Post #1230566

2026-04-12 07:47 UTC

@happyborg regarding security, I’m curious what you’re thinking there! On the one hand, a host can’t be trusted implicitly. They could for example grab your WireGuard keys if the system isn’t encrypted. On the more extreme end you also have the risk of them inspecting memory on a live system. That’s honestly a lot harder and requires pretty determined actor. So it’s not really an issue in my threat model. Re: things like WireGuard keys and TLS Certs I’m currently using an encrypted volume.

Replies (2)

@ianthetechie@fosstodon.org 2026-04-12 07:52

@happyborg I’m planning a whole post just in the encrypted volume setup since it’s not a very common approach I think. But it does simplify some things compared to FDE which complicates boot of a remote system. This at least enables the system and services that don’t need secrets to start. I also don’t give the VPS any privileges re: the boxes I control. No SSH keys etc. And PF is on the home side of the tunnel too. Anytbing else in your threat model?

Open ##1230567
@happyborg@fosstodon.org 2026-04-12 07:56

@ianthetechie you're years ahead of me there.. I've not done anything like this before. I was a coder, w some admin during v early startup. I've used VPS for things, including OpenVPN but Proxmox has started to reveal a whole new world. So while I don't want to be a sitting duck I really don't know what I'm doing and picking up bits and pieces from chaps like you. For example, that point about not having a fixed IP is noted. I wasn't going to but now I know why. 😆

Open ##1230571