The homeserver doesn’t have to be fancy. We’re running all our stuff off a Dell Vostro from 2012 we got for like $30 on Craigslist. (It did need another $30 replacement PSU though. And it has 8GB RAM and a 500GB SSD which is nothing to sneeze at for a machine that cheap and that old.)

We were homeschooled.

Not the “religious nut” kind of homeschooling though. I wasn’t even aware that was a thing growing up. Our parents actually raised us totally atheist, so almost the opposite!

Personally I’m glad we were homeschooled, our parents actually did teach us well and we learned all the academic stuff you’d expect us to learn. (The state we grew up in also has a system of “you take yearly state-run standardized tests to make sure you’re actually being taught stuff”, which probably helps. But like, I don’t think that was the only reason our parents taught us well, I’m pretty sure they actually cared, too.)

The downside of all that is that it helped our parents keep us isolated. But honestly, I’ll take that over the bullying (and indoctrination) we’ve heard of public school having. Public school sounds like hell.

– Frost

The moment you get a TLS cert, it’ll show up in Certificate Transparency logs and apparently the attack bots scan that for targets.

You can totally do that yeah!

We have our stuff set up so inbound VPS traffic (for HTTPS) comes in on port 4430, while LAN traffic is on 443. It’s not done for firewall reasons, it’s so we can pass the client’s IP through with Nginx’s proxy_protocol feature, but you could just make your local-only services not listen on 4430. Boom, done.

Fail2Ban on the VPS is probably good. On the home server, it might just lock out the VPS (since everything comes from there).

Anyway yeah, I’ve got a whole guide on this sort of setup! https://frost.brightfur.net/blog/selfhosting-with-a-bounce-vps-part-1/

– Frost