Self-host multiple websites behind pfSense

Name               site1_backend
Server list
  Name             docker-host
  Address          192.168.10.20
  Port             8001            # container's published port
  SSL              (unchecked)     # LAN traffic stays plain HTTP
  Verify SSL cert  (unchecked)
Check method       HTTP
HTTP check URI     /
HTTP check host    site1.yourdomain.com

# Access Control Lists — Host header match
ACL 1  Name: host_site1  Expression: Host matches: site1.yourdomain.com
ACL 2  Name: host_site2  Expression: Host matches: site2.yourdomain.com
ACL 3  Name: host_site3  Expression: Host matches: site3.yourdomain.com

# Actions — route matched ACL to backend
Action 1  Use backend: site1_backend  Condition ACL: host_site1
Action 2  Use backend: site2_backend  Condition ACL: host_site2
Action 3  Use backend: site3_backend  Condition ACL: host_site3

# Default backend (for unmatched hosts) — a "not found" page
Default backend  default_404

# System updates + base tools
sudo apt update && sudo apt upgrade -y
sudo apt install -y ca-certificates curl gnupg unattended-upgrades

# Docker engine + Compose (official convenience script)
curl -fsSL https://get.docker.com | sudo sh
sudo usermod -aG docker $USER
sudo systemctl enable --now docker

# Sanity check
docker --version
docker compose version

services:

  site1:
    image: nginx:1.27-alpine
    container_name: site1
    restart: unless-stopped
    ports:
      - "8001:80"                  # HAProxy backend target
    volumes:
      - "./site1/html:/usr/share/nginx/html:ro"
    read_only: true
    tmpfs:
      - /var/cache/nginx
      - /var/run
      - /tmp
    security_opt: [no-new-privileges:true]
    cap_drop: [ALL]
    cap_add: [CHOWN, SETGID, SETUID, NET_BIND_SERVICE]
    logging: { driver: json-file, options: { max-size: 10m, max-file: "3" } }

  site2:
    image: wordpress:php8.2-apache
    container_name: site2
    restart: unless-stopped
    ports: ["8002:80"]
    environment:
      WORDPRESS_DB_HOST: site2_db
      WORDPRESS_DB_USER: wp
      WORDPRESS_DB_PASSWORD: "strong-pw"
      WORDPRESS_DB_NAME: wp
    volumes: ["./site2/wp-content:/var/www/html/wp-content"]
    depends_on: [site2_db]

  site2_db:
    image: mariadb:11
    container_name: site2_db
    restart: unless-stopped
    environment:
      MARIADB_DATABASE: wp
      MARIADB_USER: wp
      MARIADB_PASSWORD: "strong-pw"
      MARIADB_ROOT_PASSWORD: "strong-root-pw"
    volumes: ["./site2/db:/var/lib/mysql"]

  site3:
    image: node:22-alpine
    container_name: site3
    restart: unless-stopped
    ports: ["8003:3000"]
    working_dir: /app
    volumes: ["./site3:/app"]
    command: ["node", "server.js"]

# At your DNS host (GoDaddy / Cloudflare / registrar):

Type  Name               Value              TTL
A     site1.yourdomain   203.0.113.22       Auto
A     site2.yourdomain   203.0.113.22       Auto
A     site3.yourdomain   203.0.113.22       Auto
A     @                  203.0.113.22       Auto   # bare root domain
A     www                203.0.113.22       Auto   # www alias

# SSH: key-only, custom port, disable root login
sudo sed -i 's/^#\?Port .*/Port 52022/' /etc/ssh/sshd_config
sudo sed -i 's/^#\?PermitRootLogin .*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo sed -i 's/^#\?PasswordAuthentication .*/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

# Host firewall — allow only 22 and container ports from LAN
sudo apt install -y ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow from 192.168.10.0/24 to any port 52022 proto tcp   # SSH from LAN only
sudo ufw allow from 192.168.10.1 to any port 8001:8099 proto tcp  # pfSense -> containers
sudo ufw enable

# Fail2ban — block SSH brute forcers
sudo apt install -y fail2ban
sudo systemctl enable --now fail2ban

# Automatic security updates
sudo dpkg-reconfigure --priority=low unattended-upgrades

# Disable services you don't need
sudo systemctl disable --now snapd cups bluetooth avahi-daemon 2>/dev/null || true