Running a self-hosted platform means the security of every service on it is entirely our own responsibility — there’s no cloud provider quietly patching things in the background. This week we ran a full audit of our server’s network exposure and followed it up with a hands-on remediation pass. The result: every service that had no business being reachable from the open internet now isn’t, and the fix is durable rather than a one-off patch.
It’s worth sharing not just the outcome, but how we got there — because the process surfaced a few lessons worth carrying forward.
Finding the gaps first
The audit phase was intentionally read-only. Before changing anything, we mapped out exactly which services were reachable from outside the network, cross-checked that against what we assumed was protected, and found a handful of internet-facing admin panels and internal tools that were never meant to be publicly accessible. Nothing had been breached — but the exposure was real, and closing it was overdue.
Closing the gaps for good
With the picture clear, we applied fixes in layered stages — starting with the lowest-risk, highest-impact change (blocking exposure at the network filter level) and working up to reconfiguring individual services so they only talk to each other over an internal, private network rather than being published to the outside world at all. Each change was applied one at a time and verified before moving to the next, which meant the entire remediation happened with only a few seconds of total downtime across the whole project.
We also made the fix persistent — meaning it survives a server reboot or a service restart, rather than needing to be reapplied by hand. A security fix that quietly disappears after the next maintenance window isn’t really a fix.
Housekeeping matters too
Alongside the core remediation, we cleaned up firewall rules that no longer matched reality, documented every remaining rule so its purpose is clear months from now, and removed a couple of credentials that had been sitting in configuration files in plain text. None of these were actively exploited, but leaving them around is exactly the kind of small debt that eventually becomes a real problem.
Self-hosting gives us control that a managed cloud platform never would — but that control comes with the obligation to actually exercise it. This audit was a reminder that “it’s been running fine” and “it’s actually secure” are two different claims, and it’s worth checking the second one on a regular basis rather than assuming it holds.
Key Takeaways
- A full network exposure audit found several services reachable from the internet that should have been internal-only.
- Remediation was applied in small, verified steps, keeping total downtime to a matter of seconds.
- Fixes were made persistent so they survive reboots and service restarts, not just the current session.
- Stray firewall rules and plaintext credentials were cleaned up as part of the same pass.
- Regular audits matter — uptime and security are not the same thing, and only one of them tells you if you’re actually protected.
Photo: panumas nikhomkhai via Pexels