Yes, I do lock it down. It's still worth securing it because "internal servers" can still get exposed and touched, even though there are less paths to them, and it's not as punishing to slip up vs a public server. For example, One of the wireguard client devices downloads a virus, and now you have a cyberattacker with access.

Another problem is supply chain issues. If the distributor of a docker container is hacked, it's not that bad... as long as your kernel is up to date and is protected against some of the recent vulns, that would enable someone to break out of a docker container

Blajah.zone's lemmy instance was hacked partially becuase internal servers weren't being held to the same security standards as the public ones:

https://pen.blahaj.zone/supakaity/weve-been-hacked

I had not patched these internal servers that nobody should have access to against this. Rebooting DB servers causes downtime, and in my hubris – I thought nobody should (nay COULD) be on my servers except me, right?

I have a comment on that post with some potential solutions, that would have cut off attack paths.

Though, I guess, it still does depend. Like if it's just gonna you wireguarding in and no one else, then the data on your devices is probably worth more than the data on the server, so no, it wouldn't be worth spending too much effort to secure less valuable data.

But if you are handing out internal access to people, including to some relative who keeps falling for scammers, then yeah, I'd take some time to harden the systems.