How it's kept safe

People are sometimes surprised that a home setup can be run responsibly, so here's the philosophy in non-technical terms:

• The front door is tiny. The vast majority of the lab is reachable only from inside my own network. The few things friends can reach from outside go through a single, locked-down gateway that does nothing else — not through my home router, which forwards nothing.
• Encrypted everywhere it matters. Connections from outside are encrypted, and remote access between my own machines rides a private, encrypted mesh network rather than the open internet.
• Least exposure. Optional features that aren't in use simply aren't turned on. Fewer moving parts, fewer things to secure.
• Backups and recovery. The important stuff is backed up on a schedule, and there are written recovery steps for when something breaks (because it eventually does).

This page is deliberately vague on specifics — that vagueness is part of the security. The point is just that "self-hosted" and "careful" aren't opposites.