With unattended-upgrades enabled and nothing open to the internet (I run Tailscale to be able to access it when I’m out of the house) I don’t worry too much about mine.

If you use something like Fedora CoreOS, the system keeps itself and all container images updated. And because system upgrades are also just a new immutable image, very little can go wrong.

I have a Nextcloud server running on it and the maintenance is negligible.

During the recent PHP-vulnerability I simply turned it off. The next day I booted it, and it automatically installed the new Nextcloud image with the vulnerability fixed.

Makes me wonder if I could have it check for CVEs and automatically shut down vulnerable containers until updated images are out.

I was just thinking last night about setting up an agent that would daily check in and do a full maintenance scan on a server or a home lab box. Check for operating system upgrades. Schedule them if needed to move from LTS to LTS. Check for CVEs against daemons you know you're running. Stuff like that. I've used agents and harnesses to set up machines before and do system administration tasks, but it feels like you could sort of set it up in a loop and just let it go forever.

I was treasurer of the kindergarten parents' association when my daughter was in that age. It’s a small org with 10-12 employees, 30-40 customers (children) twice as many stakeholders (parents, relatives) constrained budgets and strict regulations, eg also a privacy officer. We had a static website, everything with PII, so, basically everything, was on a laptop with encrypted backups. Everything was managed with an Excel Sheet and an accounting software. Payroll was handled by a tax advisor. We cloud have used cloud services but too expensive, too many compliance headaches, and too constrained. I think an agent with local inference on a Mac would be a good investment, today.

My first child's kindergarten used Facebook to share photos. You could opt-out and then - if they remembered - they'd leave your child out of the photos. Everything is an upgrade over that I suppose.