Tech, life and everything else
Even though starting my job has put me in a situation where I can sometimes afford stuff just like that, and maybe buy the occasional thing without thinking much when I should have before, I still make sure to keep the number of things I own low.
My public VPS is now only accessible via SSH from my tailnet. One more possible attack vector less.
In Alpine Linux I switched to the linux-lts kernel, installed Tailscale from the edge-community repository via repository pinning, removed the rule to allow SSH from the Hetzner cloud firewall and finally set the Tailscale ACLs to not allow access to my other Tailscale devices from the VPS.