If you can fiddle around and get the VNC functionality working, then as long as you have it behind a bastion host you basically have insta-BMC. I kneejerk-reco

If you can fiddle around and get the VNC functionality working, then as long as you have it behind a bastion host you basically have insta-BMC. I kneejerk-recommend a bastion host because a) Intel ME, and b) there was that all-0 password bypass a while back and uhhh yeah who knows what other "sneeze correctly and the leaf falls over" knock sequences there are. SSH port forwarding, VPN, RPi running the remote-access AMT web UI thingy (runs on Linux, forget what it's called) behind nginx with authentication... you get the idea.