Running a homelab gives you plenty of freedom to host your own applications, websites, and services. However, before exposing your homelab to the internet, take a few steps to avoid security problems and unnecessary headaches down the road.
If I were setting up a fresh Docker server for public access today, there are five containers I would install before deploying my applications. They provide a solid starting point for anyone looking to safely expose a home server to the internet without making the initial setup unnecessarily complicated.
Caddy handles reverse proxying and HTTPS
Why do I recommend Caddy
When you host multiple applications on a single server, you need a way to route incoming traffic to the correct container. That is where a reverse proxy comes in. I would recommend Caddy because it handles reverse proxying and automatically obtains and renews HTTPS certificates. Its Caddyfile configuration is also relatively straightforward.
You can also consider Traefik if you prefer automatic Docker service discovery and routing through container labels. Both are good options for self-hosting. Nginx is another popular choice, but I would not recommend starting with it if this is your first reverse proxy deployment. Its configuration and certificate management can introduce unnecessary complexity for beginners.
You can also use Caddy’s Docker integration through third-party plugins if you want to automate reverse proxy configuration alongside your Compose deployments. This can be useful when you frequently add or remove applications because you can manage routing closer to your container configuration.
Dockhand makes Docker management easier
Manage containers and Compose stacks
Managing multiple containers using the command line can become tedious. You eventually need to inspect logs, restart services, update images, and check whether everything is running as expected.
Dockhand gives you a web interface for managing Docker environments. You can deploy, edit, start, stop, and remove containers, manage Docker Compose stacks, inspect logs, and monitor resource consumption. It also provides visibility into container health and image versions, making routine maintenance easier.
Dockhand can also cover much of what people traditionally install Dozzle and Watchtower for. Its logging interface lets you inspect container output, while its image update features help you keep deployments current. This reduces the number of separate tools you need to maintain, although I would still suggest reviewing updates before applying them to critical services.
CrowdSec protects your server against malicious traffic
Detect suspicious activity and block malicious IPs
Once your homelab is publicly accessible, it will eventually receive unsolicited traffic. Automated bots routinely scan public IP addresses for exposed services, weak authentication, and known vulnerabilities. CrowdSec analyses server logs to identify suspicious activity and patterns associated with malicious behavior. It uses collections of detection rules, known as scenarios, to recognize activities such as repeated login attempts, vulnerability scanning, and other common attacks.
When CrowdSec identifies a threat, it can issue a decision to block the offending IP address through a compatible bouncer. You can also integrate it with supported reverse proxies, including Caddy, to help protect publicly exposed applications. Its community threat intelligence network also lets participating installations share information about malicious IP addresses.
You can also build custom dashboards using CrowdSec’s available metrics and integrate them with tools such as Grafana to visualize security events, blocked IPs, and attack trends.
Tailscale gives you private access to your homelab
Keep administrative dashboards private
You probably do not want every service running on your homelab to be accessible to anyone on the internet. Docker management dashboards and monitoring interfaces should ideally remain private.
Tailscale creates a private network between your devices using WireGuard, allowing you to access your home server without exposing additional management ports publicly. It handles device authentication and network connectivity, so you do not have to configure a traditional VPN server manually.
If you prefer an alternative, Cloudflare One offers another way to secure access to private applications. Its Cloudflare Tunnel can connect services to Cloudflare without opening inbound ports on your server, while Cloudflare Access lets you enforce identity-based access policies. I would put both Dockhand and Uptime Kuma behind Tailscale or Cloudflare Access. This lets you manage containers and inspect monitoring information from your own devices while keeping dashboards off the public internet.
Uptime Kuma keeps an eye on your services
Running Docker containers does not necessarily mean the application inside it is working correctly. A service might return a 502 error, an application might stop responding, or a service might become inaccessible because of a networking problem. This is where Uptime Kuma comes in.
Uptime Kuma lets you create monitors for individual applications and services. It supports HTTP and HTTPS checks, TCP ports, DNS records, and several other monitoring methods. You can configure how frequently it checks each service, set retry intervals, and receive notifications through integrations such as Telegram or email when something becomes unavailable.
It also provides a status page that you can share with users to show whether your self-hosted applications are operational. This is particularly useful if you run multiple services for friends, clients, or a small community. You can monitor everything from one dashboard instead of manually checking each application.
Start sharing your applications
You do not need to deploy dozens of containers to expose your homelab to the internet. Start by getting your reverse proxy, security, and management tools configured properly before adding applications, but I would also recommend keeping your Compose files and persistent volumes backed up somewhere outside the main server.
If you eventually move to another VPS or rebuild your homelab, having those files and backups will save you from configuring everything from scratch. Most importantly, test your backups and make sure you can restore your applications before relying on the server for anything important.
