Skill: ivangdavila/self-hosting (version 1.0.0)

--- name: Self-Host description: Deploy and maintain self-hosted services with security, backups, and long-term reliability. metadata: {"clawdbot":{"emoji":"🖥️","requires":{"anyBins":["docker","podman"]},"os":["linux","darwin","win32"]}} --- # Self-Hosting Rules ## Before Installing Anything - Backups first — decide where data lives and how it's backed up before deploying, not after data exists - Check resource requirements — many services need more RAM than expected, OOM kills corrupt data - Verify the project is actively maintained — abandoned projects become security liabilities ## Docker Fundamentals - Always use named volumes or bind mounts for persistent data — anonymous volumes are lost on container removal - Pin image versions (`nginx:1.25.3` not `nginx:latest`) — latest changes unexpectedly and breaks setups - Set restart policy (`unless-stopped` or `on-failure`) — containers don't auto-start after reboot by default - Use `docker compose down` not `docker compose rm` — down handles networks and volumes properly ## Networking - Never expose database ports to the internet — only the reverse proxy should be public - Use a reverse proxy (Traefik, Caddy, Nginx Proxy Manager) — handles SSL, routing, and security in one place - Create Docker networks per project — default bridge network lacks DNS resolution between containers - Bind admin interfaces to localhost only (`127.0.0.1:8080:8080`) — not all traffic needs to be public ## SSL and Domains - Use automatic SSL with Let's Encrypt — Caddy and Traefik do this natively - For local/LAN access, use a real domain with DNS challenge — avoids browser certificate warnings - Wildcard certificates simplify multi-service setups — one cert for *.home.example.com ## Security Essentials - Change all default passwords immediately — bots scan for default credentials within hours - Enable automatic security updates for the host OS — unpatched systems get compromised - Use fail2ban or equivalent — brute force attacks are constant - Keep services behind authentication (Authelia, Authentik) — not everything has built-in auth - Disable root SSH, use key-only authentication — password SSH is a vulnerability ## Backups - Test restores, not just backups — untested backups are wishful thinking - 3-2-1 rule: 3 copies, 2 different media, 1 offsite — local RAID is not backup - Automate backup schedules — manual backups get forgotten - Back up Docker volumes, not containers — containers are ephemeral, data is not ## Monitoring - Set up uptime monitoring (Uptime Kuma is self-hostable) — know when services die before users tell you - Monitor disk space — full disks cause silent failures and corruption - Log rotation is mandatory — Docker logs grow forever by default, fill disks - Consider resource monitoring (Netdata, Prometheus) — spot problems before they're critical ## Maintenance - Schedule regular update windows — services need updates, plan for downtime - Document everything you deploy — future you won't remember why that container exists - Keep a compose file repo — reproducibility matters when hardware fails - Test updates on staging when possible — production surprises are painful ## Home Server Specifics - Dynamic DNS if ISP doesn't provide static IP — Cloudflare, DuckDNS work well - UPS protects against power loss corruption — especially important for databases - Consider power consumption — some hardware costs more in electricity than cloud hosting - Port forwarding exposes your home network — use VPN (WireGuard, Tailscale) instead when possible ## Common Mistakes - Putting everything on one machine with no redundancy — single point of failure for all services - Ignoring updates for months — security vulnerabilities accumulate - No firewall rules — assuming "nobody knows my IP" is security - Storing secrets in docker-compose.yml committed to git — use .env files, exclude from version control - Over-engineering from day one — start simple, add complexity when needed


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)