How it's kept safe

People are sometimes surprised that a home setup can be run responsibly, so
here's the philosophy in non-technical terms:
The front door is tiny. The vast majority of the lab is reachable only
from inside my own network. The few things friends can reach from outside go
through a single, locked-down gateway that does nothing else — not through my
home router, which forwards nothing.
Encrypted everywhere it matters. Connections from outside are encrypted,
and remote access between my own machines rides a private, encrypted mesh
network rather than the open internet.
Least exposure. Optional features that aren't in use simply aren't turned
on. Fewer moving parts, fewer things to secure.
Backups and recovery. The important stuff is backed up on a schedule, and
there are written recovery steps for when something breaks (because it
eventually does).
This page is deliberately vague on specifics — that vagueness is part of the
security. The point is just that "self-hosted" and "careful" aren't opposites.