Hi selfhosters,
I’m considering improving the security of my homelab/server setup and I’d love to hear some more experienced opinions on my plans.
Like most self-hosters, I started out with a single-server setup: I cobbled together some old hardware, slapped on a NAS-style OS, bolted on Docker and started experimenting. As things go, my setup has grown a lot over the years. I’m running a lot on that machine - NAS capability, local DNS via pihole, a Wireguard VPN endpoint (so I can tunnel into the LAN from outside), many private services (accessible only from inside the LAN), but also some public ones accessible from the open web.
Although I’ve tried to do my homework in terms of security (various hardening measures for SSH and Docker, reverse proxy, proper SSL termination for everything), I realise I’ve put a lot of eggs in that one basket and I might want to introduce some network segmentation.
I don’t think I’m ready for getting a hardware firewall or a router/switch capable of VLANs just yet. What I’m considering, though, is putting my services available from the open internet on a separate server inside my network - a little Pi 5 I’ve still got lying around. My idea is that if a container on that is breached and if an attacker manages to escape the container to gain root access, compromise would be limited to the few of publicly available services I have on the Pi, thus limiting blast radius. If combined with (software) firewall rules that make the Pi a ‘pariah node’ (dropping all incoming connection efforts), lateral movement to other devices on the network could be contained.
An alternative would be to finally make the move to Proxmox. Everything would still be running on one physical machine, but I’d create several VMs: there would be one for private, one for publicly available services, and I’d firewall the latter off rigorously so it cannot connect to anything else.
I’d like your opinion on these plans. Which one would you recommend? Are they both sound, or is there anything I haven’t considered? Are there other (easy, non-hardware intense) things I could do to improve security even more?
I personally go with VMs. Except of some services that I run on Hetzner.
I got one Debian server that runs multiple VMs with tailscale. Then one Hetzner VPS with Caddy. This one acts as a public gateway.
Some things are still running bare metal, like Immich or Jellyfin because of apple hardware. However the level of entropy I have now is th opposite of all eggs in on basket. I sometimes forget what do I have where and have to look it up in my docs.
This sounds a lot like my second option, except yours is a little more custom-made. What do you use to set up and run your VMs?
virt-manager for qemu. I also did some cloud init script with LLM to have a nice way of spinning up new vms with a server user, ssh and my access keys. VMs have also on big advantage. It’s easy to back up entire qcow2 disk image and then if necessary move entire VM to a different host.
Ah! I use virt-manager + qemu on desktop Linux, mainly to try things and and contain dodgy software (Windows). I didn’t know it was commonly used on headless servers. Thanks for pointing that out!
combine your VMs with a little layered LXC garnish for that special touch :-)
I was in your position a few years ago. Went the Proxmox route. For many services, don’t make separate VMs, but instead separate LXC containers. Saves time and space.
I’ve done my research on that, and apparently LXCs share the host kernel, meaning: if the LXC is compromised, so is the host system. So if I go with Proxmox, I’ll probably swallow the (somewhat) larger overhead of running a full VM.
