Running Core on hardware you own solves one problem.
It doesn't automatically solve network privacy.
I went down the rabbit hole of what a home Bitcoin stack actually exposes: residential IP, DNS history, Docker ports, NAT-PMP, Lightning announcements, Nostr relay endpoints, monitoring interfaces and the trust you're introducing when you put a VPS in front of any of it.
The architecture I ended up focusing on is:
public Internet → disposable VPS → WireGuard → home infrastructure
with Bitcoin/Lightning secrets remaining at home and Tor used where it makes sense.
The interesting part isn't WireGuard itself. It's deciding what the VPS is allowed to know and what happens when it gets compromised or disappears.
My test became:
What can disappear tomorrow without taking me with it?
Full guide:
https://davidebtc186.substack.com/p/your-bitcoin-node-is-self-hosted
Curious how other node runners solve this, especially anyone running Core + Lightning + public services from the same home network.
When I ran a home node, I ran:
Public node (colo'd) --wg--> Private node (home) --intranet--> wallet
Now that I don't have a fixed home, I run:
Public node (colo'd) --wg--> Private node (colo'd) --wg--> wallet
Besides wireguard, LUKS is your friend. Also for your home hardware.
A few years ago I saw Start9 had a VPN router in the works. I haven't heard much about it recently