What we were handed.
Self-hosting traditionally means punching holes: port forwards, an exposed home IP, and a consumer router with hard limits on what it will even forward. Every new service was another opening to defend — and another thing that broke when hardware moved.
Serving real products to the public from your own hardware means the edge has to be boring, hardened, and portable. A hobbyist network wasn't going to carry a business.
The system.
We rebuilt the edge around secure outbound tunnels: services dial out to the edge network, and visitors are routed back through it — so nothing on our network listens for inbound connections at all.
Origin servers were locked down to refuse anything that doesn't arrive through the tunnel, even direct hits on the raw IP with a forged hostname. Internal tools sit behind an authenticated access gate, and because a tunnel connector is just software, it moves to healthy hardware when a host misbehaves — services have survived machine failures by relocating in minutes.
Outbound-only connections carry all public traffic — no inbound ports.
Direct hits on the raw IP get refused, forged hostnames included.
Private tools require authentication at the edge, before our network.
Connectors relocate to healthy hardware when a host fails.
What changed.
A stranger scanning our address finds almost nothing to talk to, while a dozen public products keep serving. The edge stopped being the scary part of self-hosting — and it's the same pattern we deploy for clients who want products on hardware they own.
The next study could be yours.
Bring us the problem — the messy, manual, “there has to be a better way” kind. We'll design the system, build it, and run it.