OpenVPN is my current method. Got it running on port 443 with user certificate authentication, and tls-crypt on top of that to completely mask the protocol from VPN detectors.
Also technically prevents DoS attacks, but that wasn’t my primary goal.
“Finally… Now I can compile Firefox and use it in the same afternoon.”
Probably, but it’s also the perfect excuse the relearn sailing the high seas if you haven’t done it in a while.
The blessing and curse of simplicity.
I may have written that in a confusing way. I’m saying systemd’s job is service management. Systemd-resolved is an unnecessary bit of scope creep.
There’s also a few cases of feature and scope creep, including the infamous systemd-resolved.
Systemd, your job is to launch services, manage logs, and do timers and relaunches on a service crash. DNS is out of scope, leave that to existing services.
LTSC is fine, and you can just use massgrave.dev to activate it.
My network has all the web ui stuff kept local and only accessible via OpenVPN on port 443, with fail2ban as well.
By the time a would-be attacker realizes it’s not actually a webserver, they’ll have exhausted most, if not all, of their public IP addresses on fuzzing for webserver vulnerabilities.
EDIT: and as a bonus, I can also just punch out through the firewall my work has on the visitor network with ease. All I needed was a second fail2ban rule for their static IP to deal with followup scans.