
Securing SSH with Two-Factor Authentication (TOTP)
Protect SSH logins with a key plus a one-time code: set up libpam-google-authenticator, configure PAM and sshd correctly …
🍳 Self-hosting tutorials, freshly served
Hands-on self-hosting tutorials for your own server – tested on netcup, fresh from the Serverküche.
Welcome to the Serverküche (“server kitchen”)! Here you’ll find battle-tested recipes for self-hosting – explained step by step and tested on real netcup servers (they run on any comparable root or virtual server, too). The path leads from the first server setup through hardening with SSH and a firewall to ready-to-serve applications: your own cloud with Nextcloud, your private photo backup with Immich, the password manager Vaultwarden and the paperless office with Paperless-ngx.
New here? The learning path walks you through all the recipes in the right order – and the server calculator tells you how big your server needs to be.

Protect SSH logins with a key plus a one-time code: set up libpam-google-authenticator, configure PAM and sshd correctly …

One container or eighteen? Both mail servers really set up and compared: effort, RAM, attack surface – and what Mailcow …

Attach services to Authentik: forward auth with Traefik for apps without a login, and OpenID Connect for everything with …

Set up Authentik 2026.8 with Docker and Traefik: your own identity provider with Postgres instead of Redis – initial …

Using Traefik v3 middlewares properly: set security headers, throttle requests, protect services with BasicAuth and an …

Set up Dockge 1.5 behind Traefik: edit and deploy Compose stacks in the browser and follow the logs live – without …