got a mini at home serving as an exit node
set this up one time the it dep was being obtuse about fw rules, and locked us out of ssh, so we couldn't push to gh - amateur hour; add more shadow it