Yeah, going from AWS to Hetzner will require doubling your SRE/platform/infra/whatever-you-call-them staff, clearly.

Thanks! Will dig into it

For someone whose main focus isn’t networking, do you have a guide or similar I can read to catch up? I’m running my setup on a properly killswitched VPN, but having firewall rules that are only valid for the VPN seems like an interesting extra step.

One can only hope