You can just issue new certificates one per year, and otherwise keep your personal root CA encrypted. If someone is into your system to the point they can get the key as you use it, there are bigger things to worry about than them impersonating your own services to you.

Inflation is wild. Just a few decades ago, you could get this kind of thing for just an arm and a leg.

Last time I tried freecad, the geometry solver was incorrect, so it would sometimes create two (or more) shapes from a fully constrained part. Since learning about openSCAD, I’ve seen no reason to give it another try.

An r320 is new enough that iDrac Express (two IPs on one interface) is available in the BIOS. The server needs a license for some features (like remotely attaching an ISO, and remote KVM), but not for the basics like controlling the power.

The roll to hit is a single die, so if the attacker could hit or miss on a regular (1-19) roll, the best outcome is to block the lowest number, AC+6. The extra number gives no benefit against an attacker that couldn’t roll that number on a (modified) ordinary roll, and gives a 5% miss chance against an attacker that could.

If the attacker has such a high chance to hit that they can roll AC+15 on a regular die, but cannot roll AC+6, you’re in trouble - they’ll basically never miss.