Lots of people contributed really good answers, so I don’t have anything valuable to add to their answers. But I wanted to point out for your detailed question, you include what you have done, what is your understanding and what are your shortcomings clearly. As opposed to a lot of posts with vague, detail-challenged narratives, that’s a top notch post.

And the community delivered by giving good answers, so go community!

Also, you didn’t just ghost after the initial post and interacted.with the people who graciously donated their time, so another bonus point there, as well.

Yeah, that’s the key point. They weren’t trawling all the servers, they probably had a wiretap order for one specific server. As a legal business, you can’t just say no to police because you don’t like mitm.

I have been using porkbun.com as a domain registrar.

For email hosting, self-hosting is a lot of effort. If you just want the damned thing to work. I’ve heard good things about Fastmail, and personally I’m using migadu.com. it’s $19/year for micro.

Use any imap client, or if you want to keep using what you’re using Gmail and Outlook and Apple mail apps w all support your new personal account over imap as well

What kind of limitation did you run into? Lack of packages or speed?

6GB is more than enough for many desktop environments. Plus, a server wouldn’t have any anyway. not booting the Ubuntu installer seems like a bug, or other non-resource problem. if you try with a newer installer, or some other distro, that computer can host many things.

Lots of relevant comments in this post https://aussie.zone/post/4286731

ZFS has a “copies=N” setting, but documentation and discussion I can find say there’s no guarantee that the copies will end up on different devices (vdevs in ZFS parlance)

Same here.

https://longhorn.io/ for the curious

You can use Snikket with other servers too, there is no restriction or special sauce. It’s mostly a fork of Conversations.

in addition to “dedicated Nas + compute node” and “just use a desktop” suggestions, there’s the microserver option in between. Small, but has enough power to run stuff other than storage.

Hp proliant microserver is what I use, you can try getting a previous generation from second hand market.

https://www.hpe.com/us/en/product-catalog/compute/proliant-servers/pip.proliant-microserver.1014673551.html

“underpowered” routers are usually underpowered for multiple high bandwidth wireless connections. if you disable the wireless, shoving bits over copper would -usually- be efficient enough to not be the bottleneck.

Did you consider keeping the services closed to the outside world and using tailscale to access them? Doesn’t work well if you want to give access to a bunch of people, though.

Random idea, continuously ping the router from the laptop so it doesn’t “forget” that the laptop exists on the WLAN?

(I know you mention the laptop can still reach out when you try, but maybe the trick is to keep having traffic to-from the laptop continuously)

i also think that it’s overkill, especially for a minimalistic tool like wireguard. That’s why I mentioned “if you want to be extra paranoid”. This forum is for learning, and this question is an open ended learning question, hence, an opportunity to learn about port knocking, even if the actual real life benefit of that would be minuscule.

+1 on not using containers.for Network routing stuff That way lies pain and misery.

Good point, kernel updates should be paired with reboots to get kernel patches applied quickly.

Yes wireguard would only accept connections clfrom clients with known certificates, but this is “belt and suspenders” approach. What happens if there’s a bug in wireguards packet parsing or certificate processing? Using port knocking would protect against this —very remote— possibility.

VPN software usually is built strong to begin with, and any vulnerabilities discovered will be promptly fixed as well, so updating frequently should suffice. (Why not automate it with unattended-upgrades package?

Using a random high port number will probably hide it well enough for Internet-wide port scanners as well.

if you want to be extra paranoid, you can hide the VPN service behind a port knocker as well.

I recommend https://migadu.com. not free, but the lowest price tier has lots of features, unlimited mailboxes etc.

See https://lemm.ee/post/4593760 for a related post and more discussions about pros and cons of each.

keepass2android is worth a try as well.