That’s what made ddos so effective when it first came on the scene. Stopping or mitigating one took a lot of time, phone calls, and coordination between service providers.
Edit: another thing, a large scale ddos on a residential IP address will for sure get the attention of your ISP. If you’re running something that may get that kind of attention check your TOS :)
To fully automate, you can use a premade tool like autossh, or just replicate it using standard ssh with keepalive option + a custom sysd unit file.
It's not great, but it's not the end of the world either, and doesn't actually incur any risk to your data or home network. Hell, if you want to learn mitigating this yourself, open Wireshark on your WAN interface, get the attacking IPs and send out abuse reports to their respective hosts. You can clear most script-kiddie "booter" style attacks like this in a day, dismantling their botnet in the process.
If you want to self-host a solution, few things to keep in mind:
- Rate-limit "heavy" (RAM, CPU, I/O) processes that can be externally triggered via HTTP calls or similar (if you have a HTTP endpoint for regenerating a cache or something like that, make sure it can only be called max once per hour, and so on)
- Setup fail2ban, and things like mod_evasive if you're using Apache (I'm sure Caddy/nginx have similar solutions)
- Only expose what you really want to with iptables
Ultimately, unless you're hosting something really popular or controversial, you don't really need to be scared about being ddosed. People don't spend resources just ddosing random stuff without a reason for it, and unless it's popular/controversial, you just won't get hit by anything but random port scans/vulnerability scans.
I would still be hosting at home but where I live it's nearly impossible to get a static, routable IP.
Did you try anything else before slapping cloudflare in front of your setup?