least read what the TOS says just so you are aware of potential consequences.
Can an ISP forbid you having your own home server? That doesn’t sound legal. And if I am not mistaken the cloudflare tunnel is a lot like tailscale (which i would recommend over cloudflare anyway) it doesn’t need open ports or anything like that.
They can forbid you from anything and they can terminate your service for any reason
And if you do, make sure to read them thoroughly. Most of these rules apply to for-profit hosting only. Or they’re vague and they can’t enforce them. And most contracts don’t have rules anyway. They’re mostly concerned with you not attracting DCMA complaints or a virus hosting some spam email server.
If the OP has it only reachable via a VPN, that might be good enough, it’s not directly exposed. But otherwise yes.
Another, more important problem with publicly available home server: they lost their data when their setup was maintained by a professional hoster. According to the OPs words, they themselves “know just enough to be dangerous”.
Exposing any of this to the public internet wouldn’t be a good idea however you put it.