Inspired by this comment to try to learn what I’m missing.

  • Cloudflare proxy
  • Reverse Proxy
  • Fail2ban
  • Docker containers on their own networks

Another concern I have is does it need to be on a separate machine on a vlan from the rest of the network or is that too much?

  • ChewyEnglish
    2•14 days ago

    It’s mostly to allow the reverse proxy on localhost to connect to the container/service, while blocking all other hosts/IPs.

    This is especially important when using docker as it messes with iptables and can circumvent firewall like e.g. ufw.

    You’re right that it doesn’t increase security on case of a compromised container. It’s just about outside connections.