And if you're security conscious like me and want to do things the "right way" just because you can (or should be able to), you now have to think about firewall

And if you're security conscious like me and want to do things the "right way" just because you can (or should be able to), you now have to think about firewall rules, certificate authorities, DNS names, notifications, backup strategies, automating it in Ansible, managing configs with git, using that newfangled IPv6, ... the complexity piles up quickly. Coincidentally, I just decided to tackle this issue again on my Sunday afternoon: https://github.com/geerlingguy/ansible-role-firewall/pull/114 https://github.com/geerlingguy/ansible-role-firewall/pull/11... Sometimes it's not fun anymore.