Oh, that is totally understandable, I wouldn’t even ask for that. I thought it would be a publicly accessible technical blog about homelabs in general.

Hm. I don’t think I had the chance to notice Nextcloud’s caveats as I’m the only user. I’ve set it up along with a collabora and Talk high-performance backend on separate vm-s, but I have noone to talk to as I’m the only user. <hide-the-pain-harold.jpg>

Speaking of GrapheneOS I used it on my Pixel8 for a year as daily driver, and it is great for the peace of mind of the privacy-cautious user, but at some point I came to the conclusion, that I want my mobile phone to be a single convenience device and returned to stock Android (I don’t like it, but this was a point of friction between my life and my hobby). I tried to live with an old Motorola Razr, then a modern 4G feature phone, tried using multiple phones, phone with a custom rom, GrapheneOS, but then my paranoia got defeated by everyday convenience.

VPS-es are useful, I totally agree. I have two usecases where I needed something with a static IP, and those were the solution attached to my home network with wireguard tunnel. 1. cloud connector to GoCardless to handle token exchange to retrieve my bank transaction information into an internal DB, and 2. email-relay server, so my mailcow instance can communicate with the world, but I don’t have to deal with mail traffic through my own firewall. Yeah these VPS-es have custom SSH ports, no password login, no root login, as I remember I’ve set it up to accept ssh connection only from the wireguard tunnel and fail2ban hands out ban for even pinging these VPS-es (yes, I managed to lock myself out twice. :D ).

Are you blogging about your homelab? I’d take a look if you don’t mind sharing the link just out of curiosity.

If you don’t mind I’d share my scenario with you, but I’m far from a professional myself, so in the same time I’m also asking any thought about my own approach.

For my public facing services (e.g. Nextcloud) I’ve created a separate VLAN which is completely isolated from the rest of the system, I’ve deployed an nginx LXC with Crowdsec/fail2ban, and opened very specific “pinhole” style firewall rules towards the service layer VLAN in OPNsense. I’ve also separated this service / app VLAN layer from the database layer (which is another VLAN with strict firewall rules and SSL). For authentication I use what the service offers natively, except for some cases of keycloak / hardware key.

Based on my research, this should be a solid baseline, but honestly noone more knowledgeable than myself has confirmed it, so take it with a grain of salt.

The first sentence gives away, that this is not a technical, but a psychological question. I think most of us know this feeling of this kind of urge, I’d say plan ahead, backup then upgrade. Or -depending on your usecase- a clean install and rebuild satisfies the urge even better. :) (no offense, I did this myself multiple times)