A home server has three realistic adversaries: automated scanners that find any exposed port within hours, commodity malware that encrypts whatever it can reach, and you, at 1 a.m., with sudo. Nation-states and dedicated human attackers are not on the list unless your job or situation puts them there. Model those three honestly and homelab security collapses into six controls, most of which ship in a weekend — and the first one is backups, because entropy destroys more homelab data than every attacker combined.
Start with assets, not attacks
Threat modelling questions in order: what do I have, who wants it, how would they get it, how much do I care. For a home server the first question does most of the work:
| Asset | Worst case | Replaceable? |
|---|---|---|
| Photo library | Gone forever | No |
| Password vault | Every account exposed | Data no; access recoverable |
| Tax and identity documents | Identity theft | No |
| Email archive | Blackmail-grade history leaks | No |
| Media library | Re-acquire it | Yes |
| App configs | A rebuild weekend | Yes |
Security budget should follow the right-hand column. Your media library deserves roughly zero protection effort; your photos deserve the most — and their number-one threat is a dead disk, not a hacker.
The adversaries you actually have, ranked by likelihood
Entropy. Disk failure (Backblaze's published fleet data puts annual failure rates around 1–2% per drive, worse for old consumer disks), a botched migration, a fat-fingered rm -rf, a power event during an upgrade. This is the leading cause of homelab data loss by a wide margin.
Internet background radiation. Expose SSH or a web login publicly and credential attempts start within the hour — Shodan and Censys re-index the whole IPv4 space continuously. Nothing personal: bots probe every address for unpatched software and default credentials. If you expose a popular app and skip a security release, assume the exploit arrives within days of the CVE.
Commodity ransomware, usually landing on a family Windows PC and encrypting every SMB share it can write to. Your server gets hit as collateral, via its file shares.
Credential stuffing. A password you reused in 2019 shows up in a breach dump and gets replayed against everything.
Burglary. They want the hardware, not the data — but the data goes with it.
Explicitly not on the list: a skilled human targeting you personally. If your realistic threat model includes that — journalist, activist, abusive ex, contentious lawsuit — you need operational security advice beyond a homelab article, and self-hosting may actually be the wrong call.
The six controls
1. Backups, 3-2-1, with one copy attackers can't reach. Counters entropy and ransomware, your top two threats. The critical property is that a compromised server can't destroy its own backups: use restic to a rest-server in append-only mode, or Backblaze B2 with object lock. The full pattern is in the 3-2-1 guide.
2. Expose nothing; use a VPN for remote access. Tailscale or WireGuard removes the background-radiation adversary almost entirely. My router forwards zero ports, which deletes the whole "patch within days or else" treadmill for most of my stack. Options compared in remote access three ways. If you must expose a service, CrowdSec adds a community blocklist that drops known-bad IPs before their first request.
3. Unique passwords plus TOTP everywhere, via a manager like Vaultwarden. Counters credential stuffing for a few hours of one-time setup.
4. Patch internet-facing software within days. Only what's exposed needs urgency — subscribe to release feeds for those specific apps. LAN-only services can update monthly on your schedule.
5. Segment IoT onto its own VLAN. The $30 camera with abandoned firmware should be able to reach the internet, maybe, and your NAS, never. One VLAN plus a deny rule covers it.
6. Encrypt deliberately. Laptop and phone: always, they leave the house. The server is a judgement call: full-disk encryption means every reboot needs a passphrase (dropbear in the initramfs works over SSH but adds fragility). My compromise is LUKS on the volume holding documents and vault exports, plain disks for media.
The likelihood math, worked once
Multiply likelihood by impact, roughly. Disk failure at a few percent per drive-year against irreplaceable photos dwarfs everything else on the board — which is why backups are the first security control, not an adjacent chore. An exposed, unpatched web app is the next biggest product. A targeted attack rounds to zero. If your spending doesn't follow that ordering — say, a hardened SSH config on a server with no tested restore — reorder.
Where to stop
Right-sizing means a stopping point. At home you do not need a SIEM, an IDS, honeypots, or a log-aggregation stack — the alerts outnumber the attacks by five orders of magnitude and you'll tune them out within a month, which is worse than not having them. One notification that the nightly backup failed is worth more than a wall of security dashboards. Run the boring version.
Bottom line
Backups with an unreachable copy, VPN instead of port forwards, a password manager with TOTP, prompt patches for the exposed handful, a VLAN for IoT junk, encryption where the sensitive files live. That's the whole model for a normal person. Everything beyond it is hobby — fine, but call it that.