Comment by sour-taste

A few insecure choices here: * fail2ban installed but no mention of actually setting up the rules. Additionally out of the box fail2ban won't work with docker containers * Wide open ports. Only open what you need * In the DNS script you are putting the username and password in the URL. This means even though you are using https anyone can see the username and password you're sending. Pass these options some other way.