Apache, Cloudflare, Nextcloud, Fail2ban, certificates — the full home-hosting stack.
Step-by-step Apache 2.4 install on Ubuntu, with sites-enabled, mod-php, and the basic vhost layout you actually want in production.
Expose home-lab services through Cloudflare without opening a single port. Covers cloudflared install, named tunnels, and ingress routing.
When cloudflared is up but the site is down: connector logs, ingress mismatches, hostname-to-service routing, and the failure modes you will hit.
Point a real domain at a home server end-to-end — registrar DNS, Cloudflare proxying, and the Apache vhost on the receiving end.
What Fail2ban does, why every public-facing server should run it, and the mental model behind jails, filters, and actions.
Install Fail2ban, harden the SSH jail, tune ban times, and verify the iptables rules actually fire when an attacker does.
A real war story: rule that should ban does not, log lines that should match do not, and the trail of fail2ban-regex commands that found it.
Trusted domains, overwrite host, reverse proxy headers — the four config tweaks that determine whether Nextcloud works from the outside.
Why Collabora refuses to load documents inside Nextcloud and the WOPI/SSL/CORS combination that makes it actually render.
Generate multi-domain SSL certs with Subject Alternative Names using OpenSSL. The config file pattern that actually validates.