Use encrypted LBU

Create a non-root admin user

Configure SSH to only allow pubkey logins

Pi Unbound; The gift of DoT

No backscatter email alias relay