A personal server isn't a geek's toy: it's a tool of sovereignty. Taking back control of your data instead of renting it from services that change the price whenever they want and shut down whenever they want. Here's the real subject — and above all what to put in place — for anyone who wants to do the same without being an expert.
The real subject: keeping control
Self-hosting isn't a technical whim. Your data, your tools live at home, in formats you control, on open-source building blocks no one can take away from you. No one can cut access, raise the bill, or read over your shoulder. Security isn't the goal: it's the means of holding that position.
What I take from it — A server is first a choice of sovereignty. The goal is keeping control.
The one idea that matters: reduce, don't armor
A brand-new server plugged into the internet gets probed by bots in under a minute — not a spy, a machine chaining through default credentials. Sophos measured it in 2019 on ten decoy servers: the first attack arrived 52 seconds after going live. Against that, the beginner's reflex — complicating passwords — is the wrong one. The real defense is removing doors, not adding locks. A service you can't reach can't be attacked, whatever its flaw.
What I take from it — What isn't reachable can't be attacked. Reducing the surface comes before hardening it.
What to put in place, in order
The order matters as much as the steps: reduce the surface first, harden the rest after.
- Closed by default. A firewall that refuses all inbound traffic; open only the strict minimum. Admin access by cryptographic key alone (no password — that removes anything a bot could guess), restricted to known addresses.
- Make internal traffic invisible. Everything internal runs on an encrypted private network, unreachable from the internet. Only what must be public stays public, behind authentication. Check from the outside, not from your own machine — that's how you discover a service you thought was private was actually open.
- Back up immutably, and test it. The rule: three copies, two media, one off-site, one immutable (locked in time, which ransomware can neither erase nor encrypt). A versioned backup tool rather than a plain mirror. And above all, the step everyone skips: actually restore at least once.
- Post a watchdog. An automatic alert when an expected backup didn't happen. The silent failure is the costliest trap — you discover it the day you need it.
- Scan and detect. A regular scan for known flaws in your software — while pinning a known-good version of the tool itself: in March 2026, Trivy, one of the most widely used scanners, was itself compromised. And a file-integrity monitor for system changes.
- Keep the two questions separate. "Is it running?" isn't "is it secure?" A green dashboard that only measures outages stays green while a flaw sleeps underneath — a comfortable lie.
What I take from it — The order makes it hold: reduce the surface (1-2) before hardening (5-6).
What this changes
You don't become a security expert, and that's not the point. You go from a pile of forgotten settings to a repeatable method — one that survives the next reinstall, and leaves you in charge of your own tools. It isn't invulnerability: it's no longer depending on anyone for what matters.
I've turned this list into a repeatable installation, scripts and hardening included. If you want to set it up without losing weeks to it, that's exactly what I do at Orogen. Write to me, let's talk.
Sources
- Sophos, Exposed: Cyberattacks on Cloud Honeypots, April 2019 — first attack 52 seconds after going live, 13 attempts per minute per server — sophos.com.
- Aqua Security, advisory GHSA-69fq-xp46-6x23, Trivy ecosystem supply chain temporarily compromised, March 2026 — github.com.
- The detailed, step-by-step guide: see the resource Deploying sovereign infrastructure.