host grub add intel_iommu=on iommu=pt
vm use q35, pass raw device, pcie enabled, all functions
ac 40mhz maximum on 3165 fw is iwlwifi-firmware-iwl7265d
hostapd seems enough
use openvpn-openssl
guide use
https://openwrt.org/docs/guide-user/services/vpn/openvpn/server
diffs:
389ds has ACI, no footguns with openldap ACLs.
Cockpit plugin available
=> 2 packages for debian to get a working boilerplate