As mentioned in the post. I would probably not use this setup with my more "exposing" projects like full web apps.

Yeah, I would decouple it from any residential ISP, but use a $4 VPS to still self-host. That also removes the need for a DDNS setup. Given some basic Linux skills, all you need is SSH plus nginx+certbot on Debian with unattended-upgrades or similar, that you can point your domain to.

Would recommend Tailscale over SSH.

Really easy to setup/use and means you don't have to open up ports like 22 which are constantly being port scanned.

You can move ssh to a different port.

Anyone who thinks they need to move ssh to a different port likely doesn’t have their ssh security configuration setup optimally.

Making it explicit: try to always use keys for ssh, avoid passwords. If you have to use passwords, make it very long (20+ chars) and random. Don't use dictionary words or reuse passwords from anywhere else.

Yep, and I always additionally just disable pw authentication altogether, and set PermitRootLogin to either No or without-password.

You can also do things like firewalld off (or with hosts.allow) 22 to just an ssh bastion/jumphost src (or your house IP), but I find that’s usually not necessary (although an excellent further step if you are a bit paranoid) as long you do what was mentioned in first paragraph.

I don't get it, wouldn't you use ssh keys and also just move it to a different port anyway to save the annoyance of random scriptkiddy pokes all the time?

Moving the port away from 22 changed my fail2ban logs from hundreds of lines a day to one every few weeks at most.

While you shouldn't skip on other security measures, there's no real downside to changing your SSH port and getting off the target list for a lot of botnets.

(As opposed to e.g. port knocking, which is stronger but makes it easy to lock yourself out and may create issues with some SSH clients.)

There's other reasons to use a different port. I move it to cut down on the failed login attempts (yes they'll never succeed given I only allow keys) but they clutter the log so I can't tell if I'm actually being targeted or not. On an obscure port if I do see attempts I know something serious is going on.

I'm not familiar with Tailscale, but you can easily use a different port than 22 for ssh if you want to; put a different port number in `/etc/ssh/sshd_config` on the server, and then set your `~/.ssh/config` to use that port on your clients. If you're going to be opening it up externally, you also can map a different port to the local one (which is necessary if you want to be able to ssh into two different servers with the same ssh port from the outside anyhow).

Indeed. My friend had a crypto miner put on his self-hosted server.

This was merely weeks after telling him to switch to Tailscale, but it was a great learning experience.

I was running a couple million page views/mo on a cluster of raspberry pis in my parents home a few years back. After some disruptions on my family's network I decided to setup a Wireguard VPN with Docker Swarm and a GCP instance to essentially route from GCP IP address -> Raspberry pi cluster such that my IP wouldn't get leaked and didn't have to worry about dynamic IP addresses

Very hard to do and finicky to setup but at the time was suitable for my needs

Why not sure cloudflare?

Using a web browser with JS execution enabled is a lot more dangerous than running nginx showing .html files in directories.

If you're using a modern web server like nginx, then you have to really do something wrong to get hacked serving static files.

That's not really fair, zero days will always exist.

What setup is immune to zero days?

S3, Github, Netlify etc are going to be infinitely more secure than your home setup.

And are basically free.

But no more immune to zero days

theyre not immune to 0-days tho.

they just have more staff on hand to respond, run updates, and do the due diligence of checking and implementing patches.

In order to be fair, threat models should be taken into account. People seem to be conflating nation state operations using advanced capabilities worth at least hundreds of thousands of dollars to compromise high value targets/infrastructure with "my pet project may get 0 day'd" which is the exact opposite of being fair. Moreover, if the argument is "zero days will always exist" you may as well stop using technology entirely.

Agree - an up-to-date system running only nginx and fail2ban is likely to be more secure than some vendor's who-knows-what's-on-it image which exposes various "services".

You don’t get perma-banned from your ISP for getting malware. That’s pure FUD.

Far more people (at least 2 orders of magnitude) end up infected with malware and become members of botnets from just clicking dumb shit. They don’t get banned from the ISP either.

I had my cable ISP call me a couple times about a business account a few times. I run my own mail server. A POP3/SMTP account got hacked and started sending out spam. They're very polite, professional, ask you to fix the problem and move on.

I'm surprised you got a phone call, when I worked at a tier 2, we would just disconnect you and wait for you to call us instead.

running your own mail server is an exercise in pain. not sure if you're brave or dumb, but props to giving it a go.

Heh. I've been running my own since the mid 90's. Originally I worked for some early ISPs, and continued it as a hobby of sorts. (My main personal email is on gmail.)

If you're running an email server that is running at full throughput to send spam (due to your clear negligence) from a residential ISP account then depending on what plan you've purchased it may violate your terms of service.

I know of friends who have been banned for doing exactly this.

But you will get banned from your isp if they find out you are self-hosting a blog and photo album shared with family and friends.

Depends on your ISP. I use one of the biggest ones in the US, and they won't do any such thing. They don't care if you're running servers at all, unless you start getting a lot of incoming traffic -- then they'll ask you to upgrade to a commercial account or stop it.

I've been running servers used by family and friends from my home for about 20 years now. It's never been an issue at all.