Less exposed at home, more on Hetzner

In October I retired the old domain controller in my lab and asked myself whether to rebuild it all properly: centralised users, DNS, certificates, 802.1X Wi-Fi, SMB. FreeIPA was at the top of the list.

What I did instead

Nothing. I left everything as it is.

The reasoning went like this:

• How many machines are there really? A few Linux servers, a few Macs and a single Windows client. A domain for that is a maintenance cost with no user to justify it.
• What does the Wi-Fi depend on? With 802.1X my home Wi-Fi would depend on local nodes. With WPA2/3 Personal it doesn't, and that's one less dependency that can break while I'm away.
• What happens if it goes down? If the answer is "I'll fix it next weekend", the service shouldn't be complicated.

The rule that came out of it

Every service that exists has to earn its place. My criterion is simple: if I wouldn't use it every day and couldn't bring it back up alone, I don't switch it on.

Exposure follows the same logic: at home I want fewer and fewer services reachable from outside. Whatever has to be online lives on the Hetzner servers behind Coolify, where the surface to defend is smaller and better looked after.

Why I'm writing this down

Because "do nothing" is a legitimate technical decision, and usually the most underrated one.