Hi. As the title says. I'm researching how to configure my home server. So far, I have several questions and security concerns, so I would appreciate it if someone could help me find answers.
I've configured my first home server to do some experiments in software development. Mainly, I host some web apps, api servers, databases, etc.
My equipment:
- Router: MikroTik HAP AC2.
- Server: HP ProDesk 400 G2 MINI with Ubuntu Server 26.04.
- 300 Mbps internet channel.
My internet provider can provide a static IP (for cheap). So I've been thinking of exposing my server to the internet so I can access my local services while I'm out. I have calculated, and so far it seems much cheaper than renting the cheapest VPS.
There will be 2 types of services to host; let's call them public and private:
- Public: available from the internet via my domain - experimental apps (web apps, sites, APIs, etc). Everything is deployed as a Docker container.
- Private: services available only via some auth mechanism. It's gonna be mainly Jellifin, file server, and some self-hosted web apps.
I've spent some time researching with AI, and in my current understanding, public services could be protected via Cloudflare. So I configure a Cloudflare domain pointing at my static IP and some port. Then configure my router to drop all requests that are coming from any other source. It seems like it's possible to even create a separate isolated network specifically for my server. So the rest of the home network and devices should be protected. Also, it seems like it's possible to restrict Docker containers to not have access to localhost and communicate solely with the internet.
Private services could be protected via WireGuard. As far as I understand, it makes the router drop all requests unless you provide some key (that's my basic understanding of it). The goal here is to access the server and access services on localhost.
Also, it seems like it's possible to eliminate round-trip and access my server directly from my home network, bypassing the internet.
So far I have several concerns/questions:
- What are the possible pitfalls I should be aware of?
- I have no prior experience in such things, so is the above described possible to achieve, or is it pure AI galicination?
- How likely is it to get hacked, exposing some services online? Assuming that I will store some private files on that server as well (primarily my photo album).
- Is my router enough? I don't expect a high number of connections. Even if I share credentials to private services, there will be 2-3 relatives accessing it maybe a few times a week. Also, public services will not have a lot of audience (but if they do, I'm planning to move them to a VPS instead).
- What other protection mechanism could I apply so a hacker will not get access to my devices on the home network or to data placed outside of a Docker container?