The benfit of tang is that you don’t store the secret on a shared server.
The server has a single keypair that it reuses for every client, and each client has thier own keypair.
The encryption key can only be recovered when the client and server perform thier handshake. And only the client gets the key, the server cannot see it.
A system like proxmox backup server can do this scurely. There you can create a user that can only add new backups and read the existing ones, but cannot delete any or read anything else on the remote host.
Otherwise if you only care to protect the remote machine, then something like an ssh chroot jail would also work.
i store my ssh key on my yubikey using the gpg interface. On linux it’s natively supported, on windows you need cleopatra and on android you can you OpenKeychain together with TermBot.
This won’t sync the hosts you have, but at least you always will have your private key with you.
Yubikey. I dont want to trust my phone, so I use some separate hardware instead
You usually scrub you pool about once a month, but there are no hard rules on that. The main problem with scrubbing is, that it puts a heavy load on the pool, slowing it down.
Accessing the data does not need a scrub, it is only a routine maintenance task. A scrub is not like a disk cleanup. With a disk cleanup you remove unneeded files and caches, maybe de-fragment as well. A scrub on the other hand validates that the data you stored on the pool is still the same as before. This is primarily to protect from things like bit rot.
There are many ways a drive can degrade. Sectors can become unreadable, random bits can flip, a write can be interrupted by a power outage, etc. Normal file systems like NTFS or ext4 can only handle this in limited ways. Mostly by deleting the corrupted data.
ZFS on the other hand is built using redundant storage. Storing the data spread over multiple drives in a special way allowing it to recover most corruption and even survive the complete failure of a disk. This comes at the cost of losing some capacity however.
A ZFS Scrub validates all the data in a pool and corrects any errors.
I personally run authelia. I prefer the config file over a gui where i have to click everything together. For the actual user storage i got lldap.
But my requirements a possibly different to yours, my main focus was no docker and no javascript backend.
Keycloak is definetly overkill for a homelab. Both in effort to get it to run, and maintaining it.