I am not sure if there is a good way to do it without scripting, and a router that would allow for taking variable input from an external script. But theoretically if the router would support it, you could script a port change at times there are no one on the server.

Essentially the server port is in a text file, you could use some command line utilities, and write a script leveraging something like sed to change the port in place.

But I am overcomplicating it. lol

I understand that. I didn’t call FUTO FOSS…

I wasn’t meaning to conflate the two, as I see your point. I didn’t claim it was FOSS, just that the source was available.

I know for me, I don’t mind using software that is licensed so that it doesn’t directly fall under FOSS. I just like the availability to view the source vs closed source software being a total black box.

I have no plans to monetize their work, nor fork it, only use it.

I haven’t gotten around to setting it up yet, but for a google photos type self hosted setup there is Immich which looks promising!

I know I don’t want to open up any more ports than I have to, but you’re right, that does sound like another alternative to setting up VPN.

Since I access more than just my pihole when connected to my home network. And because I want access to my home services, and don’t want to open up access to the public, opening one port and connecting to VPN is the way to do it. I have one port opened up for my VPN, and in order to connect you have to have my IP or my domain pointed at the IP, and you have to have a Wireguard profile setup, and know what port is open. So that does help a tad bit with my security concerns.

Edit: how would I go about that if I felt so inclined? Any tips?

Gitlab

Which they state is a fork of LatinIME

I want to self host more, but power draw is a concern.

So I have gone the route of running to Pi 4 8gb models as my hosts of choice.

So far I am hosting:

Non-Docker:

• PiHole
• Unbound
• Wireguard (and Wireguard-UI)

Docker:

• ForgeJo
• Dozzle
• Homarr
• LinkWarden
• Traefik
• Watchtower

There are a few other services I want to get up, but I haven’t gotten around to it:

• Jellyfin
• Immich
• Nextcloud

As to why:

• ForgeJo to host my own git repositories (Docker Compose files, Chezmoi dot files, Miscellaneous configs)
• PiHole for ad blocking
• Unbound, well, having my own DNS
• Wireguard so I can connect to my home network
• Dozzle for easy log checking for my docker containers
• Linkwaren so I can backup bookmarks in a privacy friendly way
• Homarr for easy access to other web services I host
• Traefik so I can resolve IP:port to a hostname with SSL certificates even though everything I host is internal only
• Watchtower to update my Docker containers

You can still use PiHole as your DNS when not home if you setup a VPN. For me that was the route I went.

I will likely have to do some tinkering, and more reading up on this from the documentation I am thinking. I am getting HTTP 200 statuses basically across the board. When going to the FQDN it doesn’t redirect to the PiHole admin page like I was expecting. Again, likely some configuration that I have wrong.

Shows in traefik, no errors there.

I hate to report back, but something isn’t quite working for pihole behind Traefik.

running “docker logs traefik” returns no error, and yet no certificate was presented to my pihole.

Not sure what else I might be missing or that I might have wrong.

I will give this a shot! Thank you for the help. I will report back, in hopes that between your knowledge and my fumbles that someone else too can learn from this!

so in my traefik.yml file I have cloudflare set as my certresolver as follows:

certificatesResolvers:
  cloudflare:
    acme:
      email: email@example.com
      storage: acme.json
      caServer: https://acme-v02.api.letsencrypt.org/directory # prod (default)
      # caServer: https://acme-staging-v02.api.letsencrypt.org/directory # staging
      dnsChallenge:
        provider: cloudflare
        #disablePropagationCheck: true # uncomment this if you have issues pulling certificates through cloudflare, By setting this flag to true disables the need to wait for the propagation of the TXT record to all aut>
        #delayBeforeCheck: 60s # uncomment along with disablePropagationCheck if needed to ensure the TXT record is ready before verification is attempted 
        resolvers:
          - "1.1.1.1:53"
          - "1.0.0.1:53"

And I had to get the secret mounted via the docker-compose file.

So where you have:

tls:

        certResolver: examplecom-dns

Do I have to redefine all of the same information I did in my Traefik yml but in this separate config.yml?

(I did set it up in my traefik.yml and docker-compose.yml to mount and use this config, which I had commented out for later use.

Thank you so much for the help!

Edit:

Essentially I am trying to get my PiHole which is hosted on another pi setup with an SSL cert for local use only:

So in looking at your config I tried using:

http:
  routers:
    pihole-rtr:
      entryPoints:
      - https
      service: pihole-rtr
      rule: "Host(`ph.local.domain.com`)"
      tls:
        certResolver: cloudflare

  services:
    pihole-svc:
      loadBalancer:
        servers:
          - url: "http://<ip>/admin"

However when doing this error logs returned:

2024-07-08T15:04:27-04:00 ERR error="the service \"pihole-rtr@file\" does not exist" entryPointName=https routerName=pihole-rtr@file
2024-07-08T15:04:28-04:00 ERR error="the service \"pihole-rtr@file\" does not exist" entryPointName=https routerName=pihole-rtr@file

I am doing something very wrong… And feel a little lost.

Would the file provider configs live on the Traefik server, or would they need to be on the external service. Reading through this, and looking at the example configuration files doesn’t really seem to point that out. Sorry for the noob questions.

Trying to understand this, but the way the documentation is written is different than I am used to.

Thank you!

I bought a 2024 vehicle with OnStar, I wonder if the process is comparable… Could you share your source please?

Good to know. Thank you!

I ran into an issue where I changed nothing, and all of a sudden none of my SSL certs worked on top of most of the hosts were not working through the reverse proxy. I had not even changed ip addresses on any of them. I am not sure what was going on.

It was more of a “I didn’t want to troubleshoot” and gave up, so I shut down my servers.

Today I learned about Linkwarden, and I am so excited to check it out. Thank you!

NPM I did use, however it was ultimately the catalyst as to why I quit homelabbing. But when it did work, it was simple even for SSL cert renewal.

I will have to check out gitolite. Thank you!

Traefik or Caddy are the 2 I am bouncing back and forth between currently. I may spin up a nextcloud instance.