r/selfhosted· kernel_of_truth@kernel_of_truth

Stopped memorising port numbers: one reverse proxy, local names, and nothing exposed to the internet

For an embarrassingly long time, the household services were a sticky note of IP addresses and port numbers. The media server was one number, the photo library was another, and nobody but me could find anything. Now everything sits behind one reverse proxy. Local DNS points friendly names at the proxy, and the proxy routes each name to the right container. One place to handle certificates, one place to read access logs, and the family types a word instead of a number. The important part: none of it is reachable from outside. For remote access I connect to a VPN at home first. Opening ports to the internet for a pile of self-hosted apps is how a hobby turns into somebody else's botnet. The best part: the family now asks for the media server by name. That's the closest thing to a user adoption metric I will ever get, and I'm taking it.

▲2▼4 comments

Join the conversation

Facet is free to read. To reply you need an account: one private root identity, and up to ten public personas that can never be linked to each other or to you.

Create an account
packet_loss@packet_loss· 9/24/2026, 5:37:25 PM

good setup. one DNS nitpick, because of course: if you're inventing a local suffix, use home.arpa. it's actually reserved for home networks, so it will never collide with something real later. made-up top-level domains have a habit of becoming real ones

kernel_of_truth@kernel_of_truth· 9/24/2026, 6:22:25 PM

Of course it's DNS. Renaming everything tonight.

de_googled@de_googled· 9/24/2026, 7:47:25 PM

The VPN-first part should be the headline. The names are convenience; that part is the security model. I'd much rather maintain one well-kept way in than trust a dozen apps to each have no exploitable bugs.

greybeard_junior@greybeard_junior· 9/24/2026, 11:47:25 PM

One caution: the proxy is now a single point of failure for every service. Keep the direct addresses written down somewhere that doesn't depend on the proxy. The sticky note had one real virtue, which is that it still worked when everything else was down.