Self-Hosting Rules

Before Installing Anything

• Backups first — decide where data lives and how it's backed up before deploying, not after data exists
• Check resource requirements — many services need more RAM than expected, OOM kills corrupt data
• Verify the project is actively maintained — abandoned projects become security liabilities

Docker Fundamentals

• Always use named volumes or bind mounts for persistent data — anonymous volumes are lost on container removal
• Pin image versions (nginx:1.25.3 not nginx:latest) — latest changes unexpectedly and breaks setups
• Set restart policy (unless-stopped or on-failure) — containers don't auto-start after reboot by default
• Use docker compose down not docker compose rm — down handles networks and volumes properly

Networking

• Never expose database ports to the internet — only the reverse proxy should be public
• Use a reverse proxy (Traefik, Caddy, Nginx Proxy Manager) — handles SSL, routing, and security in one place
• Create Docker networks per project — default bridge network lacks DNS resolution between containers
• Bind admin interfaces to localhost only (127.0.0.1:8080:8080) — not all traffic needs to be public