Public traffic flows Bunny → Shield → this VPS over WireGuard. Random SSH port, key-only auth, password lock — no public root, no exposed LAN IP.