A residential Debian box operated like production: zero inbound exposure for its highest-value workload, intrusion detection verified against real and synthetic attacks, a same-day CRITICAL CVE fix, infrastructure-as-code proven idempotent against the live host, and a public dashboard that lets anyone check the claims directly - plus a ten-week network incident, traced to three conflicting owners, fixed for good.
Public Internet selected.
pontosv is a bare-metal Debian 12 server on a residential connection, run solo as a deliberately operated production platform rather than a home lab.
What's running is not a demo: OJS hosts a real academic journal - Revista de Direito do Consumidor, institutional client BRASILCON - with 26 submissions and 78 registered users as of August 2026, and zero inbound ports (outbound-only via Cloudflare Tunnel, origin IP absent from public DNS). Nextcloud, TeamSpeak 6, and a public status dashboard at sv.pegradowski.com run alongside it.
The box is monitored, detected, patched, and reproducible: CrowdSec verified against real and synthetic attack traffic, a weekly Trivy scan that diffs CRITICAL CVE IDs against the last run instead of alerting on raw totals, an Ansible role proven idempotent against production, and restic backups that are restore-tested rather than merely scheduled.
Earlier in its life the server also survived a ten-week connectivity incident traced to three conflicting network owners - two racing DHCP clients, a rogue DHCP lease, and three overlapping firewall managers - fixed architecturally with zero recurrences since. That incident is covered further down as one entry among several, not the centerpiece.
A bare-metal Debian 12 server I built and administer solo - the production machine behind the BRASILCON OJS journal. Intel i5-14400, 32 GiB RAM, 1 TB NVMe, on a residential connection in Curitiba. It is my live laboratory for the discipline that actually matters in security: deciding what gets exposed, why, and proving it.
EXPOSURE AS A DELIBERATE DECISION - The threat model is simple: assume the WAN is hostile and minimize what it can see. The flagship service (the journal) reaches the internet through an outbound-only Cloudflare Tunnel - zero inbound ports for the box's most valuable workload. The only two ports forwarded on the router exist for the self-hosted TeamSpeak 6 voice server (Docker), and each is documented with its justification. Everything else - admin panels, Cockpit, file sharing (NFS/Samba), the web file manager - is LAN-only by policy, with an explicit written rule of what must never be forwarded. SSH is key-only; password authentication is disabled in sshd config.
LEAST PRIVILEGE IN THE SMALL THINGS - The DuckDNS dynamic-DNS updater runs as a dedicated unprivileged system user via a systemd timer, with its token in a root-owned config file at mode 640 - not as a root cron job with the secret inline, which is how most self-hosters do it. TeamSpeak runs containerized with only its two required ports published. The Docker stacks publish no other host ports.
INCIDENT FORENSICS - THE STORY I TELL IN INTERVIEWS - For ten weeks the server "randomly lost internet" every 1–2 weeks, and reboots only reset the clock. Instead of another reboot, I dug through journald and the packet path and found three stacked root causes: two DHCP clients racing on one NIC with independent renew schedules; a rogue DHCP server on the ISP modem that hijacked the default route (the smoking gun was a single journal line at 3:24 AM); and three firewall managers - firewalld, ufw, iptables-persistent - silently fighting each other and Docker, so every previous "fix" had edited a layer that wasn't doing the blocking. The cure was architectural: exactly one owner per layer. One DHCP client, one firewall authority, Docker managing its own chains. Zero recurrences since.
OPERATIONS AS CODE-ADJACENT DISCIPLINE - The server is governed by a living handbook: services-and-ports map, firewall policy with rationale, full incident history with root-cause analysis, an honest risk register, and triage runbooks ordered by likelihood - written so that any competent human or AI agent could operate the machine cold. Documentation is a security control; this box treats it like one.
No control is presented as total risk elimination.
The OJS journal is reachable only outbound, through a Cloudflare Tunnel; its origin IP isn't in public DNS.
A root-run collector on a timer gathers privileged data; the internet-facing dashboard process only ever reads one JSON snapshot it wrote.
Exposure requires a written reason.
Make operation recoverable by another competent person.
Remove overlapping network authorities.
01#!/usr/sbin/nft -f02# Default-drop. The journal has NO inbound rule (it rides the Cloudflare Tunnel).03# Exactly one firewall authority owns this box - no ufw, no firewalld fighting Docker.04flush ruleset05 06table inet filter {07 chain input {08 type filter hook input priority 0; policy drop;09 10 ct state invalid drop11 ct state established,related accept12 iif "lo" accept13 ip protocol icmp accept14 15 # Management surface is LAN-only by policy (SSH, Samba, Cockpit).16 ip saddr 192.168.0.0/16 tcp dport { 22, 445, 9090 } accept17 18 # SSH: key-only (PasswordAuthentication no in sshd_config).19 tcp dport 22 accept20 21 # The ONLY two WAN-forwarded services: TeamSpeak 6 voice - documented + justified.22 udp dport 9987 accept # TS6 voice23 tcp dport 30033 accept # TS6 file transfer24 25 counter comment "dropped-inbound" drop26 }27 28 chain forward { type filter hook forward priority 0; policy drop; }29 chain output { type filter hook output priority 0; policy accept; }30}Default-drop ruleset. The journal has no inbound rule - it rides the tunnel.
Two racing DHCP clients and a rogue lease repeatedly replaced the default route, while firewalld, ufw, iptables-persistent, and Docker each affected an overlapping layer - so a fix in one tool often wasn't the layer actually blocking traffic.
Detection (CrowdSec), vulnerability management (Trivy), and infrastructure-as-code drift checks (Ansible) run against production, not just incident response
A public status dashboard exposes real container health, security posture, and backup history for anyone to verify directly
The highest-value workload has zero inbound ports and real production traffic — a national journal client, not a demo
Recurring connectivity incident stopped after ownership was simplified
Public and private services now have explicit exposure rationale
Operational knowledge is preserved in a living system handbook