My server lives in the living room
Blog, cloud, Git and a few websites run on a Mac mini at my place. No open ports on the router, one tunnel to the outside. An overview.
Translated from the German original with an AI language model, approved by me. Read the original
This site, my WordPress blog, my files and my Git server do not run at a hosting company. They run on a Mac mini at home. That is less exotic than it sounds.
The setup
Everything runs in containers, held together by a single Compose file:
- Caddy as the web server in front. It routes every request to the right place based on the hostname.
- WordPress for the main blog, with MariaDB as the database.
- Nextcloud for files, calendars and video calls.
- Forgejo as my own Git server.
- A few static sites, like this one.
The data lives on an external drive. The idea: plug the drive into another computer, start the stack, everything keeps running.
No open doors
The router has not a single open port for the websites. Instead, a small service builds a connection to Cloudflare from the inside, a tunnel. Visitors land at Cloudflare, and Cloudflare passes the request through the tunnel to Caddy. From the outside, my connection is not visible at all.
For myself there is a second way in, through a private VPN. That also reaches things that are deliberately not public.
What happened along the way
A lesson I did not expect: my Git server was publicly reachable for a while. Within about a day and a half, AI crawlers sent around 300,000 requests and downloaded thousands of archives. Not an attack in the classic sense, just bots grazing on everything they can find.
Since then the Git server is no longer on the tunnel. I only reach it through the VPN. And I keep access logs that I review regularly.
Is it worth it?
For me, yes. I learn more from it than from any course, I know where my data lives, and it costs little more than electricity. The price: when something breaks, I am the admin. At three in the morning, too.