I personally use retired devices around the home, they are put on my IoT vLAN and wam bam thank you man I have a kiosk.

My passwords for OS and all admin dashboards are extremely long, unique, random strings managed by Bitwarden.

If you are paying for Bitwarden, or using their free tier, stop and and start hosting vaultwarden. You can still use the Bitwarden app, with vaultwarden but with all the premium features.

Get a firewall you can either install OpenWRT or opnSense on, when making my decision I went with OpenWRT because opnSense has a webpage that tries to upsell you. vLAN the heck out of your place, and set up a VPN to access your services like vaultwarden out side of your home. On a vLAN that cannot access your WAN or anything else put your IoT things, on a vLAN that cannot access anything else setup crowdsec. On the topic of crowdsec it should be your only device that port 22 is ssh!

For your IoT things set up home assistant, which should be on a different vLAN that can reach out to the WAN and into the IoT vLAN to control stuff. I wish I could say I have completly degoogled and deappled, but I am waiting for a year for my iPhone to stop getting updates and whenever for my iPad to stop getting updates. I should probably replace my homepod minis sooner rather than later with the Naebu things for HA. The only thing I still have a Google account for is youtube but once I get a hand me down Mac mini I will install Debian and get a youtube replacement with sponsor block.

One of the things that finally got me off of cPanel was the host I was using decided to rape me over the coals without letting me have a wildcard email address so I got a business plan that I could have unlimited email addresses so if one got spammy I could just turn it off and if I still used the service I just changed the email, or if I wanted to extend a free trial I could just spin up a new address. So I recently moved to a new host that offers wild card addresses.

Get a whole LAN adblocker, let it be pihole or adguard home, there was recently that spyware ad pixel so expect more of those in the future. Me personally use pihole and have it very finally tuned to block a lot. I tried adguard once but liked pihole better, this was years ago even before I had pihole finaly tuned so don’t ask me why I liked pihole more.

What I have done to harden SSH is:

• set up pubkey authentication and disable password authentication
• disable root login
• not expose my SSH port publicly; it is accessible only from my LAN and through Wireguard

I have done those things as well, but I have also

• changed my port, to some four digit number.
• port forwarded port 22 to its own vLAN that goes to a pi 0 2 that runs crowdsec as a honey pot.
• I am looking for additional things to run on either that pi or vLAN for security.

If it was just for backup backblaze is probably less expensive but my LAN consists mostly of pi’s and hand me down computers. I am slowly moving things around on my LAN so to each their own I guess. I like the idea of having more control over my stuff so having a whole Debian system on the other end feels right for me.

*edit: It also gives me peace of mind knowing that I can encrypt my stuff to my liking. Silly me I forgot to actually look at the encryption tool I used, I just did a search and found age was highly suggested. It is coded in Go, sure it is open source and all that I am just not a fan of the language.

My flint2, came with OpenWRT, but I installed a vanilla OpenWRT onto it it handles my many different wifi APs, all my vLANs, and a couple VPNs. I have a finally tuned pihole setup, I could not imagine changing it, I was watching this video by SomOrdinaryGamer so I went to the site he made an example of and I got no ads with just my pihole.

I meant no shade, I know it takes a lot of work to do everything I have done for security/ad blocking.

I was backing up multiple places on my LAN but than half of my place flooded, so lamenat and carpet was ripped up, one of my pi 5’s was misplaced with a NVMe drive and another was lost. Than just down the street 3 house went up in flames had the wind been blowing just a little south my condo complex would have been burnt to the ground. After the fire fighters were telling us to get back further and further I had my main pi 5 that had all the backups of everything important on another NVMe drive and a few other things ready to go if the firefighters started banging on my door telling me it was time to leave. I wish I could honestly say that was the day I decided to get a VPS and start my back up, but I was still hoping my father would let me set up a pi with a drive big enough to do back ups at his place. It sounds like he will but he is concerned about security risks about my VPN, funny thing is my back up pi would be the most secure thing hooked up to his modem/router and I wouldn’t want his stuff touching my stuff and with how my LAN and VPN are set up they would have a hard time doing it. Anywho I have a domain hosted by EasyDNS, and just went and looked at their VPS options and got some year long plan and set up cron jobs to take the stuff I want to backup and use age to encrypt it and than it is sent to my VPS each age container is than deleted after there is something of the same name but 3 days iterations older and deletes it.

Yes, from what I understand. They are using ad services from the big ad companies, and because capitalism sucks they are completely fine with selling the spots.

if you do not have a system to VPN into your home I would suggest get a firewall (preferably one you can install openWRT of opnSense on) and VPN into your LAN when away from home.

I have a finally tuned pihole that offers different blocking for different vLANs on my home network and VPNs, I would not trust a third party for ad blocking. However you do you.

I was watching SomeOrdanryGamers video on this and his pihole did not block all the ads on an ad infected site, but mine could. I have used canyoublockit many times to stress test my system, wish there was something newer though.

Wow they gave you a time to come back, they have just said I have surpassed my 5 free articles for years now, I think it is because I am using a “DNS sink hole”/adblocker I do not care enough to turn my pihole off just to try and read it.

I have gotten a static IP, and clear my cache regularly since my last attempt to read a wired article so it is not that they are using anything to see that I have tried them before.

I respect what you said about your own firewall, however I disagree with it! ISP modem/firewall’s are rarely if ever updated/upgraded. I thought I was fine without a hardware firewall until I started getting into some of my more darring adventures into home labbing. I was using DuckDNS for things, but decided I wanted to be able to do more so I needed a static IP. Luckily my ISP offers two static IPs for free so I got those.

I hope part of your hardening SSH is changing the port number! If you want to keep your LAN safer with a firewall, and something small like a pi zero (I use a pi zero 2), you can setup a honey pot vLAN. Again I realize you said not interested in a firewall, but I am saying a honepot helps.

I was never really against AI, and used the free things for most of the time. I moved to paying for AI once I started homelabbing, I have saved so much money with being able to move my things to my LAN. If I could afford a computer with a strong enough GPU it would be great.

I was able to setup a firewall running OpenWRT that I had tried searching the internet for help but it was always way over my head.