What are the most paranoid network/OS security measures you've implemented in your homelab?

MigratingtoLemmy@lemmy.world to Selfhosted@lemmy.world – 180 points –

As the title says, I want to know the most paranoid security measures you've implemented in your homelab. I can think of SDN solutions with firewalls covering every interface, ACLs, locked-down/hardened OSes etc but not much beyond that. I'm wondering how deep this paranoia can go (and maybe even go down my own route too!).

Thanks!

131

You are viewing a single comment
View all commentsShow the parent comment

You might be interested in setting up network bound encryption via Clevis and Tang. I use a hidden pi zero in my house acting as a Tang server. It's great being able to reboot any of my encrypted servers without having to manually unlock disks.

Do you recommend any resources about this? I'd be interested in learning how to implement this.

I'm using the recently merged Clevis module for NixOS. There was a recent talk at FOSDEM about it.

I know about it, but it kinda defeats the purpose (the purpose being police raid protection)