Hetzner is great as a provider, highly recommend.

I use authentik with fail2ban, crowdsec and ufw. I use netbird to act as a VPN between different servers - most services need users to login through there but have a couple on the internet. I also restrict countries to ones my clients are on and update when im going on holiday.

I use caddy as my reverse proxy with rate limits and crowdsec. I moved from NPM just to try it and liked it.

SSH is on a different port and restricted to keys only. I also setup ntfy to notify my phone if there are logins (to check it’s just me).

I use unattended upgrades for security but try to upgrade frequently the servers and docker services.

+1 for authentik

I think Debian Server + Docker compose. Its the easiest way to get started and has the most documentation for. To me, the OS itself is the least concern - just get something maintainable. Then choose services you want from https://selfh.st/apps/ and have a go with them. Most services give you docker compose scripts so that is by far the easiest way.

If there are two of you with accounts, then I would suggest these:

• Reverse proxy (caddy, nginx, etc)
• SSO authentication (authentik, authelia etc)
• VPN for access (wireguard, netbird, tailscale etc)
• Security (fail2ban, crowdsec, etc)

On top of Home assistant and the Jellyfin / arr stack you mention, I would recommend Immich (google photos), Paperless NGX (letter scanning / management), Vaultwarden (password manager), FMD (find my device server for android phones), and SearNGX (private search engine).

Potential alternatives would be NixOS (fully scripted) and Proxmox (better containerisation but still got to decide what you install on each container, such as Debian + docker). You could also use podman instead of docker compose, which is more secure but a bit more effort to adapt to. However, if access is only through the VPN and you have two users, Debian + docker would be fine.

Adding to this - first thing I self hosted was vaultwarden so keeping track of the admin accounts is so easy. Make an admin account at the start to set it up, then only use that in a private window for any settings changes needed. My personal account is then like a normal user which helps me test it and keep it separate. I try and use SSO for everything so it also tests if that works correctly - I.e. after setting it up I’ll login to my personal account on the SSO to see if it registers correctly and that my username is given regular access.