A lot of people simply don’t have time to go the extra steps.

Instead you should be focused on secure by default design. E.g. not setting a static router password to admin admin.

It’s stupid in this day and age to continue to see default logins occur still.

I setup caddy and a proxy server for ingress.

Essentially I have a server with wireguard connections between my home server and the external VM.

Proxy using proxy protocol with nginx so it preserves the ip.

DNS certificate management with cloudflare, and I’ve got Authelia in front of the majority of my websites, with some exclusion rules, say for a share link.

Authelia has mandatory 2FA, anything less is silly, with Grafana alloy scrapping caddy metrics.

Anywho most of my stuff runs in docker. The stuff I don’t want on the WAN but on tailscale/Lan has a filter to block the wireguard interface.