Selfhosted

I am sad, and ashamed, that you had to continuously point towards it being "a hobby exercise" - without which the only answers you would get are "change your VPS provider bro" or "you're too scared bro". Paranoid or not, these questions are important to understand and answer (network security is not easy when you get into such concepts), regardless where they are coming from. I am positively dismayed; aggravated even, that even in such a community where people know so much, the first thought that would come to their mind is "just trust them bro".

That said, you are correct. The VPS can absolutely inspect your storage + RAM and scrape the keys/certificates. Considering that Cloudflare tunnels are much worse, I'd rather stick with a VPS, but the problems remain.

I wonder if LUKS can be used for the underlying storage hosting these certificates. Although, will that help if the RAM of the device is compromised?

Cheers

the VPS provider can always get their own certificates for my domains and do a MitM attack.

You can limit which CA's will offer certificates for your domain with the CAA record in DNS. You can also at least detect if someone else creates a certificate for your domain if you watch the certificate transparency logs.

Technically you're correct: your VPS provider can inspect your network traffic, the contents of RAM and anything on the disk.

Bluntly: you have to trust your VPS provider, and if you're unsure they're trustworthy you shouldn't use them.

(Scaleway is legitimate, bound by actual useful data protection laws, and has a comprehensive privacy and security policy.)

You could try destination NAT with netfilter/iptables (DNAT) and terminate TLS on your home server.

This way packets will be forwarded to the home server without beign decrypted on the VSP.

Best option is to directly NAT traffic from VPS to your home server, either directly to your IP or set up a wireguard peer and send traffic via wireguard to your local and do the SSL/TLS termination on your local.

You are best exposing just 443 port on the VPS and moving that traffic over wireguard. Server will have your local public key on the server, and you could implement a wireguard key rotation to change them frequently.

Traffic sent back will be encrypted with the certificate, and even if they get the wireguard server key, you can rotate it, but still they will see encrypted packets.

It depends what kind of things you're doing on your local. If it is just a website thing, then reverse proxy is fine. Anything other than that, NAT would be cleanest one.

LUKS on the disks would encrypt it the data on the block storage level, and, in theory, they should not have a way of reding block storage files directly. But since it is a VPS they can, technically, gather data from host memory.

Next step might be going down a dedi server route, Luks encryption on disks. Only thing thats needed there would be sufficient network pipe.

You are correct. The provider owns the IP and also VPS. They theoretically have the ability to do anything within those confines. Same thing with your nameserver provider with your DNS records and the domain itself with the registrar. There's a certain level of trust that needs to be accepted for anything that goes outside the confines of your house. The good thing is those companies have more to lose than you by breaking that level of trust.

Terminate the ssl connection at a reverse proxy hosted in your home server, and instead useiptables to redirect the traffic through the wireguard interface

It sounds like you're doing something very similar to me. I run my Lemmy and Mastodon server out of my home. I have a wireguard tunnel between that server and my cloud VPS. The cloud VPS handles reverse proxying. The information that I am most likely leaking is metadata. Metadata is surprisingly useful. In an ideal world we could secure and obfuscate everything. For the most part though, your traffic is secure and your cloud provider won't be able to really get more than your metadata.

@dr_robot

Something else to consider is Cloudflare tunnels. They are free and quite handy.

Essentially, it creates a secure wiregiard connection between you and cf so you don't need to open any ports or have a reverse proxy on your side. Then, cf becomes the end point and where dns points.

Cf essentially hosts your reverse proxy for you and you so all the config on their site once you get the tunnel setup. The Cloudflared docker is all that I had to set up.

Its essentially what you are doing with the vps, but purpose built and free.

I'm using a SSH tunnel to connect a port on my vps to a port on my home server. I have rhevssl certificates both on the vps and the home server (I trust the vps provider), but I'm pretty sure (correct me if I'm wrong!) that this would work with the certificates only on the home server. Could the vps provider do a mitm then? I'm not sure, the packets go in one port and are directly forwarded to my home server.

Can the vps provider get their own certificates? That's a good question. I guess you could check the certificate when connecting to prevent tampering. Datetime of issue alone should be enough since vps providers can't fake that. Unless you don't trust CAs either :)

If you’re concerned that you VPS provider is replacing your certificates you need to find another provider.

You should also look in to certificate transparency monitoring. I get notified anytime a certificate gets issued for one of my domains.

DNS is very leaky no matter where you run it, unless you run DNS over HTTPS (DoH). Full stop.

I'm no fan of DoH because it scales poorly. Nevertheless, a combination of Tailscale (or tailscale-like securort overlay mesh network) and an in-mesh DoH DNS relay going to be more secure than most other setups. Relay the DNS out through Tor at your own (performance) peril, but that's going to he very secure.

I'm not a practitioner of this method, but it's how I would approach it if I needed to.