Infrastructure
Traefik terminates TLS and is how a service is reached from outside the host. CrowdSec is the optional layer that watches and blocks.
Running the service is the easy part. Operating it is the challenge.
Hardened Docker Compose blueprints for reverse proxy, secrets, and intrusion detection — set up once, reused by every service you self-host.
Starting a container is one command. Keeping the service reachable only to the people who should reach it, patched, and recoverable when the disk goes — that is what these guides are about.
What the guides cover
Section titled “What the guides cover”Applications
Passwords, files and calendars, invoicing, file sync, document editing — each with installation, verification, backup and updates.
Operations and recovery
Backups with Borgmatic and the restore that proves them, plus a method for finding which layer is actually broken.
Security
Firewalls, TLS, credentials, isolation, detection, recovery — what each measure stops, what it does not, and where this blueprint sits in the chain.
Also here: what self-hosting does not answer — who governs each piece of software, and what still leaves the server anyway.
What is claimed about testing
Section titled “What is claimed about testing”Each guide opens with the version it is written against and, where one exists, the date it was verified on a real host — followed by one line naming what was not exercised. One application has had its data restored from a backup. The others say so instead of implying otherwise.
© 2026 SecDockBlueCode Apache-2.0Site content licence not yet decided