On the SSH points you make before the break - I don't particularly disagree on any part. But you still have to maintain it, and vulnerabilities do still get fo

On the SSH points you make before the break - I don't particularly disagree on any part. But you still have to maintain it, and vulnerabilities do still get found. --- As for exposing Wireguard, that's not necessarily true - You can have your server dial-out to another host instead. Additionally, because Wireguard operates on UDP, and doesn't respond unless you pass the right credentials - it's very hard to detect from a cursory scan. You would have to already know what IP and port that Wireguard was listening on. SSH because it's TCP based can be detected by any random scanner, regardless of it's port. Unless you're using some conditional firewalling, such as like with port-knocking.