Harden a self-hosted Server

Self-hosting removes an unknown SaaS operator from the trust boundary. It does not remove the need to secure the host, SSH authority, DNS, TLS, owner account, model providers, and recovery copies.

Minimum boundary

1. Use a supported Linux host with current security updates and a dedicated noninteractive SSH identity.
2. Grant the operator account only the host and Docker authority the lifecycle requires. Anyone who controls Docker effectively controls the Server.
3. Verify the SSH host-key fingerprint through a separate trusted channel and enforce strict host-key checking.
4. Expose only the ports required for restricted SSH and the configured HTTP certificate challenge/HTTPS path; keep internal services private. See the Linux host and TLS checklist.
5. Require a domain and explicit ACME email for Let's Encrypt profiles; verify DNS before deployment.
6. Store owner credentials and recovery codes in protected operator storage, separate from the host.
7. Retain verified recovery bundles off the host. Same-disk backup is not host-loss recovery.

nautilo profile list
nautilo status --profile circle-server

Replace circle-server with your exact profile. The signed administrator CLI does not expose doctor; use the Linux guide's explicit SSH, Docker, DNS, and TLS checks. Check firewall and patch state at the host/provider. A healthy Nautilo status does not certify those controls.

Prove the boundary

• An unknown or changed host key must fail closed.
• An unprivileged host account must not gain Docker lifecycle authority.
• HTTPS must present the expected hostname and certificate.
• profile current must identify the intended instance without printing secrets.
• Owner sign-in and a model-backed turn must work through the public route.
• A verified recovery bundle must exist somewhere the loss of this host cannot erase.

Backups and the Railway protected-upgrade recovery path are recovery controls, not automatic high availability. One hardened Compose host is still one host; plan separately for host or provider outages.