# Self-Hosting Minimalism Self-Hosting is hard. You have to manage security, networking, backups, services, updates, and hardware. I prefer to avoid third-party dependencies. ## WireGuard The only port exposed to the internet is for WireGuard. All clients that want to use my self-hosted services must be connected to the VPN. I use a LAN network such as `192.168.199.0/24` so that clients can continue to access the LAN they are actually on (typically `192.168.1.0/24`). ## Firewall I like to use WireGuard to restrict access to services, and like services to be user-less and password-less if possible. ### Preventing local users from accessing services These services are bound to the WireGuard interface `192.168.119.1`, but local user accounts and processes can still access these services. This is a potential security vulnerability. We can use firewall rules to only allow remote clients to access these services. I do not use the PostUp/PostDown commands in WireGuard to establish the firewall because these services should remain inaccessible at all times. ``` define WG_IP = 192.168.199.1 chain output { type filter hook output priority 0; policy accept; ip daddr $WG_IP meta l4proto tcp reject with tcp reset \ comment "Block locally-generated TCP to WireGuard IP (fast-fail)" ip daddr $WG_IP reject with icmp type admin-prohibited \ comment "Block locally-generated non-TCP to WireGuard IP (fast-fail)" } chain input { type filter hook input priority 0; policy drop; meta iif "lo" ip daddr $WG_IP drop \ comment "Block lo->WG IP even if something reaches INPUT on lo" } ``` ## Service Manager I use `systemd` and isolate services either using `DynamicUser` or a permanent local user account. ### Actual Budget A decent alternative to YNAB. It requires HTTPS to function properly, even with the HTTP workaround it is not possible to import nYNAB budgets. Luckily, both Firefox and Chrome have settings to treat your VPN as a secure origin. - Firefox, in `about:config` set `dom.securecontext.allowlist = 192.168.199.1`. This must be the hostname without the protocol or port number. In addition, you should set `security.mixed_content.upgrade_display_content = false`, otherwise images will not load on that hostname any more (for other apps like Home Gallery). - Chrome, in `about:flags`, set `insecure origins treat as secure = http://192.168.199.1:5006`. This must include the protocol and port number. Restart browsers for it to take effect. ### Home Gallery A very lightweight gallery.