Skip to content

Security & Platform Operations

Practical platform hardening for a self-operated web environment: private administration paths, reduced public exposure, persistent host and Docker rules, DNS filtering, monitoring, backups, and traceable operations documentation.

Public summary only: internal hostnames, addresses, secrets, firewall details, and full configurations are not published.

Security Architecture Overview

Layered view of the current platform: public ingress, private management path, DNS and firewall controls, observability, analytics, and recovery with clear responsibility boundaries.

Open full diagram
Security and Platform Operations diagram with access, defense, analytics, observability, operations, and trust boundaries

Current Controls and Operations Building Blocks

Architecture Snapshot

  1. Public Web
  2. VPS / Ingress
  3. Tailscale Overlay
  4. Private Proxmox Runtime
  5. Docker Services
Private AccessReduced ExposureFirst-Party AnalyticsMonitoringScheduled Local Backups

Verified controls include private administration paths, persistent host and Docker filtering, monitoring, and application/data backups with an isolated restore rehearsal. Encrypted secondary copies to removable storage are operator-triggered; automatic failover and complete infrastructure recovery are not implemented.

Access & Network

Private entry paths and controlled exposure.

  • Tailscaleprivate overlay network
  • UFWinterface-level firewall rules
  • Nginx Proxy Managercontrolled reverse proxy entry points

Filtering & Defense

DNS filtering, attack detection, and community threat intelligence.

  • Pi-holeDNS filtering
  • CrowdSecdetection and CAPI threat intelligence; no active bouncer

Analytics & Data

First-party metrics and storage components.

  • Plausible Analyticsfirst-party web analytics
  • PostgreSQLrelational data store
  • ClickHouseanalytics and event storage

Observability

Runtime visibility across hosts and services.

  • Netdatareal-time host metrics
  • Uptime Kumaservice availability checks
  • Dozzlecontainer log visibility

Operations

Container administration and update flow.

  • Portainercontainer management
  • Watchtowercontainer update lifecycle

Security Stack

Network Segmentation

Principle: Reduce attack surface. Impl: Private overlay paths, workload-level separation on Proxmox, and controlled service entry points instead of unmanaged direct exposure.

Firewall Strategy

Principle: Layered defense. Impl: Interface-aware UFW rules, a persistent DOCKER-USER policy, Pi-hole for DNS filtering, CrowdSec for detection, and Nginx Proxy Manager for centralized service exposure.

Secure Access

Principle: No open management ports. Impl: Tailscale on top of WireGuard for private administration paths, consistent SSH access, and controlled remote access to internal platforms.

Observability

Principle: Keep the operating state visible. Impl: Netdata for real-time metrics, Uptime Kuma for service checks, Dozzle for live logs, and Watchtower for routine container update automation.

Operational Outcomes

  • The environment combines private Tailscale ingress, DNS filtering, persistent host and Docker rules, controlled service exposure, and inspectable detection instead of relying on a single security control.
  • Metrics, uptime, logs, analytics, and the container update lifecycle are now visible and easier to operate, reducing routine maintenance overhead across the self-hosted platform.
View Case Study: Self-Hosted Infrastructure >View Operations Layer: The Vienna Fortress >

Case Studies

Layered DNS Filtering and IPS

Challenge: Internal services and clients needed baseline protection against unwanted domains and suspicious traffic patterns.

Approach: Used Pi-hole for DNS filtering, connected CrowdSec for detection, and routed service access through defined entry points.

Outcome: DNS filtering, detection, and service access are easier to inspect separately; active blocking remains pending until the bouncer configuration is verified.

Private Administration Path

Challenge: Distributed services and dashboards needed remote administration without broadly exposing management interfaces.

Approach: Moved administration through Tailscale and SSH aliases; public access is limited to user-facing services while management surfaces stay private.

Outcome: Management is separated from the public web path, and exposed services are easier to operate and audit.

The Vienna Fortress

Challenge: A tool-by-tool private infrastructure lab became harder to monitor, secure, and maintain as the service stack grew.

Approach: Built a Proxmox and Docker platform around Nginx Proxy Manager, Pi-hole, CrowdSec, Netdata, Uptime Kuma, Dozzle, Watchtower, and Homepage, and stabilized a Proxmox API integration for a React-based dashboard.

Outcome: Created a clearer internal platform with structured operating paths, centralized visibility, and reduced exposure.