2026-04-12 20:39 UTC
After quite some time, I finally have all the pieces in place. Over the last 30 minutes, I’ve set up one of my servers from scratch. Here are some key changes:
- Reverse Proxy: Nginx with Modsecurity (WAF)
- Container Isolation: Every container runs in a seperate linux user
- Podman Quadlet: I rewrote all my compose stacks into quadlet files - now all containers are starting probably after reboot 🥳
- Grafana: Grafana's configuration is no managed by Opentofu which provitions at the moment the datasources (Grafana Loki and Prometheus) as well as the dashboards.
- Server hardening: Improved ssh configuration, firewall, permissions in general on this host
- Ansible: Everything is powered by ansible
- Certbot: Use wildcard certificates for my domains / subdomains for easier renew process
- Backups: All those services have proper backups configured which are timed with systemd timer and are replicated into my local homelab.
- Services that are running at the moment
- Grafana
- Prometheus
- Grafana Loki
- Grafana Alloy
- GitLab Runner
- some other services that I wanna migrate to this server
#homelab #sysadmin #linux #ansible #automation #devsecops #selfhosting #declarative #gitops #monitoring
Replies (2)
-
@hotsause@mastodon.social 2026-04-12 21:12
@niclas@infosec.exchange how did you manage to run each container as a separate user? I have a few containers in my stack that have to run as uid 1000 (like homepage for example), what do you do in this situation?
-
@soleluke@hachyderm.io 2026-04-14 05:42
@niclas@infosec.exchange I had never thought about adding a WAF to nginx in my homelab. I spent a little bit of time today and got ModSecurity added to it, plus a bit of tuning and defining exclusions for a couple apps. Thanks for mentioning it! This feels like a good addition to the stack.