Self-hosted infrastructure
A dedicated server operated end to end: reverse proxy with automatically renewed certificates, monitoring, encrypted off-site backups. Admin interfaces are reachable over VPN only, never from the public internet.
Background
Rather than shared hosting or a managed platform, I chose a dedicated server administered end to end: full control of the stack, from the operating system up to the TLS certificate, and a reproducible foundation for both personal projects and internal company tools.
Architecture
Debian 13, for its stability and support lifecycle. Every service runs in Docker containers described in version-controlled Compose files — no manual, non-reproducible configuration lives on the server.
Traefik handles reverse proxying at the edge: automatic container discovery through labels, routing by domain name, and Let's Encrypt certificate issuance and renewal without intervention. TLS terminates there, and no application container is exposed directly. PostgreSQL holds persistent data on an internal Docker network, with its port never published on the host: each application gets its own role and its own database.
Security
The surface exposed to the internet is limited to ports 80 and 443. Everything else — SSH, admin interfaces, monitoring, database management — is reachable only over Tailscale. An admin interface that isn't routable from outside can't be scanned or brute-forced.
- Firewall denies by default
- Key-based SSH only, no root login
- System security patches applied automatically
- No database port published on the host
Monitoring and backups
Uptime Kuma tracks service availability and raises an alert as soon as a check fails — the goal being to know before users do.
Backups run on restic: PostgreSQL dumps and application volumes are encrypted server-side before being sent to remote storage, leaving the repository unreadable to whoever hosts it. Deduplication keeps a deep history at low cost, with a tiered retention policy.
Restores are tested: a backup you've never restored isn't a backup.
Outcome
Several services in production, a reproducible deployment, and a recovery time measured in tens of minutes. Skills that transfer directly to client work: system hardening, networking, containerization, monitoring, and backup strategy.