I think you have to go into desktop mode to find the setting to disable shader pre-caching but it’s 100% better with it disabled!

Typically, in my experience, official Linux support isn’t required for a good experience. While the last thinkpad I used with a tablet was an x41 I guess about 15 years ago, I’ve been using thinkpads with Linux continuously since before then. It’s amazing to see manufactures officially supporting Linux now, but once the hardware works in the linux kernel, it tends to keep working on all future releases. It’s not like Windows where you need to go to the manufacture’s website and download drivers, they are open source and are kept working by volunteers for a long time.

Please do your own research, but in a quick search it seemed like the Thinkpad X12 was working well for some people with modern Linux distributions. I know some people use Linux on the Surface Pro’s and I almost bought one once, but decided to go with a wacom tabletop monitor/tablet instead.

Most VPNs don’t allow port forwarding, and if they do it’s a random port that changes frequently. So you’d need a method to tell people the new port. Also, you typically want to use SSL so you’ll have to use self signed certs. Though interestingly LetsEncrypt recently started testing certs for IP addresses:

https://letsencrypt.org/2025/07/01/issuing-our-first-ip-address-certificate

You can. I recommend making sure you have logging in place so you know what’s going on. This could include not just service logs but firewall logs as well. You might want to rate limit the connection attempts for SSH and WireGuard and consider Fail2Ban or something similar.

Yes, that’s one way to do it. Another way is to pick some amount you can afford to save and buy bitcoin every month or so. Hold it for a few years and always spend your oldest coins first. For example $20 from 2020 buys $200 worth of stuff now.

What does running pfsense in a virtual machine really give you? Consider setting up the ubuntu server as a router directly. The most important part is making sure you configure the firewall correctly (iptables or nftables). dnsmasq can handle dhcp requests and hostapd can provide wireless. Be careful that all services are listening only on appropriate network interfaces before you connect it to the internet.