Use doas with limited rights so it can diagnose but not do damage without consent. A yubikey is real helpful so it can run commands using a swperate sshkey with more permission, but only if I physical touch the yubikey to approve it.