Hence the suggestion of at least throw up a second level of HTTP basic auth from nginx in front. > HA won't be accessible to you if you are somewhere where Wir

Hence the suggestion of at least throw up a second level of HTTP basic auth from nginx in front. > HA won't be accessible to you if you are somewhere where WireGuard is not possible At that point, you also really want OTP (along with nginx HTTP basic auth), as if you're connecting from a device you don't control, it's not a bad plan to assume a keylogger may be operational. Can you help me understand a situation where you have to get into your HA instance, and none of your own personal devices are able to get online? EDIT: > Does HA have an exceptionally bad security record? Is a lack of regular security fixes needed evidence of good code, or due to lack of inspection / identification of vulnerabilities? HTTP basic auth is like a seat belt. It's a minor inconvenience that adds a layer of security. I haven't had a car crash, nor has my infra been exploited to the best of my knowledge. I still use both HTTP basic auth and seat belts every day.