One of the main reasons I run my own instances (Mastodon and Lemmy). Keep the garbage blocked and out of sight.

Devices at home are named after Autobots and remote devices are named after Deceptions.

• crowdsec
• SSH - change port, disable root login, disable password login, setup SSH keys using SK(YubiKey in my case)
• nftables - I use https://github.com/etkaar/nftm to keep things quick and simple. I like the fact if will convert DNS entries to IPs. I then just use dynamic DNS update clients on all my endpoints
• WireGuard for access to services other than SSH(in some cases port 443 will be open if its a web server or proxy)
• rsyslog to forward auth logs to my central syslog server

"HU-MAN"

Hard pass. Which ever vendor keeps making dumb appliances gets my money. I can live with basic "smart" appliances as well. The ones that connect to WiFi simply to tell when say the wash cycle is done by sending a message to your mobile. But I don't need no flipping AI crap in my house thank you.

940/940 unlimited for ~$90/month in Western Canada

IF it's possible you might be able to take the ISP SFP and put it in a SFP to RJ45 media converter and then you can use any 1gig capable router. I did this with my Telus SFP.

OPNsense or OpenWRT. I run multiple OPNsense firewalls for family members all connected together with a WireGuard Mesh.

Cisco is command line for the most part until get into the APIC NSX stuff. There's others but I'm only exposed to those 2 where I work.

I selfhost both Lemmy and Mastodon. Lemmy is set and forget follow the communities you etc. Mastodon does need a little bit of tweeking after being setup. I have a script the removes remote content from my server after 7 days which keeps the used space down considerably. More details about the commands used can be found here -> https://docs.joinmastodon.org/admin/tootctl/#media-remove

Nah don't use those. Get your own direct from Let's Encrypt. Less hoops to go through when its time to renew. Acme with a crontab entry takes care of renewals automatically. Don't forget to add to the crontab line to restart nginx right after the renewal so that the new certs are used.

Edit: spelling

I have one last domain to move off Google Domains as the registrar. All my other domains are moved to Porkbun already and haven't had any issues. All of my domains use desec.io for DNS.