The suggestion I have heard is to have the remote machine connect to the machine on a schedule and pull the backups onto itself. Then your local machine doesn’t have direct access to the backups, making it harder to compromise the backups if hacked. But this also assumes the backup machine is locked down and isolated so it is lower risk than the local machine.
I have been happy with https://batterysharks.com/ . Just keep in mind batteries are heavy so shipping costs are high.
I read that as “Padan Fain” at first glance and was confused by The Far Side and Wheel of Time crossover.
I just started playing with Dockhand and it looks like it has a built in update schedule mechanism. It’s fills a comparable role as Portainer, so maybe check that out.
I would make an FAQ. I think for getting tone it is important to know what things are hard facts, what things are more subjective preferences, and what’s things are “we had to make a choice between options with no clear ‘best’ option”.
Any reason you need to encrypt the host OS information? I would assume anything interesting would be in the VM and you could probably have the VM encrypt it’s own storage.
When mine did that it required a battery replacement. Got replacement from this site: https://batterysharks.com/. Also, maybe you should stop doing things that aren’t absolutely necessary until you’ve taken a nap.
If your Internet connection is 1g or slower just about any desktop built in the last 10 years should be fast enough. The critical thing is having a good network card. Intel is generally very reliable for network cards and you can get used ones on eBay for not to much.