[jameshart]

The problem with this is that we really can't trust the home network any more. You need to make sure that any services you run on it are zero-trust - i.e., they don't just assume that anyone inside the domestic firewall is a friend.

Because inside the firewall are a bunch of phones and laptops and things that are accessing random webpages and running random apps; and (depending on your level of home network paranoia) maybe a bunch of internet-of-things things, or networked speakers, or televisions, etc., etc.

So even your basement server for home-only use really needs a cert, and client auth, and obviously needs to stay patched... lest it become a monster inside the firewall itself.