no idea about which game server, but i would definitely put everything behind a vpn and give the connector to the 20 friends.

nowadays a vpn connector is available for every platform and the peace of mind you get is priceless.

For me it depends on the hw on site; if it is properly setup and in an adequate environment i have no issue anywhere.

(me too i did #2 at home…)

Proxmox is a virtualization solution: let it do its job and run a vm with opnsense.

It is simple both from a virtualization and a networking perspective; your hypervisor is ‘hypervisoring’ and the firewall is firewalling, easier to maintain and debug, no custom thinkering required.

If you are at home go with #1, more fun and lots of discoveries; if you have to pay the bills, go with #2, tested, solid, easier to handoff to your colleagues.

IMHO you should look/ask for such a feature in a google group because big g may have a business case for such a feature: it would pull back in those users who try to escape.

and that should not be an immich feature but a google one.

as a self-hoster I prefer to have control on my data; a solution to feed my data to google through a third party (that may do whatever it wants while performing the transfer) is the exact opposite of what i’m trying to achieve and would have little to no value for me.

If the main site gets compromised the credentials there must be considered lost and known to che attackers.

with a pull backup that’s not an issue because the main site has no access to the remote system; it is a process on the remote site that has credentials to access the main site and not the other way around.

the remote system may receive retrieve a compromised copy of the data, but the attacker cannot tamper with previous backups so recovery is still possible.

Fifa Agent Platform -> FAP

pun intended?

last thing missing in your post is a complaint for slow migration on a 1gbit link…

you can complain as much as you want because proxmox is not vmware or you can embrace proxmox and make the effort to move/update/refresh your knowlwdge on to the new environment.