Thank you very much for your input. I will look into the third option.
Thought of it, but did forget it over tinkering the last few days. :)

I enjoy apalrd very much, down to earth, deep dive, no bullshit explanatory videos mostly about networking.

I don’t know about torrent downloads, but for “obviously illegal” streaming and IPTV offerings, customers also will get bonked. For example [German]: https://www.bms-rechtsanwaelte.de/wirtschaftsrecht-blog/illegales-iptv-streaming-strafbarkeit-nutzer

Hi, could you tell me why? I mean, I think I understand the basics of the risk of brute force attacks. My mitigation for the admin account is, not to allow login outside the local network. Users are allowed from anywhere, as my family uses the library. Also my service (there are others) are routed through NGINX.

Do you have tips for external users using, for example, a VPN only for specific addresses / IPs? At least that was an idea I had, but didn’t got got around to dig for solutions.

Thanks in advance.