Welcome to the club! I too have an fyi tld!

I set my Lemmy instance a couple of weeks ago. But hosting isn’t new to me so wasn’t a huge hurdle.

I have a python weather app on my linux desktop using 37mb. 1.6gb seems a tad excessive.

im on a basic uk isp, with no fancy router, just the isp provided one. i have a fully exposed web server, im even hosting a lemmy server. Thats my domain, radiantfig.fyi, totally public, has been for nearly 2 years now. From that you can get my servers IP address. My IP is dynamic, changes roughly every 6 weeks. I have a ddns script that updates my server IP address to my domain name provider automatically. I have certbot running updating my TLS certs with lets encrypt, and if a cert dies or fails or is compromised, my server will refuse to serve. Everything is behind an nginx reverse proxy through port 443. I also have an ssh port open on a random port. Have fail2ban setup fairly aggressively to prevent brute force attacks, and have crowdsec which also kind of does the same but in a slightly different way. the internet requires ip addresses. to protect your ip address you have to give somebody elses. that somebody is a 3rd party you have no control or say on the decisions they make. i must have over 20 individual services that are public facing. 3 fully federated, lemmy, forgejo and matrix. Im as secure as any other website. nothing is unhackable, no matter how far down the rabbit hole you go. its all just layers of difficulty.

The important thing is dont listen to random internet people about security. dont listen to me. dont listen to anybody who tells you they know best. do your own research, understand the options, the risks, the compromises. only then do you put anything up. but if you are going to anxious or worried about your server and data, no amount of security guarantees you safety, so be warned.

Out of the box. Void is a very Diy distro though, so don’t expect to install it and be up and running. But I have a fully functional pc with sway / Wayland, steam and video editing, so no compromises. I was previously on arch Linux for 15 years and tuned it as hard as I could and couldn’t get anywhere near this boot time.

Baring post, my pc cold boots in 3 seconds. And does a full shutdown in 3 seconds as well.

Unfortunately my mobo’s slow to post so that takes around 5-6 seconds.

I moved from arch Linux to void and its init system called runit is amazing. Mega simple and fast.

A reverse proxy is the traditional safe route. Use a web server like Apache, nginx or caddy, and setup to reverse proxy all your services through port 443, and use let’s encrypt and certbot to generate and manage TLS certificates.

I host around 15 public facing web services this way using nginx.

Just be aware, this is very public facing so server security and hardening is important. Things like strong passwords, disabled root, use ssh keys instead of passwords, setup fail2ban, setup crowdsec etc.

The more modern safer way is not to truly expose to full public and use things like tailscale or cloudflare tunnels. But this relies on 3rd party servers and I’m not a fan of that, but it does bring benefits.

My Current Self-hosted Setup

Hardware

Server 1

• Trycoo / Peladn mini pc
• Intel n97 CPU
• Integrated GPU
• 32gb of 3200mt/s ddr4 (Upgraded from 16gb)
• 512nvme
• 2x 2tb ssd’s (Raid1 + LVM)
• Startech usb to sata cable
• Atolla 6 port powered usb 3.0 splitter
• 2x 8tb hdd’s
• 2 bay usb 3.0 Fideco dock
• Each 8tb HDD is split into 2 equal size partitions, making 4 x 4tb partitions
• Each night, the 2tb SSD array backups to the alternating first partition of the HDD’s .
• Each 1st of the month, the 2tb SSD array backups to the alternating 2nd partition of the HDD’s .

Server 2

• Raspberry pi 4b
• 32gb SD card
• 4gb ram

Services

Server 1

• Nginx web server / reverse proxy
• Fail2ban
• Crowdsec
• Valutwarden
  Bit warden reimplantation for storing credentials
• Forgejo
  Remote federated git
• rs_maps
  Simplified Google Maps replacement, with tagging and GPX creation.
• Matrix / Continuwuity
  Federated IM protocol
• Immich
  Google Photos replacement
  External libraries only
  4 users
• Radicale
  Calender and contacts
• Lemmy
  Federated replacement for Reddit
• Navidrome
  Spotify replacement
  2 users
• Adguard home
  1st instance
  Provides Network wide DNS filtering and DHCP server
• Unbound
  Provides recursive DNS
• Go-notes
  Rich Text formatting, live, real time multi-user notes app
• FMD
  Find my device
• Transmission
  Torrent client
• PIA VPN
  Network Namespace script to isolate PIA & Transmission
• Searxng
  Meta search engine - integrates with Go-llama
• StirlingPDF
  PDF editor
• File browser
  This is in maintenance mode only so I am planning to migrate to File Browser Quantum soon
• Syncthing
  Syncs 3 android and 1 apple phone for immich
• Custom rsync backup script
• Darkstat
  Real time Network statistics

Server 2

• Fail2ban
• Crowdsec
• Honeygain
  Generates a tiny passive income
  I’m UK based and in the last 6 months it has produced £15
• Adguard home
• 2nd instance
  Provides Network wide DNS filtering and DHCP server
• Unbound
  Provides recursive DNS
• Custom DDNS update script

Overview

Been running this hardware setup since July 2025, although a couple of services have been added in that time. All works really well and has minimal maintenance as everything is fully automated with scripts. -