replying to @dtinth
Almost everything. Looking at what runs here:
Must stay root (the core, not components):
- sshd: it logs you in as dev
- the gateway (caddy + oauth2-proxy as
gateway): an edge hole must not land in the account with sudo, and dev's code must not read its secrets
- the…