I recently installed on a new system, and it took of lot of tries with nondescript errors to get new certs fetched

That’s a bummer. It’s great for this stuff, don’t need processing power or memory, and I don’t really care if it got nuked for some reason

I am behind GCNAT, and my ISP doesn’t do IPv6. I have a free tier VPS from Oracle that uses wireguard to tunnel packets to my home server.