Podman and quadlets are the way to go for monoserver services

For the unique fingerprint, using a lot of privacy apps /extensions makes you stand out more, because you’re likely the only person to use that exact configuration. The best way to hide is by obfuscating the data and sending random garbage.

Fair, markdown, git and pandoc could work but, it might be too big of a jump for someone used to Word

Is Word mandatory or is Word compatible good enough ?

Because LibreOffice is pretty good, you could even push it further with pandoc, inputting markdown and outputting word documents.

Otherwise, as others suggested, Wine with an older Office version should do the trick

They definitely don’t want to be treated the way they treat others

Definitely not beginner friendly. Yunohost is great for beginners.

Preferably in an easy, maintainable way. Like markdown in a git repo.

“decentralized” internet, sure !

Yeah, it’s started to roll out on their new hardware:

https://www.theverge.com/news/652364/synology-nas-third-party-hard-drive-restrictions

I’d not recommend Synology anymore, as they’re starting to implement vendor lock on their drives and NAS boxes. As in, you’ll have to use their drives for the Nas to work.

It has to do that none of the American apps are being banned for the exact same reason. Especially when we know for certain that they are (at the very least) as bad as that one Chinese app. It’s a funny double standard.

If you buy three of them you can set up a Ceph cluster I suppose ahah. That would solve part of your issue of having storage and compute on the same node.

If you don’t need enterprise level hardware and support, I can suggest MinisForum. They released the MS01 fairly recently and I believe it fits your specs.

https://store.minisforum.com/products/minisforum-ms-01

That’s the problem, if anyone somehow gets your root CA key, your encryption is pretty much gone and they can sign whatever they want with your CA.
It’s a lot of work to make sure it’s safe in a home setup.

I’m talking about home hosting and private keys. Not businesses with people whose full time job is to make sure everything runs fine.
I’m a nobody and I regularly have people/bots testing my router. I’m not monitoring my whole setup yet and if someone gets in I would probably not notice until it’s too late.
So hosting my own CA is a hassle and a security risk I’m not willing to put work into.

The domain certificate is public and its key is private? That’s basically it, if anyone gets access to your key, they can sign with your name and generate certificates without your knowledge. That’s my opinion and the main reason why I wouldn’t have a self hosted CA, maybe I’m wrong or misled, but it’s a lot of work to ensure everything is safe, only for a self hosted setup.

For self hosting at least, having your own CA is a pain in the ass to make sure everything is safe and that nobody except you has access to your CA root key.
I’m not saying it’s not doable, but it’s definitely a lot of work and potentially a big security risk if you’re not 100% certain of what you’re doing.

That sounds like a bad idea, you would need your CA and your root certs to be completely air gapped for it to be even remotely safe.

Well it’s a good step in the right direction, not a massive difference but still

Say what you want about tiktok but damn if it isn’t extremely effective at sending information out of reach from governments, I don’t know what it is. You can see they fear it hard.