[imiric]

There's nothing "hacky" about port knocking. It was never meant to be a complete security solution—nothing is.

But it works very well as an additional layer of security. Sec nerds often scoff at "security through obscurity", but it is a very valid strategy. Running sshd on a random high port is not inherently more secure, but it avoids the vast majority of dumb scanners that spam port 22, which is why all my systems do that. Camouflage is underrated, yet wildly effective. You can see how well it works in nature.

In any case, this is not a port knocking solution anyway, as I mentioned in another comment.

[frumplestlatz]

It’s really, really not a valid strategy for anything. Just put your services behind WireGuard.