Getting an Apple Airport Express to join a DD-WRT wireless network
...should be easy. But it's not, unless you pick "WPA2 Personal Mixed" and "TKIP" instead of "WPA2 Personal" and "TKIP." What's the difference? Who knows! Probably the "mixed" setting is somehow insecure in random unadvertised ways. But at least my music plays through the wireless speaker connection now.
Also, while DD-WRT claims to support WDS, as does the Airport Express, I am not nearly smart enough to figure out how to set it up. Just pick "join an existing wireless network" instead of "extend my wireless network" in the Airport setup tool.
(I'm writing this mostly so that other people who Google for these terms might have some chance of coming up with a useful answer. Naturally all the random sites Google popped up for me were totally useless, and trial-and-error won the day.)
ssh+2FA to all your machines, anywhere, without opening firewall ports.