Security
Intermediate
Services reachable only over VPN
A service that returns 403 from outside and works normally over VPN – same name, same valid certificate. IPAllowList, …
·
11 min read
Category
Security category: all tutorials
All Serverküche tutorials in the Security category – hands-on step-by-step self-hosting guides for your own server.
14 tutorials
All tutorials
Security
Advanced
Headscale: Your Own Tailscale Network
Headscale 0.29.5 as your own control server behind Traefik: nodes, MagicDNS, an embedded DERP relay, ACLs and an exit …
·
16 min read
Security
Intermediate
How Secure Is My Server? A Self-Audit With Lynis
Lynis 3.1.7 on Debian 13: audit your server, understand the hardening index, fix real findings – and spot the …
·
17 min read
Security
Advanced
Hardening Docker containers
Harden containers with Docker's own tools: drop capabilities, no-new-privileges, read_only with tmpfs and resource …
·
14 min read
Security
Intermediate
Securing SSH with Two-Factor Authentication (TOTP)
Protect SSH logins with a key plus a one-time code: set up libpam-google-authenticator, configure PAM and sshd correctly …
·
10 min read
Security
Advanced
Authentik Part 2: Connecting Apps – Forward Auth & OIDC
Attach services to Authentik: forward auth with Traefik for apps without a login, and OpenID Connect for everything with …
·
13 min read
Security
Advanced
Authentik: Single Sign-On (Part 1)
Set up Authentik 2026.8 with Docker and Traefik: your own identity provider with Postgres instead of Redis – initial …
·
16 min read
Security
Intermediate
Setting up a WireGuard VPN
A lean WireGuard VPN natively on the netcup server: keys, server and client config, firewall, phone QR – plus the Docker …
·
14 min read
Security
Advanced
CrowdSec: modern, collaborative intrusion prevention
Set up CrowdSec with the Traefik bouncer: detect attacks from the access logs, block attackers with a 403 and benefit …
·
18 min read
Security
Intermediate
Restic backups: encrypted and off-site
Off-site backups with Restic: set up encrypted, restore snapshots, prune with retention and automate via a systemd …
·
12 min read
Security
Intermediate
Setting up Fail2ban
Fail2ban watches your logs and bans IPs after too many failed attempts – with a safe whitelist for your own address so …
·
9 min read
Security
Beginner
unattended-upgrades setup
Automatic security updates on Debian 13: set up unattended-upgrades, decide when the server reboots, and check with a …
·
5 min read
Security
Beginner
Setting up a firewall with UFW
Set up a host firewall in minutes with UFW: block everything except SSH, HTTP and HTTPS on your server – without ever …
·
5 min read
Security
Beginner
Hardening SSH access
Key-based login instead of passwords and no root login: the most important moves to harden the front door to your …
·
5 min read