The current setup, for reference.
- A dual-band router running
OpenWrt, with the stock one kept as a spare
- An old mini PC as the always-on box: a few containers, nothing precious
- A two-disk NAS in a mirror, snapshots nightly
- An offsite copy of the important folders, synced with
rsync
- This site: plain HTML on a small VPS behind
nginx, certificates via certbot
Rules I try to follow
- Default deny inbound; open ports only for things that actually listen.
- Every change to a remote machine gets an automatic rollback timer first.
- If a backup has never been restored, it is a hope, not a backup.