I’m a little paranoid, so this is my security set up.

SSH, blocked at firewall level, only allowing specific local IP to access port 22. Also authentication is done by key, with password disabled.

Most services are local only and I access them through wireguard VPN when I’m outside my home.

For services that need a domain name and be public facing, I use a reverse proxy, with the following protections:

• Very restrictive geoIP block, only my country can access.
• Restrictive rate limiting.
• Crodwsec, with community lists, a pluging for open lists, community rules and my own very restrictive set of rules for banning attackers. (For instance as soon as the requested path contains “.env” that’s an instant ban, no second chances).
• Monitoring through grafana.
• Some complex services that need a valid tls handshake but I only want to use them myself have a setup when they are technically open to the net, to get let’s encrypt, but the server rejects every IP request but mine.

Recently I also reduced some noise, surface attack, deleting the A register from my second level domain and using an obscured target for the CNAME records. I also want to delete the www subdomain as it gets a lot of uneeded noise.