Reposting this from selfhosted with a few changes.

Apologies for the long post, I thought this a better option than going doing rabbit holes with 30 tabs open, ending up having to ask anyway, and accidentally end up in a XY problem by asking questions separately.

___

I'll try to keep this short. (Hi it's me from the future - I failed. It looks like a small megathread. Hopefully it'll be useful to someone else.)

Got the Oracle Free Tier (PAYG) for a Minecraft server, but ended up taking a dive into selfhosting. Installed Portainer and things went from there.

Right now I have Nginx Proxy Manager, NextCloud, Immich, Homepage and DuckDNS. Also rclone but outside of Docker.

I stumbled a lot during this setup since it was my first time, and I never intended on using it for important stuff. I want to do things right and secure this time.

So, bottom line, I'm looking for your suggestions on what services/self-host projects are the best for a secure setup, I have done some research, but I'm unsure, that's why I'm here. Here's what I'm intending to do and questions for each service:

___

	1. Rootless Portainer/Docker, first of all. I've read that rootless is more secure, and Portainer is just what I know, but I'm willing to use something else. Had my eyes on Rancher but info is scarce on this.

	2. Traefik instead of Nginx Proxy Manager? Not sure if it's a drop-in better replacement.

	3. Authentik. As I understand it, it allows me to log into all my services by just logging into Authentik once.

However, I do want some stuff to be exposed to the public - When I share files in NextCloud and when I share albums in Immich, for example, and I don't know how things would work then. I maybe could be convinced out of the sharing capabilities, but it would be a major con for me.

	4. I also saw a proxy for Immich that makes it more secure to share things. Would it be needed then? Is there such a thing for other services?

	5. I also intend on installing Codeberg, Gitpod and Pihole. (Any tips regarding those would be very much appreciated, I'm learning web dev but I've never used Codeberg or Gitpod, and in the case of Gitpod I don't even know if it'll be useful for a beginner like me, I don't know what it does exactly and how it would apply to me.)

I tried installing Pihole but couldn't make it work. I wanted to be able to just type an IP address on my android phone to use it (much like Adguard DNS's "dns.adguard-dns.com"), but I'm not sure if that's even possible with Pihole.

And when looking at docker containers for it there were a bunch of variations such as Pihole + Wireguard + Unbound. I went down the rabbit hole back then but I'm not knowledgeable enough about networking.

	6. Watchtower for auto-updates. Not sure if it would work with Nextcloud AIO though?

	7. I may want to run a webserver one day. Any suggestions for that are also welcome.

	8. I recently started using Bitwarden with Ente Auth. Is there something useful I can do with this server? Having automatic backups would be nice, not sure if I'll need to run the self-hosted Bitwarden service I heard of. Keep in mind I don't want to use ONLY my server as the Bitwarden server, either both or just the official one.

___

	9. Another service that kept coming up was Tailscale. As I understand it, it's a bit like ye olde Hamachi for playing LAN games over the internet - You connect two computers in a virtual LAN so they can see each other, without the need for portforwarding which can be dangerous.

It confused me a bit since it I never saw it mentioned when searching for Hamachi alternatives. I use ZeroTier for that.

But the big concern is again, the services I'd like to be public/have public functionality.

And apparently Wireguard is an alternative for this? I've heard that Tailscale was paid, maybe that's the difference? So if I end up using the Pihole container with Unbound and Wireguard already, maybe Tailscale wouldn't be needed?

___

	10. The last big question: What would be a good workflow to download a backup of all docker volumes and then import them back? 10a. A lot of services also have files on my /home/ folder, I'd have to back them up separately, right? 10b. Should I only use docker volumes from now on to avoid the above? I'm afraid it would be a nightmare to access and edit files though.
	
___

A few extras:

	11. What's your preferred way of ssh'ing and file management on a server? I use Windows 11's included ssh, but I couldn't make Filezilla work at all. Lot of permission trouble, not even sure if it's viable to use it with a server.

	12. What would be the differences in your advice if I was running this on an actual local server instead of Oracle? I will probably never do it, since I feel so much safer with a cloud option, but I am curious.

	13. What other services would you recommend? Or alternatives to what I use or mentioned.
	13a. Thinking of switching Homepage for Glance, any pros and cons against either or other alternatives?

___

	14. And lastly, if any kind soul is feeling extra generous and helpful, how in the holy heavens do I set up a Matrix server? Keeping in mind this would be after all of the intended setup above.

I've heard the Ansible playbook is the most simple but installing another "manager" on top of Portainer sounds like a nightmare to deal with, not to mention, I don't know which services are the best, e.g. Synapse and its alternatives like Continuwuity, Element Web and its alternatives like Hydrogen, etc.

When I look at the Ansible playbook page and it's tables upon tables of different services, my brain melts.

Keep in mind I don't plan on joining federation. since it would be for just me and my friends, I don't know what would be the benefits for doing that.

___

Both Matrix and Pihole+Unbound+Wireguard are the ones that stumped me the most. And now with all the big changes and additions I want to make, I'd probably hit many, many walls to hit my head against if I didn't ask for help. So apologies if this seems lazy.

Oh, and apologies for this being in Oracle Cloud and not a true home server. A while ago a friend got some servers from his old workplace shutting down, but from what I remember the specs weren't great and I was afraid to use old hard drives for storage. Also security concerns from someone inexperienced like me, as I mentioned in question 12.

What services for a secure home server setup? + Beginner questions (Oracle Cloud)