Hi selfhosters,
I’m considering improving the security of my homelab/server setup and I’d love to hear some more experienced opinions on my plans.
Like most self-hosters, I started out with a single-server setup: I cobbled together some old hardware, slapped on a NAS-style OS, bolted on Docker and started experimenting. As things go, my setup has grown a lot over the years. I’m running a lot on that machine - NAS capability, local DNS via pihole, a Wireguard VPN endpoint (so I can tunnel into the LAN from outside), many private services (accessible only from inside the LAN), but also some public ones accessible from the open web.
Although I’ve tried to do my homework in terms of security (various hardening measures for SSH and Docker, reverse proxy, proper SSL termination for everything), I realise I’ve put a lot of eggs in that one basket and I might want to introduce some network segmentation.
I don’t think I’m ready for getting a hardware firewall or a router/switch capable of VLANs just yet. What I’m considering, though, is putting my services available from the open internet on a separate server inside my network - a little Pi 5 I’ve still got lying around. My idea is that if a container on that is breached and if an attacker manages to escape the container to gain root access, compromise would be limited to the few of publicly available services I have on the Pi, thus limiting blast radius. If combined with (software) firewall rules that make the Pi a ‘pariah node’ (dropping all incoming connection efforts), lateral movement to other devices on the network could be contained.
An alternative would be to finally make the move to Proxmox. Everything would still be running on one physical machine, but I’d create several VMs: there would be one for private, one for publicly available services, and I’d firewall the latter off rigorously so it cannot connect to anything else.
I’d like your opinion on these plans. Which one would you recommend? Are they both sound, or is there anything I haven’t considered? Are there other (easy, non-hardware intense) things I could do to improve security even more?
I’ll start again with the threat modelling. How worried are you about an adversary acting with a compromised container? Is it just fear of an attacker or are you trying to protect something specific? If so, identify that service and/or data and isolate it. Start with what you want to protect. Does it need to be on a different physical device? If not, do you need kernel level separation (VM) between systems? That separation will have overhead associated with it. Does the compute cost reduce your risk enough to justify the separation? Moving onto multiple different boxes has its challenges as well. Yes you are more segmented but do you have the network bandwidth to support the services you want? Also, do you need those publicly available services actually exposed to the internet? If you are already using wireguard, what difference does it make to create keys for your other devices to be able to access the environment? In this age of AI running rampant, reducing your external attack surface is the single greatest thing you can do to protect yourself.
Opinion time. Build on what you have and know. If you haven’t physically separated your machines yet and everything is running on docker, look into building docker networks. If you have the networking expertise and multiple devices to run things, bite the bullet and migrate to a new set of systems. From what it sounds like, you don’t have much experience with Proxmox and that is fine. Running a few Ubuntu servers with vms and containers works great as well. Look into your firewall rules. You can use AI to help you draft a firewall table. What services need to talk to what systems? Whitelist those and blacklist everything. Once you have an understanding, look into VLANs. I personally have 3 machines running on my home domain and they are separated by functionality with like 8 separate vlans woven between them. Adversaries care about home servers for two reasons (mainly): crypto mining and botnets. Your description of the hardening already manages most of these threats. Physical or virtual both work but build your controls and networks around what you want and know. Does that make sense?