So I’m relatively new to server hosting. (But experienced with remote web hosting from providers.) After about a year of fighting to run Nextcloud on a hosting company and finally losing everything from the cPanel vulnerability a few months ago, I broke down and launched my own home server. I’m looking for advice to maximize security.
CachyOS Linux with ClamAV Docker via Portainer Nextcloud (E2EE), Immich, DocuSeal and NoteTrace Routed through a domain and subdimains via Zero Trust Cloudflare Tunnel and Cloudflare DNS.
I have regular redundant backups both onsite and offsite with Duplicati.
My passwords for OS and all admin dashboards are extremely long, unique, random strings managed by Bitwarden.
I know just enough about this stuff to get into trouble. What else should I setup? I have little to no monitoring going on and don’t know much about that direction.
If the OP has it only reachable via a VPN, that might be good enough, it’s not directly exposed. But otherwise yes.
Another, more important problem with publicly available home server: they lost their data when their setup was maintained by a professional hoster. According to the OPs words, they themselves “know just enough to be dangerous”.
Exposing any of this to the public internet wouldn’t be a good idea however you put it.