Also, after unlocking the wallet the bash history should be cleared so that the pwd can't be found if the box is compromised. The wallet should also be locked too shouldn't it at some point? cat /dev/null

I would suggest adjusting the firewall rule to only allow ssh from your specific IP. For example: sudo ufw allow from 15.15.15.15/32 to any port 22

does the wallet holding the 30M need to be on the same machine? Can it be on some other machine instead and does the wallet need to be online at all or can it be offline?

on Mac, the file is at ~/Library/Application\ Support/Linda/Linda.conf