I spend a weird amount of my week explaining that a self-hosted security stack isn't one tool. A friend put Wazuh on a box, watched the dashboard for an afternoon, and announced he was covered. Then a scanner hit his SSH port, Wazuh logged it as clean as day, and nothing actually happened. Detection without prevention is just a crime log you've paid for. Somewhere in the middle of helping him I wrote down what I really run on my own small network, and it settles into three layers: something that catches it, something that blocks it, and something that gets you back when both of those fail.
That's the whole self-hosted security stack, and it's worth saying slowly, because it keeps getting compressed into "just install a SIEM."
What a self-hosted security stack actually is
Layer one is detection. For me that's Wazuh running in Docker — log ingestion, file integrity monitoring, vulnerability checks. It tells you something happened. It is genuinely good at this, and it behaves on a modest server, not a Kubernetes cluster.
Layer two is prevention, and this is the bit people skip. CrowdSec watches the bits that face the internet. Its real trick is the shared community blocklist: an IP that got hammered on somebody else's box an hour ago is already on my ban list before it knocks on my door. That's the difference between fail2ban guarding one door and a network that's effectively seen the fight already.
Layer three is recovery, because no layer is leak-proof. Restic does encrypted, deduplicated snapshots, and I don't believe any of it until I've restored it. I test a real restore on a schedule — a backup you have never read back is a rumor.
Why you want all three running at once
Most small shops run layer two, maybe, and pray about the rest. I get it — three tools sounds like three things to babysit. The trick is that a folder of docker-compose files handles it. Detection logging to one place, prevention feeding a shared blocklist, backups churning at 2am and emailing their little status line. The dashboard is the only thing you actually look at in the morning.
The honest name for this shape is a self-hosted security stack, and it's the kind of thing you assemble once and then mostly forget until a ticket reminds you why it's there.
FAQ
Do I need a SIEM if I already block bad IPs? Blocking stops what you've already seen. A SIEM tells you about the thing working quietly at 3am that nobody blocked because nobody knew it existed. Different jobs.
Is restic enough, or do I need a NAS? Restic encrypts, dedupes, and gets you to a working restore. Offsite is on you — point it at a cheap S3 or B2 bucket and the 3-2-1 rule mostly writes itself.
What's it really cost to run? Hardware and attention. On a small server the three stacks are polite about RAM. The ongoing cost is tuning alert noise, which is its own monthly chore and well worth doing.
I bundled all three into one folder — Wazuh, CrowdSec with a Grafana view, and a restic backup with a small audit dashboard — as the SMB Security Pack if you'd rather not wire them together yourself. $15 one-time, updates included. Cheap enough that the decision stops being "should I" and becomes "fine, give it an afternoon."
Top comments (0)