CyberSecurity Paranoia

Hi folks, I wanted to do a quick sanity check on my current infrastructure and see what you all think—mostly to figure out if I'm sliding too far down the paranoid over-engineering rabbit hole or if this actually makes sense. Here is my current setup: Internal Services: Anything used exclusively at home stays strictly behind WireGuard . If I’m away, I just toggle the VPN on my phone or laptop. Exposed Services: For the few things that must be accessible over the open internet (HTTPS only)—mainly because I have a device where I can't install a VPN—I route traffic through Traefik as my reverse proxy. Security & Middleware: On Traefik, I’ve set up rate-limiting middleware for exposed APIs and strict security headers for web services. Around that, I’m running CrowdSec to catch weird traffic patterns and Pocket ID for SSO/authentication. Lately, I’ve been tempted to throw mTLS (Mutual TLS) into the mix for those few publicly exposed services. The endpoints are only accessed by a handful of devices (mine and my partner’s, all under our direct control), so requiring client certificates feels like adding an unbreakable layer of armor. But I keep asking myself: is this pure paranoia, or is paranoia just a spectrum with no limit in self-hosting? On top of that, I’m considering adding or switching over to Cloudflare Tunnels ( cloudflared ). I haven't migrated my DNS to Cloudflare yet because I’ve seen very mixed reviews: some people had bad experiences with updates breaking things or policy concerns, while many others swear by it. What are your thoughts? Is mTLS worth the hassle for personal/family setups, or is it overkill given CrowdSec, Pocket ID, and proxy middleware? And how has your experience been with Cloudflare Tunnels compared to hosting your own proxy on a public IP? Roast my setup or hit me with your practical advice! Cheers.