Hardening your home lab 

This post provides a comprehensive, cost-free hardening guide for home labs and self-hosted services, emphasizing reducing attack surface (SSH/RDP/VNC controls, MFA, Authentik access management, VPN/IP allowlisting), fixing insecure defaults (e.g., environment secrets, Docker bypassing UFW), enforcing TLS for internal and external traffic with example Nginx configs, and applying defense-in-depth (least privilege, Docker network segmentation). It also recommends automated patching (apt cron, Watchtower), robust off-site immutable backups (e.g., Borg), and strong monitoring/AV hygiene (Uptime Kuma alerts, scheduled ClamAV scans) to detect and recover from compromises.