Ever since ssh almost got backdoor-ed, the only thing "exposed" on my servers is Wireguard, which is UDP based and therefore harder to know if it's running. SSH also goes over wireguard.

Isn't it basically impossible to know if it's running unless you have an authorize key? I thought it didn't respond at all unless you ping a valid entry key off it.

The security through obscurity (non-standard port, no root) are both kinda silly but why not.

That said, with awesome services like TailScale, it's pretty hard to get locked out of your network. TailScale is so so good at "just working".

I think these are decent controls when layered with others. The effectiveness differs depending on your threat models, of course, but at the very least it helps reduce the noise seen from most automated scans reducing the effort involved in monitoring your assets.

So you're sort of driving parallel to the existing commentary.

* LAN components are on a UPS, helps keep continuity between power blips and breaker flips

* Dynamic DNS, cron runs a script 4x per day to ensure a DNS name points to my IP, even if issued a new one by the ISP

* Rebooting everything occasionally to ensure the network and services come back up on their own and I didn't make a mistake with some config that loads at boot, etc.