I want to run a web server at home (really for the fun and learning of web/network and other security best practices), running a web app that I plan to write with Ruby on Rails and be able to access it from outside. I plan to run it on a Linux VM + Apache web (want to install from scratch, again for the fun of it) server running in virtual box/VMWare on my Mac.
I understand I need to forward ports (plan to forward 80 to 8080 or some other unprivileged port, no other port opened from my router), potentially get dynamic DNS etc to be able to access it reliably etc, and am not worried about getting it connected to the outside world.
I have read articles and resources on hardening the Apache webserver. I plan to try and follow best security practices to mitigate common threats (XSS, CSRF, SQL injection etc) for the webapp itself (using Ruby on Rails security guide which I think is a pretty good starting point).
Since I'm running it on a VM, is there a way for somebody to hack/hijack the webserver/web app to control my host machine (I don't care if they control the VM since this whole thing is for learning)?
What extra precautions do I need to take to protect my host machine? Or is it simply better to get a separate system just to run the webserver?
Also what extra protection can I add in my VM to prevent it from getting hacked in the first place (firewalls, intrusion detection like snort?)
If the VM or dedicated webserver machine is taken over, how does it affect my local/LAN network security? How can I mitigate the threat?
Is it safer to create a VM, create a web server accessible only through a VPN inside the VM, where the VPN server is sitting inside the VM, and create VPN logins through which the web server can be accessed? Similar or exactly the same as how you have a corporate intranet? I assume I will run OpenVPN as a unprivileged user and not sure if I can make it listen on unprivileged ports.
I have read the authentication wiki and other related posts on Stack Exchange such as vulnerability of other systems if one system is compromised on the network etc, but still felt the need to ask the question.