mTLS?

This looks really cool

Gitlab isn’t owned or controlled by Microsoft

The IPv6 privacy extensions are something else entirely and are not used for anything server side

You should research IPv6 port scanning techniques. It is harder than IPv4 but still doable depending on the context. If your goal is simply to reduce network traffic due to bots that’s one thing. However, it should not be considered a security mechanism.

I would use keys instead of certs

That’s only if you use the brute force method

IPs are not secret and can be leaked in various ways. Don’t count on IPv6 as a security mechanism as that’s not what it was designed to do

You technically can scan IPv6

It is just less common

I personally wouldn’t waste your time with bans

Enable public key authentication and disable passwords

Take a look at TightVNC

I honestly wouldn’t use Rustdesk do to the Chinese affiliation and the questionable ownership. Unfortunately haven’t found an alternative outside of RDP over Netbird.

I find gnome way easier to use than KDE

KDE does have its strengths as I use it on my desktop but the settings are incredibly confusing and the default theme is ugly

This could honesty be a enterprise product

You can set a time in the config file

Admittedly your cron job does the same thing but I like to have everything in one place

It seems worse in many regards

I’d rather do btrfs honesty

Honesty I wouldn’t recommend much outside of ZFS for data storage

ZFS is hard to beat

There are plenty of way to get a local unprivileged shell

For instance, if you are running a old version of cups someone could chain together several vulnerabilities to gain root on your system

https://www.bleepingcomputer.com/news/security/cups-flaws-enable-linux-remote-code-execution-but-theres-a-catch/

Having a MAC like SELinux helps to mitigate this but you still should patch as soon as possible

11W is actually a lot lower than what I was expecting. It isn’t crazy efficient but it isn’t bad.

Are you sure it supports DDR4? The Intel spec page says it has a clock of around 2.5GHz with DDR3 memory

Except the hardware itself is really old which means that the performance will be much lower and thus the CPU usage will be higher. The older systems also have much slower memory and bus speeds.

You would be much better buying a more modern consumer CPU since the performance boost will mean that the CPU utilization will be lower. Most workloads including Jellyfin do not benefit from tons of slow CPU cores. Things will work better the higher CPU and ram frequently you have.

Server CPUs are a poor choice outside of very specific applications

All major distros have been patched as of writing this (you are welcome to correct me if I’m wrong)

I would pickup a old workstation of of a site like eBay. Last time I was shopping around they were pretty cheap but that was pretty insanity pricing