People ask me, reasonably often, what a self-hosting setup looks like when it has survived a few years of real use rather than a weekend of tinkering. This post is the honest answer: the services I run, the way they fit together, and the parts I've deliberately left out.
I don't run this stack because I dislike the cloud. I run it because I want to understand everything that touches my data, and because the setup has ended up cheaper, quieter, and more portable than what I was paying for before.
Everything lives on a small set of Linux VMs spread across two providers — deliberately not colocated with each other. The rule is: no single provider can knock out all of my services. A second, quieter rule: nothing important is reachable on an unencrypted port.
The services themselves are boring on purpose. Deployments are plain docker compose files checked into a private repository. There is no orchestration layer, because there is no scheduling puzzle to solve — a dozen containers does not need a cluster.
The piece most people underestimate is TLS certificate management. My web-facing endpoints all terminate at a single reverse proxy that handles issuance and renewal automatically. Sensible default as it is, it took me a while to internalise one thing: renewal is the part that fails, not issuance.
# every certificate, one command, renewed automatically
certbot renew --quietAutomated renewal only helps if it is actually tested. Mine used to be "automatic" until a rate-limit incident proved otherwise. Now the renewal job emails me a diff of what changed each cycle.
Very few services listen on the public interface. Anything that can sit on a private network does. Anything that must be public goes through the reverse proxy, and the proxy is the only process that terminates TLS on ports 80 and 443.
The important habit I've kept: don't expose more than you must. Every port mapped to the outside world is an attack surface with a label on it. If I can't justify a port in one sentence, it doesn't get opened.
Backups are nightly, off-site (the second provider), and encrypted. I restore from them on a schedule, not just when something breaks. There is a difference between having a backup and knowing the backup works; most backup horror stories are about that difference.
A full restore takes under an hour. That number is my real SLA, and it's the one I care about.
Email, for one. I don't run my own mail server, and I recommend nobody does. The delivery, reputation, and spam-filtering curve is a discipline of its own, and the failure mode is "my mail silently goes to spam," which is worse than "my site is down."
After a few years, the thing I value most isn't any particular tool. It's that the stack is boring. Boring means predictable, and predictable means I can fix things at 1am without a handbook.
If you're starting out, begin with the reverse proxy and certificate automation. They give you the most leverage for the least complexity. Everything else is content.