Linux

Setting Up ZFS on Linux for Home Server Storage If you’re self-hosting anything important — media libraries, documents, photos, databases — your storage layer matters more than any app you run on top of it. A single bit flip, a dying drive, or an accidental rm -rf can wipe out years of data. ZFS was designed to prevent exactly that. It’s a combined filesystem and volume manager that checksums every block, supports snapshots, and can heal corrupted data automatically. Originally built by Sun Microsystems for enterprise servers, it’s now the gold standard for home server storage. ...

Linux Server Hardening Checklist for Self-Hosters You spun up a server, installed Docker, and deployed a dozen services. Everything works. But your SSH port is open to the world with password auth, you’re running everything as root, and your firewall is… what firewall? Most self-hosting guides skip security entirely. This one doesn’t. Here’s a practical, ordered checklist to harden your Linux server without breaking the services running on it. Who This Is For Anyone running a self-hosted server — whether it’s a Raspberry Pi on your desk, a mini PC in the closet, or a VPS at Hetzner. You don’t need to be a sysadmin. You just need a terminal and 30 minutes. ...

Docker makes self-hosting easy. It also makes it easy to accidentally give an attacker root access to your entire server. Most self-hosting guides skip security entirely — here’s what they don’t tell you. 1. Never Run Containers as Root (When Possible) By default, processes inside Docker containers run as root. If an attacker escapes the container, they’re root on the host. Fix: Use the user directive: services: myapp: image: myapp:latest user: "1000:1000" Or in the Dockerfile: ...

One of the most common security mistakes in self-hosting is accidentally exposing services to the internet. That Redis instance you spun up for testing? It might be listening on 0.0.0.0 with no password. Your database? Possibly reachable by anyone. Let’s fix that. Why Exposed Ports Matter Every open port is a potential entry point. Some services — like databases and cache servers — were never designed to be exposed publicly. They often have no authentication by default. ...

Your self-hosted server is humming along — but is it actually healthy? Disk filling up? Docker containers silently unhealthy? SSH config wide open? SSL certs about to expire? selfhost-doctor answers all of that with one command. Quick Start curl -fsSL https://raw.githubusercontent.com/bird/selfhost-doctor/main/selfhost-doctor.sh | bash That’s it. No installation, no dependencies, no API keys. Just a clean diagnostic report in your terminal. What It Checks selfhost-doctor runs through 7 categories of health checks: ...

How to Set Up Fail2ban: Protect Your Server from Brute-Force Attacks If you expose your home server to the internet, automated attacks will find it. Within minutes of opening SSH or a web service, bots start hammering your server with login attempts. Fail2ban is your automated security guard. It monitors logs for suspicious activity (repeated failed logins, exploit attempts) and automatically bans offending IP addresses via firewall rules. In this guide, you’ll learn to install and configure Fail2ban to protect SSH, web services, and more. ...

Securing Your Home Server: Essential Steps Every Self-Hoster Should Take Running a home server gives you control over your data and services, but it also makes you responsible for security. Unlike managed cloud services, you are the sysadmin. One misconfiguration could expose your personal data, family photos, or entire network to attackers. The good news? Securing a home server isn’t rocket science. Follow these essential steps and you’ll be miles ahead of most self-hosters. ...