Okay, thanks for elaborating. My vault is also on my home network only with an insanely long password.
But since someone tried breaking into my network recently I felt like I might need to harden up a bit.
In a professional environment I would obviously be much more paranoid but my home server is for tinkering so I dont expect perfection.
I would like a better setup for the vault and otp though. Like, if I store the admin otp key in the vault, I would be unable to retrieve it and get admin access which is bad. Theoretically, I could just store it in an encrypted file with the password stored in the vault.
But I‘m not sure if that is best practice. With my backups I try my best for 3-2-1 backups procedure so I‘d love to make it easy and reproducible for myself.