Why my home VPN is off by default
Feb 2026 / 2 min
- Homelab
- Security
- Infrastructure
Remote access to my home network runs over a WireGuard tunnel, and my one firm decision about it was that it stays closed. A tunnel left running is an open door whether or not anyone is walking through it, so I don't leave it running. I toggle it from a small Telegram bot I wrote, which means the tunnel only exists as an attack surface for the few minutes I actually need it. It's a modest piece of engineering, but it changed how I think about exposure: the safest service is the one that isn't listening.
Storage is a TrueNAS box, four 4TB drives with one disk of parity, so a dead drive means a degraded pool and a replacement rather than a restore from backup. A separate mini PC runs the things that shouldn't share fate with the storage: the printers, Home Assistant, and the bot that controls the VPN. I'm now building a second TrueNAS box to physically replicate the main pool. For now non-critical data just goes to encrypted cloud backup, because I don't yet keep anything sensitive enough to justify the cost of full local replication. That part matters to me. I'd rather size the redundancy to the actual data than build a mirror because a mirror looks serious.