Your websites are public. Your server is not.

How the Baumeister box is locked down:

- No inbound ports. Sites go out through an encrypted tunnel the box opens itself. Your home IP stays hidden.
- Two-factor sign-in: your password plus a code from an authenticator app.
- No sign-in from your home network. Other devices on your Wi-Fi can't get in.
- Signed updates. Each one is checked against Baumeister's release key, and failed updates roll back on their own.
- Debian security patches install automatically.
- Every unit makes its own keys and identity on first boot. Nothing is shared between units.
- No preinstalled access: no SSH keys, password logins off.