@vk6flab I looked at fail2ban and I don't think I need the complexity right now - instead I decided to block all ssh access from the "outside world" through ufw

when I do need to get to the system, I can reach it because there's a subnet router for it on my Tailscale network and I can ssh in that way

the nginx logs are not fun to read! so many paths being probed. so far though, no obvious risk, just hassle, since I'm hosting a single-page website there

@g7soz It's definitely worth a try, but be sure you have firewalls engaged if you route an Internet traffic to your device.

You don't have to route all of the internet - it would make sense to have a less than default route on the tunnel.