Drippin' Pools by Gio

Cloudflare Tunnel was already hiding the home network's IP correctly — nobody can find the real server by looking up the domain. I turned on three things that were off by default: Bot Fight Mode (challenges suspected automated traffic before it reaches Nginx), Block AI Bots (stops scraping/training crawlers), and AI Labyrinth (sends bots that ignore the block into an infinite maze of fake pages).

Suricata (inline IPS mode) had already blocked 27 inbound SSH brute-force attempts from known-bad IPs before they touched anything inside. DMZ isolation was correct — the server can reach the internet but nothing internal. One gap: Suricata only watched the WAN interface, not the DMZ, so malware calling home from a compromised DMZ box would go unseen. Fixed by routing the DMZ's DNS through my Pi-hole instead of a public resolver — every domain the server looks up now gets logged and checked against a known-bad-domain blocklist automatically.

Login history was clean, but a port scan turned up two real issues: an old test/demo service left reachable from the outside longer than intended, and SSH still relying on password auth with no protection against repeated login attempts. Both were closed the same day — the exposed service was removed, fail2ban was installed and tuned, and SSH was switched to key-only authentication.

Specifics are kept general here on purpose — the audit process and the fixes are what's worth showing, not a map of what used to be open.

Logs showed only normal background noise — WordPress-login probes that got harmless 404s, a self-identifying security-vendor scanner, and social/AI crawlers. But bots were auto-filling the contact form to spam it. Fixed with a honeypot: a hidden field real users never see; if it's filled in, the backend fakes a success response and silently discards the submission, so the bot never adapts. Also added a robots.txt disallowing the contact route to cut down on scanner noise.