2 posts
Every technical blogger eventually faces this decision: Ghost or WordPress? WordPress powers 43% of the internet and has a plugin for everything.
I wanted a security blog that I fully controlled — no managed platforms, no vendor lock-in, just a VPS and a stack
TL;DR: Pin the LinuxServer WireGuard image, bind /config to a protected host directory, grant only the networking
Self-HostingTL;DR: Choose Nginx Proxy Manager for the simplest way to publish ordinary web apps; choose Pangolin when
password managersTL;DR: Vaultwarden is my pick for individuals and small teams, official Bitwarden is the safer supported choice
nginx-proxy-managerTL;DR: Run Nginx Proxy Manager 2.15.1 with ports 80 and 443 public, bind its admin
vpnTL;DR: "VPN" is really two different products that happen to share a name. A self-
vpnTL;DR: For most self-hosters in 2026, pick WireGuard if you want raw speed and full control,
self-hostingTL;DR: Immich is an open-source, self-hosted photo and video platform that genuinely replaces Google Photos
self-hostingTL;DR: A real backup is encrypted, off-site, and restore-tested. The fastest way to get all
self-hostingTL;DR: Self-host n8n with a pinned image, persistent encryption key, non-root user, read-only filesystem,
privacyTL;DR: A working privacy stack in 2026 is not a single tool. It's seven decisions
emailTL;DR: - Proton Mail — best default for most people. Custom domain works, the apps are polished, deliverability is
vpnTL;DR: Proton VPN is the right default for most self-hosters who want a privacy-respecting VPN
securityI spend a lot of time testing security tools — for my own infrastructure, for CTF challenges, and for
vpsTL;DR 33 days of real Uptime Kuma data from a Hetzner CPX22 in Helsinki: 99.98% uptime
self-hostingGitHub is free, reliable, and deeply integrated into every developer's workflow. So why would anyone self-
DockerIf you followed my earlier post on Docker security best practices, you already know the fundamentals: non-root
CTFSpoiler Warning: This post contains a full walkthrough of the retired HackTheBox machine "Lame," including both
ProxmoxA VPS is great for running production services, but for learning, testing, and breaking things on purpose, nothing
NmapEvery time I set up a new server, the first thing I do before hardening anything is figure
Self-HostingGoogle Drive gives you 15 GB for free and sells you convenience. In exchange, it scans your files,
SecurityIf you build anything for the web -- APIs, SPAs, server-rendered apps, microservices -- the OWASP Top 10 is
SecurityEvery HTTP response your server sends includes headers that browsers use to decide how to handle your content.
hetznerI've been running the entire ByteGuard stack on a Hetzner CPX22 in Helsinki for months. Ghost
fail2banTL;DR Install and configure Fail2Ban to automatically block IPs that brute-force your SSH, Nginx, or other
uptime-kumaTL;DR Deploy Uptime Kuma with Docker Compose and monitor your websites, APIs, and Docker containers in minutes.
sshTL;DR Go beyond basic SSH setup: disable password auth, lock down sshd_config with strong modern ciphers,
ctfSpoiler Warning: This is a full walkthrough of the retired HackTheBox machine "Cap." If you haven&
self-hostingThe average person pays for 5-10 SaaS subscriptions. Notion, Google Drive, LastPass, Slack, Trello — the monthly total
vaultwardenTL;DR Self-host Bitwarden’s open-source backend (Vaultwarden) on your VPS using Docker Compose. Get a
reverse-proxyTL;DR Nginx Proxy Manager, Traefik, and Caddy all handle reverse proxying and SSL — but for different use
wireguardTL;DR: Install wireguard, enable forwarding, create one server keypair and one keypair per client, configure wg0, add
ghostEvery technical blogger eventually faces this decision: Ghost or WordPress? WordPress powers 43% of the internet and has
dockerTL;DR: The Docker security practices that reduce the most risk are running applications as non-root, publishing
vpsHetzner vs Contabo vs Vultr: Best VPS for Self-Hosting in 2026 Affiliate disclosure. This post contains affiliate
linuxTL;DR Lock down a fresh Linux VPS in 10 minutes: disable root SSH login, set up SSH
vpsI wanted a security blog that I fully controlled — no managed platforms, no vendor lock-in, just a
No matching article. Try a software name, topic, or security term.
Get the 47-point Server Hardening Checklist and one practical self-hosting email each week.
No tracking pixels in the newsletter. Unsubscribe whenever you like.