Maybe something like this. https://www.amazon.com/gp/aw/d/B0F93N2H36?psc=1

In Z-waveJS my Kwikset locks have a User Code V1 setting. Under that is all of the user code slots. The interface isn’t very pretty or intuitive, but it works well for adding, removing, enabling and disabling the codes.

What about mounting it sideways?

Sounds like it’s time to take to the seas me bucko.

A layered defense is always best. Nothing is 100%, but knowing your threat model will help define how far you have to go and how many layers you want in the way. Defending against State level actors looks different than swatting the constant low effort bot traffic. You’re right, if a bad actor gets root on your machine, all security is forfeit. The goal is to minimize that possibility by keeping applications and packages updated and only allowing necessary connections to the machine. You mentioned wireguard or tail scale. Set that up first. Then set up the host firewall to only allow outbound traffic onto the VPN to the required ports and endpoints on the LAN. If the VPS isn’t hosting any public facing services, disable all traffic except the VPN connection from and to the public Internet both on the cloud provider’s firewall and the host firewall. If it is hosting publicly accessible services then use tools like fail2ban and crowdsec to identify and block problem IPs.

Firewall rules on outbound traffic from the VPS to the LAN would do it. Allow traffic to the hosts and ports that the VPS needs to reach and block everything else.

I’ve seen it explained elsewhere and it makes sense to me. Kidnapping usually implies a person being taken with the intention of negotiating for their release, where disappeared is more often associated with avoidance of giving any substantial information to a party seeking their return.

I like my Denon Heos setup: 2 TVs, home theater, receiver in my office connected to my computer and speakers in 7 other locations. Works great with Music Assistant, and doesn’t require a cloud connection. It can pull firmware updates if you want but I’ve blocked all Internet access for those devices with no loss of functionality.

I feel there’s a Soviet Russia joke in there somewhere. Maybe something about illegal immigrants too. Can’t quite put a paw on it though.

The Disney Vault!