sandwichsaregood

Is that a hot take? I see a lot of people saying this, including myself. Kubernetes solves problems at work, but is way overkill even for my moderately elaborate home setup that would cause more troubles than it solves. If people want to use k8s at home go ahead, but I don’t.

I agree that there is some value to obscurity generally, but Wireguard already evades port scans and fingerprinting. Unless a packet is signed with a known key, it gives no response to traffic, so scanners and fingerprinters see a closed port. You ISP can identify WG traffic while you are connected by inspecting your traffic, but random scanners won’t see anything. Look on shodan, you won’t see Wireguard.

I ended up building it myself, which may be the best option if you want to use other plugins. I have it set up in my own Forgejo with a CI configuration to auto build the binary and docker image. Forgejo let’s you also host container images, so I can just pull from the latest build wherever I need it.

Both those tools analyze service logs for suspicious activity and block based on patterns. If you aren’t hosting anything externally, they probably aren’t doing anything.

Tugtainer is pretty nice, and has a webui.