David Heinemeier Hansson

Embrace the progress of containers and security, question the financial equation of renting vs buying, and connect your own server to the internet.

Dare to connect a server to the internet

I just run 24 services of our business in a 400€ 4590k old machine with docker rootless containers through a reverse proxy (which is also a container in which some of other partially exposed containers are connected to).
This saved us ~5000€-18000€ a year in AWS costs we dropped out from.
Because I am using a 2 computer cluster of Docker Swarm I managed to load balance high loads with our workstation, which main purpose is machine learning training. It has a 5800X Ryzen paired with 64Gb of RAM.
You create your desired A registry subdomain in your domain manager for every service you want to expose which points to your IP. 
A wildcard is insecure enough.
Forward incomming 80 and 443 to 8080 and 8443 ports in NAT.
Best is to use an external firewall like PFSense.
Exposing 80 and 443 directly to your server, increases the surface attack. It is slightly better to port translate those to 8080 and 8443 or random ones.
Only expose 8080 and 8443 ports on the reverse proxy container. No other container has to be exposed directly.
Next to do, create configurations in reverse proxy to forward incoming request with subdomains to specific upstream containers by service hostname (because they are containers only exposed and resolved to reverse proxy container network by its container name as a hostname).
Last thing is to use certbot with Let’sEncrypt and http-&gt;https redirection to enforce HTTPS only.
I recommend Nginx Proxy Manager image because of its easy of use and web admin panel and Portainer as a nice web based container and deployment administration.
PD: You should use a NAS if you want persisted reliability from containers, and also forget about image, datasets and artifacrts storage.

Localhost::8080
Is completely safe 😅