Gosh I’m sure that this will be some dangerously delicate process that will be too hard for me…

pihole -up

Oh. Cool.

Use brioche, it holds up better in the custard…

Real maple syrup. Accept no substitutes.

A dash of nutmeg.

Kde. I’d love to be able to give some erudite examples of why.

Alas, the default is clean and works for me. It stays out of the way.

The single best thing you can do security wise, is to NOT have any personal data on a web facing server.

Separate the data

Rereading it does look like you are doing the things right; so just audit what is on the public side. - your calendar and tasks- cool

Your photo and docs, do those need to be on there?

they are not accessible on the WAN

If they are on a server that is publicly accessible, please move them to a different location

Otherwise you sound like your doing well

5 days to boot. Damn. The dedication to get it to work is amazing

I hope he doesn’t have to patch it….

¯\_(ツ)_/¯ Yeah. It is kinda hard.

Backups. First and foremost.

Now once that is sorted, what if your DB gets corrupted. You test your backups

Learn how to verify and restore

It is a hassle. That’s why there is a constant back and forth between on prem and cloud in the enterprise