How it's protected and built

1. The front door: almost nothing is open

• The router forwards only what the public services need: the website, mail, live streaming and game voice.
• Checked by outside scan on 2026-10-13.
• Every web app sits behind one reverse proxy (Nginx Proxy Manager). Apps never publish their own ports to the internet.
• HTTPS everywhere, with certificates renewed automatically; plain HTTP is redirected.

2. Admin tools are invisible from the internet

• Management panels (containers, databases, DNS, downloads, dashboards, the proxy itself, the VPN server and the identity admin console) answer only to the home network and the VPN. From anywhere else they refuse the connection, each one tested from outside.
• Being on the right network is not enough on its own: where a panel has single sign-on, both checks must pass, the right network and the right identity. Two keys, not one.
• The VPN's own admin side is not reachable on the home network at all, only through the proxy and single sign-on.
• Every rule was tested from three places: the open internet, the home network and a real VPN tunnel.
• Public sign-in pages for the apps stay reachable, so locking the admin side never locks users out.

3. One identity, checked properly

• Sign-in runs through Keycloak (single sign-on with OpenID Connect) for 20+ apps: one account, one place to set password rules. Two-factor authentication is required for every password sign-in, and repeated failed sign-ins lock the account for a while.
• Tools that have no login of their own sit behind an authenticating proxy (oauth2-proxy), so they are never open by accident.
• Registration is closed where it is not needed; new accounts are created on purpose.

4. Remote access through an encrypted tunnel

• Remote access runs only through a self-hosted zero-trust mesh (NetBird), never through open ports.
• Signing in to the mesh goes through the same single sign-on, so there is one account and one place to revoke access.
• Access is per group and denied by default: friends reach game streaming and nothing else; only admins reach internal systems; devices can't see each other unless a policy allows it.
• Tested with two devices: the admin one reached the internal systems, the other reached none.
• The mesh's setup page stayed invisible from the internet until the first administrator existed.

5. DNS that blocks the bad stuff

• AdGuard Home blocks ads, trackers and known malicious domains before a connection is made, at home.
• Its own lookups are encrypted, validated (DNSSEC) and sent to two independent resolvers.

6. Privacy where it matters

• Download and media-fetching traffic leaves through a VPN container with a kill switch: if the tunnel drops, that traffic stops instead of leaking.

7. Every service in its own box

• Each app runs in its own container on its own internal network. A problem in one app does not hand over the others.
• Secrets live in environment files and a self-hosted password manager (Passbolt), never in code.
• The mail server bans IPs that keep guessing passwords (fail2ban).

8. Watching and recovering

• All network addresses live in one settings file, so a new router or a move means editing one file.
• A watcher keeps an eye on the home internet address, asks several independent sources and acts only when they agree. If the provider changes it, the access rules update themselves and I get one short mail.
• Every change is backed up first and can be undone one service at a time.
• Alerts for runaway CPU, disk health and failed jobs go straight to my inbox.
• Dependency updates are proposed automatically every week and reviewed before they land.
• Daily database dumps plus encrypted, versioned backups (restic) on separate disks, all kept in-house, with a weekly integrity check of the backup data.