Access · Security · Backup
Reaching and protecting a home server: Tailscale, Cloudflare Tunnel, vzdump
A home server is only as good as its access and its backups. My principle: no port forwarding, every access path a conscious decision, a backup every day.
Who gets access from where?
| Who / what | Solution |
|---|---|
| Only me, privately and on the move | Tailscale (WireGuard VPN) |
| Only me, in the browser without VPN | Cloudflare Tunnel + Access (login via one-time PIN) |
| Other people | Tunnel with two-factor login or a strong password |
| Sensitive data (e.g. photos) | Via Tailscale only, never public |
The Cloudflare Tunnel makes an outbound connection, so no port has to be opened on the router. How I locked down an exposed dashboard with it is in the note Zero Trust for the homelab.
Everyday protection
- Fail2ban blocks addresses after repeated failed attempts.
- AdGuard filters ads and trackers via DNS across the whole network.
- Uptime Kuma alerts you when a service becomes unreachable; Glances shows the load on the host.
- Regularly check what DNS and the tunnel actually publish.
Backups with vzdump
Proxmox backs up whole containers with vzdump. Mine runs daily to a separate disk, keeping 7 daily, 4 weekly and 3 monthly backups:
vzdump <CTID> --storage <backup-storage> --mode snapshot \
--prune-backups keep-daily=7,keep-weekly=4,keep-monthly=3Important: a second disk in the same machine protects against disk failure, not against theft, fire or power surges. By the 3-2-1 rule at least one copy belongs in another location – and a backup only counts once you have tested the restore.
Checklist
- No port forwarding on the router
- A login layer for every public service
- Private services via VPN only
- Daily backup to a separate disk, plus a copy in another location
- Test restores regularly
- Monitoring with alerts
Keep reading
Self-hosting · Homelab · Privacy
Leaving the cloud: a home server instead of Google, iCloud & co.
At home I run a Proxmox server with 15+ services. Here is which cloud services it replaces for me, what it costs – in time – and where you are better off staying in the cloud.
Proxmox · LXC · Homelab
Proxmox & LXC in a homelab: which containers I run and why
Four containers, four roles: how my home server is built, which programs run where and how I laid out the storage.
Homelab · Backup · Proxmox
Backup the 3-2-1 way and the restore test: a backup only counts once it has been restored
Most backup stories end at the same point: the backup ran – but nobody ever tested whether it can be restored. Here is how I back up my Proxmox host and how I test the restore without endangering anything running.
DevOps · Cloudflare · Zero Trust
Zero Trust for the homelab: Cloudflare Tunnel and Access instead of open dashboards
An internal dashboard was publicly reachable via a subdomain. Here is how I locked it down with Cloudflare Tunnel, Cloudflare Access and Tailscale.
More from my homelab
Find the whole series, more notes and case studies here.
All notes Case study MeisterMeld Case study PflegeOasis Case study Kernbohr-Expert Back to the homepage
Comments
Join the discussion: comments run on GitHub Discussions (sign in with a GitHub account). Content from GitHub/giscus is only loaded after you click. Privacy