Selfhosted

• Update frequently.
• Use HTTPS. Redirect all HTTP traffic to HTTPS. If you use Caddy as a reverse proxy, this is pretty easy to set up. You‘ll want to get a domain name though.
• If you use systemd, then systemd-analyze security (with man systemd.directives) is your friend. Be as restrictive as possible without breaking functionality.
• Consider putting services like Jellyfin or Nextcloud in their own containers/VMs.

You don‘t need Cloudflare. I don‘t know why half the commenters in this thread recommend it. Cargo cult? You don‘t need DDOS protection. Nobody does DDOS attacks on random home servers. You don‘t need to hide your IP address either. Just make sure that you only expose port 80 and 443 to the internet and nothing else, and don‘t expose the admin interface of your router to the internet.

Alternatively as others have suggested, if you‘re not sure about your ability to secure everything, only expose your services over a Wireguard VPN. You don‘t really need Tailscale if you only want to manage a handful of devices, and you also don‘t need Tailscale‘s mesh networking for your use case.

I am using Tailscale.

I went for wireguard VPN instead of exposing services. Its much more safe afaik, but you have to configure each device you want to give access (aka scanning QR code). You also dont need to buy a domain for that. Exposed services would be easier to use, especially if you want to use it on many devices

If you are just exposing port 80 and 443 (standard web ports) cloudflare proxy is free and will work well to hide your IP.

Get yourself a domain name then use Cloudflare DNS to set an A record pointing to your home IP. If you have a dynamic IP (one that occasionally changes) you'll want to read this: https://developers.cloudflare.com/dns/manage-dns-records/how-to/managing-dynamic-ip-addresses/

As soon as you put something up online, you will de facto become a target with nowhere to hide except offline. Your IP will be known and constantly hammered by more or less serious threats.

If you don't know the basics of Linux system administration and typical security measures, I would propose 2 approaches: you can go "the NAS way" and purchase something turnkey like a Synology (or anything on which you can easily spin up containers to host your services). You can expect a large part of the administration to be taken care of with sound default settings.

Another approach is to use a beginner friendly distro like https://yunohost.org/ , perhaps more involving, more risky, bit more rewarding.

Also, don't put anything up there like personal or valuable information (except if encrypted with local-only keys), expect to be hacked, expect to be wiped, and think early on about (off-site) backups.

Duckdns.org for dynamic dns. You can get a domain name like example.duckdns.org for free.

Caddyserver.com to reverse proxy to your running docker services. You’ll be able to set up jellyfin.example.duckdns.org

Crowdsec.net to secure the network

Tailscale for access to running docker services that you don’t need to share with friends.

i have a lot of stuff exposed to the web. i got a domain from godaddy, attached my public ip and created a subdomain for each service. than i have traefik that manage the tls and route each subdomain to each of the docker containers.

in total i have exposed 80, 443, and a random port i use for ssh. of course ssh is only by public key.

now i'm trying to set up fail2ban on the exposed services since someone could bruteforce them.

The other day I learned about endlessh. I set that up, switched my actual sshd to listen on a different port, and the ssh login attempts from randoms essentially went down to 0. Pretty neat.

Best advice I can give is to make sure the default virtualhost on nginx/apache just sends a 404 to all requests to your IP, and only serve the apps you want when they’re accessed by the correct hostname. The vast majority of spammy scanners are just hitting all public IPs, so as long as you don’t tell them what you’re hosting you’ll be alright.

Then, I’d advise having some sort of basic web application firewall (WAF). Modsecurity is a common one, NAXSI is another. These take some time to set up, but are quite good at absorbing attempted attacks.

My approach was to set it all up internally, create a wireguard VPN accesspoint and only open that up. That way I don't have as much to worry as much within the network (still use generated passwords for things) and able to access it anywhere.

Granted, you asked about opening up to the www. I'd suggest buying a domain through cloudfront, setting up an nginx instance that proxies traffic (think nextcloud.mydomain.com), and have it only accept connections from cloudfront servers.

That allows you SSL termination, pretty good bot coverage, and a nice domain name to share as needed.

General advice would be to look boring and hide your IP as much as you are able (get a domain). As long as you're not looking juicy you won't attract skilled attention. It's like locking a bike, most bad actors will just pass by looking around for one without a lock or a real fancy one worth their resources.

You can utilize Cloudflare's free offerings, starting with simple stuff. Their DNS Proxy is essentialy a single-click but will help substantially. You can build on top of that with simple WAF rules, such as droping connection attempts from IPs originating from countries notorious for "poking around". You can also reverse that rule and whitlelist only your country.

Keep your firewall tight, don't expose other ports, put your services behind a reverse proxy and redirect everything to HTTPS. Start simple, constantly improve, learn more advanced methods/concepts.

Just make sure you know how to properly secure your network, check logs, ensure you have logs. ensure you have backups in a secure location.....

And, be prepared for the constant barrage of vulnerability scans, and login attempts.

It comes down to using secure passwords, 2 factor authentication, and updating software as soon as you can.

Check out Cloudflare's zero tier tunnel to only expose the services you need without port forwarding. Added benefit of masking your home's IP behind Cloudflare to prevent DDOS. Only downside is you need your own domain.