Thanks for the contribution!

I would highly suggest using a separate VLAN at the minimum directly off your firewall, and at the ingress of your firewall put rules in blocking any traffic from the server to the rest of your home. You can always allow ssh from your work env to the server, but block unsolicited traffic from the server to your home. I’d also suggest potentially leveraging a secondary public IP if you have service that will give you a block of IP addresses for a fee. It would be worth it to just keep your home separate from any denial of service type attacks directed at your lemmy instance.