Agree on a good hardwall router/firewall, I like MikroTik, but they are not easy to setup if you are not used to them. Using IPTables on the Edison as a local firewall would be a good second layer of security (headache sometimes too).
If you are going to expose SSH, you need to block brute force attacks. SSHGuard is a good solution. It can watch your logs for SSH attacks and block the IP address. Another good solution is to also run SSH on another port than the standard 22. Like have it run on port 8002. This can be done by editing the /etc/ssh/sshd_config file and set the port like: "Port 8002". But if you do not need to expose SSH, that is best.
If you are going to expose your web interface to the population of the earth and where ever else the Internet reaches, you could run HTTPS as it will not let people in the middle study your packets.
Everything you've mentioned are good steps. Depending on the value of what needs to be protected overall (in the home or otherwise - not talking about just equipment value, but also information value) some additional steps may be needed. HTTPS doesn't prevent MITM, in fact many commercial products do just that, because they locally terminate and create a new session to the requested resource. This has some useful purposes (e.g. determining if the user is getting good performance from the network or not), but we can't assume that there are no people out there that will do this for bad purposes.
Local firewalls are good, but at the end of the day home equipment has a tiny processor and could fall over if it was overwhelmed, so blocking all incoming ports on the external router or FW is a good idea if possible. We all thought SSH was fine but that heartbleed attack vulnerability was present for years : ( And it was easy, and extremely severe.
One thing that a lot of people forget to do with HTTPS is validating the certificate that is sent to you. Browsers do that automatically but often you need to configure your API calls to do so. But if your machine is compromised then that man in the middle can be sitting on your machine reading everything.
One thing that a lot of people forget to do with HTTPS is validating the certificate that is sent to you. Browsers do that automatically but often you need to configure your API calls to do so. But if your machine is compromised then that man in the middle can be sitting on your machine reading everything.
