Probably a silly question: Is serving HTML required? git exists after all

Here’s mine : )

root is a user account that has all privileges and is what bots are programmed to probe, so exposing it introduces unnecessary risk. IMO there’s no reason to permit root login via ssh in any circumstance, ever, in all cases, absolutely.

For all the people thinking, “well the world doesn’t work in absolutes, there’s always a special case!” There isn’t.

If a user needs to use elevated permissions, there are many ways to do that without exposing root. sudo(8) is one way to do that.

IMO ssh is the tool you’re describing. My ssh server is exposed to the WAN and is configured like this:

• set to a random port to reduce spam (completely eliminated it for me)
• set PasswordAuthentication no
• set PermitRootLogin no

I bought into .net almost 10 years ago and never left. I think legacy tlds (com, net, org) tend to be more affordable and I can be motivated by money.

• Uptime
• Days since last system update
• Days since last CVE scan

• Embrace
• Extend
• Extinguish

Like 10 years ago, I got started by doing this project:

OpenBSD PF: Building a Router

In general, I’d recommend ANY BSD documentation or guides, they’re all written by knowledgeable ppl who are also likely educators in CS departments. Also, I’d recommend actually doing a project. Reading is useful and IMO the doing is much more effective.

So I recently quitted Google Drive

Congrats, great life choice

downloaded all my data and hoping to keep it on Hard drives myself, They are external plug in types

You have multiple external drives. Are they USB? How many?

So when I plug it in

Are they not usually plugged in? Is there a requirement to keep them air gapped between syncs?

it copies/syncs the things on my computer, anyone knows somethign like that?

Like others have said, a shell script that calls rsync is maybe the way to go and with some more information on number of drives, drive interface type, and air gap requirements it may change

Nope, I’m accessible on the WAN and the webserver is intentionally public facing.

Edit: AllowUsers in sshd.conf is my access control

I operate SSH, nginx, and uvicorn like this:

SSH

• pubkey auth only
• not on default port
• AllowUsers var in sshd.conf is set

nginx

• runs as its own user
• serves static files or forwards to uvicorn
• rate limits are set
• returns 444 on requests that aren’t in sitemap.xml (nonsense and probing)

uvicorn

• runs as its own user

and a firewall runs on top of everything in a hardened kernel. I’m self taught, so I could be missing something obvious and this setup has been reliable for me for a few years.

Probably wouldnt use. I don’t monitor dashboards. I send myself an email when something needs attention. Then, if I find myself needing to check on something, I use ConnectBot.