Run the stateful half of a self-hosted stack properly — PostgreSQL with least privilege and TLS, Meilisearch with scoped API keys, and backups you have restored at least once.
Stateful services are where self-hosting stops being forgiving. A misconfigured web server is a bad afternoon; a database with a superuser application role and no tested restore is a bad quarter.
This path covers three things in order: making the machine private, giving each data service the narrowest credentials that still work, and proving the backups restore.
The PostgreSQL article is scheduled rather than live, so it will appear in this path when it publishes. The rest apply now, and the backup article is the one to read first if you only have time for one.
Read in order. Ticking a lesson stores your progress in this browser only.
SSH hardening, a default-deny firewall, and the fix for the problem that catches almost everyone — Docker publishing container ports straight past UFW into the public internet.
A database is only as private as the host's firewall rules.
Keep the listener off the public internet, get pg_hba.conf right, require TLS for remote connections, and give the application a role that cannot drop your tables — on PostgreSQL 17 and Ubuntu 24.04.
pg_hba.conf, TLS and least-privilege roles. Scheduled — publishes in September.
A Meilisearch deployment that survives a real workload — master key handling, scoped API keys, the index settings you must set before loading data, snapshots, and what its memory usage actually means.
Master key handling, scoped keys and the settings that must precede indexing.
A nightly backup for a self-hosted Docker host: database dumps taken with the right tools, file volumes snapshotted with restic, a systemd timer to run it, and a restore test that proves it works.
Dump databases with their own tools; never tar a live data directory.
SSH hardening, a default-deny firewall, and the fix for the problem that catches almost everyone — Docker publishing container ports straight past UFW into the public internet.
Keep the listener off the public internet, get pg_hba.conf right, require TLS for remote connections, and give the application a role that cannot drop your tables — on PostgreSQL 17 and Ubuntu 24.04.
A Meilisearch deployment that survives a real workload — master key handling, scoped API keys, the index settings you must set before loading data, snapshots, and what its memory usage actually means.
A nightly backup for a self-hosted Docker host: database dumps taken with the right tools, file volumes snapshotted with restic, a systemd timer to run it, and a restore test that proves it works.