Is keeping everything inside of a local “walled garden”, then exposing the minimum amount of services needed to a WireGuard VPN not sufficient?

There would be be no attack surface from WAN other than the port opened to WireGuard

Please do. I too stole it.

Act your wage

StandardNotes for me

I try to balance things between what I find enjoyable/ worth the effort, and what ends up becoming more of a recurring headache

I have a somewhat dated (but decently specd) NUC running Proxmox, and it’s the backbone of my home lab. No issues to date.

I was using a WD PR4100, but I upgraded to a Synology RS1221+ and it’s been fantastic :)

I have a beefed up Intel NUC running Proxmox (and my self hosted services within those VMs) and a stand alone NAS that I mount on the necessary VMs via fstab.

I really like this approach, as it decouples my storage and compute servers.

Join us; It’s fantastic.