

Might need more info about your setup. The reverse proxy probably has some logs you aren’t looking at. Most bots from what I’ve seen do ip:port scans hitting every ip and every port. Nginx reverse proxy manager or something similar isn’t going to forward ip:8123 to home assistant. A straight router port forward will, but the reverse proxy manager will look at the domain GET request for https://ha.hit_the_rails.net to your LAN ip:port. It’s a little security through obscurity as they have to know your sub+domain.
For a time I had port 22 open and forwarded directly to a server. Constant bot traffic. Changed the port, put an ssh honeypot on 22, and it almost completely went away. Sure the bots could be smart enough to scan and find another open ssh port, but they rarely did. I assume because anyone savvy enough to change the ssh port is savvy enough to not allow default logins like ubnt:ubnt and root:1234 which were by far the most common logins I got in the honeypot.
Garuda - because like endeavor it’s arch for lazy people, plus I got sold on the gaming edition by how much I like the theme and the latest drivers. But that’s just what got me to try it, what sold me on it is when I had a vm of it that ran out of hdd space mid kernel update. I shut it down to expand the drive, booted it back up and no kernels present. Fiddling around in grub in a panic made me realize snappertools auto snapshots btrfs before updating. I think only once in my life (out of dozens of tries) has Microsoft’s restorepoints actually worked for me. Booting to the snapshot was effortless, clicking through to recover to that snapshot was a breeze. I rebooted again just to make sure it was working and it did. Re-updated and I was back in action.
That experience made me love garuda. I highly recommend snappertools+btrfs from now on and use it whenever I can. Yes, preventative tools and warnings would have stopped it from happening, but you can’t stop everything, and it’s a comfort to have.