Even worse: the nonsense of alfalfa in California. All the residential use accounts for only 15% in this state and most of it does not come from aquifers.
Now, Alfalfa is cultivated to be sold as cattle/horse feed to foreign countries and wastes a ton of water. Same for almonds and other “boutique” crops that don’t contribute in any way to the end of hunger and fill the pockets of few with money at the expense of public water.
I have wireguard for other purposes but I also have ssh open on a different port. I don’t much understand the argument of exchanging ssh for wireguard. In the end, we’re just trading an attack vector for another.
My ssh only allows connections from my user. If I’m using password auth, I also request a 2FA.
Tail scale is also a good idea but I don’t like having my control plane under someone else’s control.