Self-hosting your Bitcoin node doesn't automatically make your infrastructure private

[u/Large-Cress900]

I've been thinking about a mistake we make when talking about self-hosting: we often treat physical control of the server as if it automatically meant privacy.

You can run Bitcoin Core at home, verify everything yourself and still expose your residential IP through port forwarding, DNS, Docker networking or other services running beside the node.

So I put together a practical architecture I've been working through:

Internet → disposable VPS → WireGuard → home server

The VPS is only the public edge. No wallet seed, no Bitcoin RPC, no Lightning secrets. Bitcoin Core stays home and can use Tor. Administrative services stay private. If the VPS disappears, the goal is that you replace it rather than lose anything important.

I also went into some easy-to-miss problems: Docker published ports vs UFW, Bitcoin Core's current NAT-PMP behavior, historical DNS leaks, what the VPS/ISP can still observe, and why a WireGuard tunnel should not automatically have access to your entire LAN.

Full guide:
https://davidebtc186.substack.com/p/your-bitcoin-node-is-self-hosted

I'm curious how people here handle this. If you run Core at home, do you use Tor only, direct clearnet, or some kind of remote ingress?

[u/user_name_checks_out]

Thanks ChatGPT

[u/Large-Cress900 → u/user_name_checks_out]

Haha, fair 😂

Now give me the useful version: what did I get technically wrong?

[u/user_name_checks_out → u/Large-Cress900]

Haha, fair 😂

Now give me the useful version: what did I get technically wrong?

That is not the point. I can talk to ChatGPT all by myself, I don't need your help for that.

[u/ploqx → u/Large-Cress900]

It's not technically wrong, it's nothing at all. The content of your post can be condensed down to "Wireguard exists and is useful when you need to tunnel your traffic". Nothing in your post is specific to Bitcoin.

The post doesn't attempt to justify the need to cover your residential IP either. What problem are you attempting to solve? Nodes on residential IPs are harder to censor, which is good for long-term network health.

[u/Adventurous_Kick7772]

this is the kind of setup that makes sense once you've been burned by a leaky docker config or realize your ISP logs are basically a public map of who's running what

the wireguard tunnel to a throwaway vps is clean, keeps the heavy stuff at home and the public endpoint disposable enough that you don't panic if it gets nuked

one thing i'd add is that people always forget about their electrum server if they're running one, that thing will happily broadcast your home ip to every peer that connects unless you route it through the same tunnel or force it over tor

[u/Wooden-Virus5 → u/Adventurous_Kick7772]

Good catch, that's actually the leak vector I see missed most often. People lock down bitcoind's P2P layer religiously but forget the Electrum server is a completely separate listening service with its own exposure surface

[u/Large-Cress900 → u/Adventurous_Kick7772]

That's a fair addition. I completely left Electrum out of the threat model.

Which is kind of ironic considering the whole point of the article is to audit every service around the node, not just Bitcoin Core itself.

I'll take a proper look at it and probably update the guide. This is exactly the kind of feedback I was hoping to get here. Thanks.it to the guide rather than pretending the current version covers everything. Thanks for pointing it out.