Securing home access to my ssh-server
I now run a Wireguard VPN-server inside an Incus container.
The container has two interfaces.
One on my LAN and one only shared with the host via Incus.
The host runs a ssh-server that only binds to the interface shared with the container.
So the only way to access my ssh-server is through the VPN.
The VPN is configured with a PSK to be more resistant against post quantum encryption.
My ssh-server only accepts key authentication and post quantum KEX.
If there is an exploit in Wireguard that somehow makes it possible to run code or become root on the serverside, then only my container is affected.
If someone plugs in a computer in my home LAN they can never access my ssh-server.