As the title says, I want to know the most paranoid security measures you’ve implemented in your homelab. I can think of SDN solutions with firewalls covering every interface, ACLs, locked-down/hardened OSes etc but not much beyond that. I’m wondering how deep this paranoia can go (and maybe even go down my own route too!).
Thanks!
Notifications on system file access
Notifications on root login/sudo
Declarative OS, tmpfs root, disabled sudo
Bastion server, but right now I don’t have a proper router to do it at home
Yubikey, or a separate phone on Graphene OS for otp, keys, etc
Authelia + fascist fail2ban (or some CSF)
Most of these are pretty normal, but usually you don’t do them all at once 😄 also, I don’t really like hiding my services from the open internet, authelia is fine tuned to let people only access what they are supposed to. And regular users of my server usually don’t notice that I even have it