CyberSecurity Paranoia

Hi folks,

I wanted to do a quick sanity check on my current infrastructure and see what you all think—mostly to figure out if I'm sliding too far down the paranoid over-engineering rabbit hole or if this actually makes sense.

Here is my current setup:

* **Internal Services:** Anything used exclusively at home stays strictly behind **WireGuard**. If I’m away, I just toggle the VPN on my phone or laptop.
* **Exposed Services:** For the few things that *must* be accessible over the open internet (HTTPS only)—mainly because I have a device where I can't install a VPN—I route traffic through **Traefik** as my reverse proxy.
* **Security & Middleware:** On Traefik, I’ve set up rate-limiting middleware for exposed APIs and strict security headers for web services. Around that, I’m running **CrowdSec** to catch weird traffic patterns and **Pocket ID** for SSO/authentication.


Lately, I’ve been tempted to throw **mTLS (Mutual TLS)** into the mix for those few publicly exposed services. The endpoints are only accessed by a handful of devices (mine and my partner’s, all under our direct control), so requiring client certificates feels like adding an unbreakable layer of armor. But I keep asking myself: *is this pure paranoia, or is paranoia just a spectrum with no limit in self-hosting?*

On top of that, I’m considering adding or switching over to **Cloudflare Tunnels** (`cloudflared`). I haven't migrated my DNS to Cloudflare yet because I’ve seen very mixed reviews: some people had bad experiences with updates breaking things or policy concerns, while many others swear by it.

What are your thoughts? Is mTLS worth the hassle for personal/family setups, or is it overkill given CrowdSec, Pocket ID, and proxy middleware? And how has your experience been with Cloudflare Tunnels compared to hosting your own proxy on a public IP?

Roast my setup or hit me with your practical advice! Cheers.

https://redd.it/1x3vo2d
@r_SelfHosted