Best practices to self-host a blog/small website? reddit / selfhosted ---------------------------------------------------------------------- puckpuckgo · 2023-12-04 18:31 I'd like to self host a website with WordPress or Ghost as I have hardware that is capable of doing this. I haven't pulled the trigger because I keep hearing horror stories about exposing anything to the internet. I wanted to get some opinions on the following setup: ​ https://preview.redd.it/jpu822unmb4c1.png?width=2090&format=png&auto=w ebp&s=16878740829c4a153c92fb28cc8b09738e3d8b0e The UDMP is my only router and I use this for a bunch of private traffic (regular use, cameras, IoT, Wireguard, etc.) It has a Ubiquiti switch connected to it which has a box with Proxmox connected to it, which is where everything else is connected to. This Proxmox box has a single RJ45 port through which all traffic passes back and forth from the switch. What security considerations should I have if I'm already assuming that someone will break into the WordPress/Ghost VM? I was planning to completely isolate both the NPM and the WP/Ghost IP addresses from everything else via firewall within Proxmox and at the UDMP level (I use VLANs). The only thing I cannot do is isolate the NPM/WP boxes from the rest of the Proxmox box since I only have 1 LAN port. I am, however, expecting to get a PCI card soon which has two 2.5 GB ports on it. ---------------------------------------------------------------------- Defiant-Ad-5513 · 2023-12-04 22:15 To go saver just wait for the card and don't use the NPM container just use cloudflare access for any access rules. ---------------------------------------------------------------------- No_Bee_7194 · 2023-12-05 03:14 👀What an unbreakable architecture. I cannot provide any useful suggestions. I just want to say thank you for sharing. This will be my new goal. ---------------------------------------------------------------------- ZaxLofful · 2023-12-05 05:49 I use Docker + Cloudflare Tunnels w/ app firewall ---------------------------------------------------------------------- kumbaya_03802 · 2023-12-05 11:09 I'm currently hosting a Davis [weather station website](https://www.ralphsshack.com) on Wordpress at home on a Rasp. Pi 3B+ for a few weeks now. Used to host it on a Rasp. Pi Zero W before because I used the bigger Rasp. Pi as an Omada controller. The wireless Rasp. Pi now functions as a secondary AGH ad blocker & a crontab machine. My main AGH ad blocker runs on the bigger Rasp. Pi & running together with my web server. I try to keep things simple these days. I stopped running things on bigger machines like NAS servers in the past. I have a bare metal server setup on Debian with UFW & Fail2Ban. I use Cloudflare tunnel so I don't have to open server ports. Also, limit SSH port access on UFW. I used a lighter software firewall on Wordpress (BBQ Pro) & kept the site software info (changed login URL, copy protection, etc.). It's more about caching & preloading server assets these days if you want things to run smoothly on a smaller server machine. I used Nginx FastCGI to cache pages & PhpRedis as an object cache. Page cache (WP Fastest Cache) plugin works fine too in the past. ---------------------------------------------------------------------- Simon-RedditAccount · 2023-12-05 11:37 Have you considered publishing just a static website? Like vanilla HTML, Publii, Hugo etc. The only thing you need is just a static webserver, so even nginx will work - and work perfectly. Much more secure than PHP/Node.js + CMS + CMS plugins. Or you can even host the static website not at home: say, with Cloudflare Pages. >What security considerations should I have if I'm already assuming that someone will break into the WordPress/Ghost VM? DMZ is what you want. A completely isolated network that hosts your external service(s), without any access to home network. How will you implement it, is another question. Some people set up different VLANs, some people do heavy firewalling. Also, it's wise to restrict outcoming connections from DMZ. Say, all you need is to whitelist WP's update server and SMTP that you use to send emails; and completely block any other resources. Even if bots/attacker break into, such a compromised host won't be of much use. ---------------------------------------------------------------------- kumbaya_03802 · 2023-12-05 11:57 I agree. He doesn't even need to run a regular preload & only cache pages once posted or if he makes some revisions/changes to it. Even an old $15 Rasp Pi is an overkill for such setup. ---------------------------------------------------------------------- domanpanda · 2023-12-05 12:00 I would be hesitant to homehost even static pages but in case of dynamic ones i would rethink idea twice or triple times. Especially when we talk about WP. Years ago i was working with WP v4 and v5 on proffessional lvl and all i can say that back then you had to have REALLY good knowledge about WP, it's plugins and security overall to secure this CMS. Plugins were written poorly, database was a pure mess, default config was invitation for hackers (especially comments engine), zero days popped up often. Just nightmare. Especially in multisite setups. So yeah, i wish you good luck with your plan. In your case i would rather look for some cloud or VPS and use separate email and randomized password when setting it up. ---------------------------------------------------------------------- jogai-san · 2023-12-05 16:20 Just publish a site to netlify, github pages or something like it. Astro is nice for that. ---------------------------------------------------------------------- eddyizm · 2023-12-05 18:36 Be interested in what you end up with. I've used cloudfare tunnels for temp stuff but I am trying to set up zerotier on a vps to reverse proxy to my homelab. Currently having some networking issues. 😵‍💫