Any tips for my current setup?

I recently started using Caddy + Crowdsec as a reverse-proxy after previously relying mainly on Tailscale, but needing to switch due to a device outside of my network not supporting Tailscale to access a Jellyfin server I'm hosting.

After quite a bit of trial and error, I was able to get it set up but am unsure if I've missed anything to harden the security of my setup.

I'm running everything from my home PC running Windows, which I know would be more secure using dockers but because it is my sole computer I don't have the resources to run everything under WSL2.

My Caddyfile currently looks like this, with specific information obfuscated:

{ crowdsec { api_url http://localhost:8080 api_key *** ticker_interval 15s appsec_url http://localhost:7422 } log { output file C:\Caddy\logs\access.log { roll_size 5MiB roll_keep 5 } } layer4 { localhost:4444 { @crowdsec crowdsec route @crowdsec { proxy { upstream localhost:6443 } } } } } ***.***.*** { route { crowdsec appsec } tls { dns desec { token "***" } } log encode gzip handle_path /jellyfin/* { reverse_proxy localhost:8096 } handle_path /navidrome/* { reverse_proxy localhost:4533 } } 

With Crowdsec, I'm using both Caddy and Windows Firewall bouncers, with logs setup for both, as well as the maximum free lists.

If there are any other setting files needed to share, I can.

One thing I have read a bit about is using headers, but don't know where to start with that.