Self-hosted Infrastructure
A personal Debian infrastructure: Docker Swarm cluster, TLS reverse proxy, filtering DNS, VPN and backups — hardened and documented.
Technologies
- Debian
- Docker Swarm
- Traefik
- AdGuard Home
- WireGuard
- Cloudflare
- LUKS
- systemd
Highlights
- · Three Debian nodes in a Docker Swarm cluster.
- · Reverse proxy with automatic TLS and host-based routing.
- · Filtering, encrypted DNS with split-horizon for internal names.
- · Remote access through an encrypted VPN.
- · Hardened containers, disk encryption and tested backups.
Overview
A personal infrastructure self-hosted on Debian, built as a full platform rather than a single server: several clustered nodes, a single ingress, controlled DNS resolution, encrypted remote access and tooled operations.
The goal is to own the platform end to end — from the system up to the service — to understand and arbitrate the trade-offs of performance, security and operations.
Architecture
- Three Debian nodes joined in a Docker Swarm cluster for fault tolerance and load distribution.
- Reverse proxy (Traefik): automatic TLS termination (Let’s Encrypt), host-based routing, security headers.
- Filtering DNS (AdGuard Home): encrypted resolution, blocking, and split-horizon to separate public from internal names.
- VPN (WireGuard): encrypted remote access to the private network.
- Public / internal separation: only services meant to be public are exposed; administration and internal services stay private.
Security
- Unprivileged containers:
cap_drop ALL,no-new-privileges, read-only filesystems where possible. - Filtered Docker socket proxy for ingress, instead of mounting the raw socket.
- Disk encryption (LUKS) and dedicated SSH keys.
- Default-deny firewall (allow-list) and a reduced exposed surface.
- Images pinned by digest and disciplined updates.
Operations
- Regular backups with tested restore.
- Versioned configuration (infrastructure as code).
- Logging and automated checks.
Why
Self-hosting means facing real engineering problems: performance, security, resilience and observability. That experience feeds directly into application development — designing software whose deployment and operations are considered from day one.