Getting the First One Right
Most bad self-hosting experiences don't come from a hard piece of software. They come from good software stood up in the wrong order: exposed before it was configured, configured before it was tested, tested with the default password still sitting there. None of the steps below are advanced. Doing them in this order is the whole trick.
Pick a Forgiving First Service
Your first self-hosted app shouldn't be the one thing your household actually depends on working. A read-it-later app, a photo backup tool like Immich, a password manager like Vaultwarden, all of these are useful enough to be worth running and forgiving enough that a mistake costs you an afternoon, not a crisis. Save the service that everyone will notice the moment it's down for after you've made your early mistakes on something lower stakes.
Run It Local Before You Expose It Anywhere
Get the service running on your home network first, reachable only from your own devices, before you think about the internet at all. A basic docker-compose.yml and an evening is usually enough. Confirm it actually does what you wanted, poke at the settings, break it a little on purpose. Every problem you find while it's LAN-only is a problem that never had a chance to be someone else's problem too.
Put a Reverse Proxy in Front of It, Not the Internet
Never port-forward a self-hosted service's own port straight to the internet. Put a reverse proxy (Caddy, Traefik, or Nginx Proxy Manager are all reasonable choices) in front of it instead, and forward only that. Caddy in particular hands you automatic HTTPS through Let's Encrypt with almost no configuration, so there's not much excuse to skip it. The service itself stays on an internal network, unreachable except through the one thing you're actually watching.
Change the Defaults the Moment It's Up
Default admin passwords, default API keys, default demo accounts, all of it needs to change before the service is reachable from anywhere but your own LAN, not on some someday list. Scanners look for exactly these defaults constantly, and "I'll get to it" is how a fresh install gets compromised in its first week. This takes five minutes. Do it before you write down the URL anywhere.
Plan the Update, Not Just the Install
Installing a service is a one-time decision. Updating it is an ongoing commitment you're making at the same moment, whether you think about it or not. Decide upfront how you'll actually pull new versions, a tool like Watchtower for automatic image updates, or a recurring calendar reminder to check manually, and stick to whichever one you picked. A container running a two-year-old image with known CVEs isn't a self-hosted service anymore. It's an open door with extra steps.