I’m Benjamin Ollson from Duncan, BC. I run a 24/7 home server on a spare MSI laptop — Pop!_OS, GTX 1060, 16GB of RAM, 37 Docker containers, Ollama for local AI, Home Assistant, Jellyfin, Paperless-ngx, and a simulated fly world called Willowmere. I’ve just started a channel, The Den, and my first episode, “The Laptop That Never Sleeps,” is already made: https://www.youtube.com/watch?v=84aN4FNccP0
Tom Lawrence pointed me here from the contact form, so I’m asking the forum directly: with 37 containers on one laptop, what would you secure first?
I’m not asking for money or gear, just the first mistake to fix. I have a 3-year-old daughter, and I’m trying to turn this into a one-person automation business — to be a good role model for her and work toward things like a college fund — after being let go for my boss’s financial reasons. I’ll document it honestly, bugs included.
You should secure that laptop by putting it behind a firewall. You should disable root account on all your containers. Do not expose anything directly to internet. Use overlay vpns for external access. Move away from home assistant in a container, to a HaOS (home assistant in vm) if you have resources. Never share your full name, location, and email address anywhere. And for the love of god, do not use AI voice in your youtube videos. I would prefer a real voice on a crappy microphone instead of AI garbage.
The first thing in my opinion is to make sure NOTHING on the laptop gets reached from the internet. No port forwards, no UPnP on the router, no “temporary” DMZ. If remote access is wanted later, it comes through WireGuard or Tailscale, never through an opened port. Getting that policy set before anything is installed removes about 80% of the ways beginner homelabs get owned. Software firewalls come next, and Linux has a number of firewalls you can run (nftables, ufw, or firewalld, etc.). I would enable one of those one every VM and block everything except SSH. I would only use SSH keys for login and not passwords. Other services can be permitted on an as needed basis, but scoped to a limited number of IP addresses, not wide open.
Restrict the management interfaces of Proxmox, etc., at the server. The Proxmox web UI and SSH only need to answer to the admin workstation. Proxmox has a built-in firewall (Datacenter and Node level) that can allow 8006 and 22 from one source IP or a small range and drop everything else. Same idea with nftables on a plain Linux box.
I would also consider taking management interfaces off the LAN entirely. Install Tailscale on the server laptop and only allow 8006 and 22 from the tunnel interface. Then the management plane isn’t reachable from your home network at all, only from devices enrolled in the VPN.
Second, if and when money permits, you may want to get a firewall router device (pfSense, OPNsense, OpenWRT, etc.) that allows you to segment your network.
Third, backups. Focus on backing up the data that is valuable to you and work towards a true 3/2/1 backup plan.
Thanks svirepi and Louie1961 — I worked through your advice tonight and here’s where it landed.
Nothing on the laptop is reachable from the internet: no port forwards, no UPnP (the router doesn’t even expose it), no DMZ. The only public thing is the blog, through Tailscale Funnel, and remote access is Tailscale only.
SSH is keys-only already, password login off, and the firewall is on.
Backups are nightly on the server, a copy on a second machine in the house, and weeklies offsite — working toward a proper 3-2-1.
Containers: no-new-privileges is now on all 46 services, the one privileged container (Home Assistant) lost privileged and just got two network capabilities for Bluetooth instead, and Syncthing runs as a non-root user now. All 47 containers verified healthy after.
Not yet: moving Home Assistant to a VM would break the integrations I have wired in and the laptop is tight on resources, and a proper firewall router is a money thing for later. The AI voice note is heard — that’s a bigger decision for the channel and I’m still thinking on it.
Thanks again, this gave me a real list to work from.