Fair enough. Every service I run depends on encrypted data, so starting the machine without decrypting isn’t worthwhile in my case. I have to decrypt to get everything back up after power loss anyway.

Main advantages I’m aware of for full disc encryption are encrypted swap and system config. Overkill for some use cases so YMMV, but wanting to point out that decrypting at boot can be done.

I may be missing something in your use case. As long as you have the port forwarded you can decrypt from anywhere. Use pub key auth and you’re good to go

You can decrypt via ssh at boot. I used dropbear to accomplish that on my machine

I recently switched from Joplin to Obsidian for different reasons. I’d prefer something FOSS, but so far I’ve been happy with the transition. Since it works with plain markdown files, it would fit your use case

Running fewer commands as root is more significant risk reduction than having an extra user. I won’t be replying further since I’m simply repeating what others have already said. If you sincerely don’t understand, I suggest doing additional research on your own.

You seem to be looking at the issue in black and white. Any reduction in root access is beneficial. Using sudo with password cache lasting an hour is still preferable to signing in as root. As many people have said, it’s about minimizing attack surface

None of us can tell you the right approach for your specific system and use-case. People are simply pointing out that what you stated you’re doing is insecure and not recommended

Are you asking why it’s more secure to surface a few commands without password rather than all of them…?

Same. Maybe I’m just old, but this isn’t even slightly funny. Wish the repetitive, low-effort memes were left back on reddit

Mind if I check it out as well? I’m considering switching to NixOS

If you like the look and feel of the SA profile but don’t love the height or ABS material, check out KAT. It’s the endgame profile for me