Let's untangle those problems. I have a similar setup so I just want to share some ideas to show that you don’t need to copy keys.

If I'm traveling or I wipe my device or get a new one, I would have to add the new key to many servers as authorized keys

If you oftentimes access ssh from untrusted systems you’re kind of in a bad spot to begin with. The best thing you can have is a yubikey on a keychain. Everything else means you leak secret material (a password or a key) to a machine you don’t inherently trust.

Also, I want a key backed up in case of disaster since all of my devices are in my home most of the time

Again, something that you can easily solve with a hardware key [in a safe]. But realistically, in case of a disaster a local shell password login should be good enough?

I'd recommend you to think about what attacks are you trying to prevent by using a shared private key. I’m not saying it's a bad concept, inherently having it in your password manager (like 1Password that even has ssh-agent support) is pretty common. The problem with just the keys is that it's non-trivial to expire them if needed. You might be indeed better off with some web based authentication that you can access from any place which would ask you secret questions/send you a text message or do whatever 2FA you deem sufficient and mint you a short-lived certificate for ssh.

Not an answer, but I’m curious: what's wrong with just having several ssh keys, one per device?

You can absolutely run your own CA and even get your friends to trust it.

My fear is, that if i don't document well or not use ansible, I will be hating my life once my server dies and I have to restore my data and also set um my services again in a few years.

I’ve been there plenty of times, you’re not alone. There are two solutions to that problem, really, and it boils down to the classic pet vs cattle.

1. Everything is a pet

Pets mean you care about every server. If it breaks, it's cheaper for you to fix it than redeploy. The overwhelming majority of your setup will be pets. Why? It's simpler. Things don’t break that often, and when they do, it's okay to be low-effort in fixing them.

Write docs for yourself, even if it's just notes on the sequences of commands to run to redeploy things. You will thank yourself when the server finally dies in two years and you have notes on how to bring everything back.

2. Everything is a cattle

Cattle means there's no difference between server A and B. Everything is replaceable. Ultimately, whatever you run can run to the same extent in AWS, your basement NAS, or on your desk PC.

Cattle is also a lot of work. You will learn an excruciating amount of things about storage, networking, visualisation, workload scheduling, and such. And it's easy to be demotivated because of how much there is to learn.

So take it easy. Concur that your hobby world is full of pets, but learn how to do the cattle approach at your leisure. You’ll realise that in every practical cattle setup, there are still pets, and that automating yourself from complexity only means you add layers of it somewhere else.

Isn’t kagi's point that they store very little about you to the point there no search history and you have to pay for the service provided?

This is the best answer. Your router protects you from the outside, but a local firewall can protect you from someone prodding your lan from a hacked camera or some other IoT device. By having a firewall locally you just minimize the attack surface further.

This looks nice, but there's plenty free alternatives in this space which warrants a section in the readme with the comparison to other products.

You mention ram usage, but it’s oftentimes a product of event size. Based on your numbers, your average event size is about 800 bytes. Let’s call it 1kb. That’s one million events per day. It’s surely sounds more promising than Elastic, but not reaching Loki numbers, or, if you focus on efficiency, is way behind Victoriametrics Logs (based on peeking at their benches).

I think the important bits you need to add is how you store the logs (i.e. which indices you build) and what are your trade-offs. Grep is an efficient logs processor which barely uses any ram but incurs dramatic I/O costs, after all.

Enterprises will be looking at different numbers and they have lots of SaaS products to choose from. Homelab users are absolutely your target audience and you can have it by making a better UI than the alternative (victoriametrics logs aren’t that comfortable to work with) or making resource usage lower (people run k8s clusters on RPis, they sure wonder about every megabyte of ram lost) or making the deployment easier (fire and forget, and when you come to it, it works).

It sounds like lots of things and I don’t want to be discouraging. What you started there is really nice-looking. Good job!

You can delegate to isolated nameservers with DNS-01, there's no need to have control over the primary zone: https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation

If you drop the projector, then airpods already do it better when paired with the watch. There's no point in such a device at all, then.

By all means, use the publicly available code within the limits its license permits. Always strive to give credit back (I oftentimes add notes to where I took config bits even in my private my-eyes-only repos to have some breadcrumbs).

Remember that licensing and copyrights are kind of separate things. People own copyright to their work (unless they explicitly give it up), and licenses are the terms on which you can use their copyrighted work.

Know the basics of the OSS licenses and know which ones you can copy things from verbatim (e.g. don’t touch AGPL code unless you also use AGPL). Generally, I just keep the original license and add a note to my license file saying that e.g. this code is licensed under Apache 2.0, but some parts are MIT.

It gets somewhat murkier when you use someone's code and base yours on that. IANAL, and that's very much the legal territory. If at all possible, just reuse the original copyright and license and then derive your work (given the license allows that).

Being on the receiving side of this a few times (people using my code verbatim in their projects I stumbled upon) it leaves a bit of a sour taste in the mouth when you see your copyright header replaced with someone else's completely. Don’t do that. All the three times it happened to me, the other party was quick to remedy the situation, though (2 added the original copyright note back, 1 removed all my code). So just don’t do that. Make a habit to read that dumb tall copyright notice at the top of the file every time and you’ll quickly learn what to expect.

However, XAMPP didn’t just die because it opened itself up to Microsoft and got extinguished

So, we went from the somewhat imaginary “google killed xmpp” to fully fictional “Microsoft killed xampp” now? it's almost like the fedipact people literally have no clue what they are talking about.

iOS 17 installs on a 5 years old iPhone though. I don’t think that's an unreasonable window of deceives supported.