Damn. Another rabbit hole to dive into. Thanks… I guess. :)

The lua queries look promising.

Have fun. :)

Side note: Never look at LXC/incus or home assistant or esp32 to attach. Rabbit holes everywhere.

In your case: no need for a fw if you can trust your local network.

Generally: services can have bugs - reverse proxy them. Not everybody needs to access the service - limit access with a firewall. Limit brute-force/ word-list attempts - MFA / fail2ban.

I assume you want to access a self hosted service on your local server from the Internet.

To make the service accessible from the Internet multiple things are required:

• the router can be accessed from the outside. Find your public IP in the router or use a find-my-ip website. Better: do both. This is the address you can use to access your router (or whatever service you choose to expose through it). Side note: If the Ip-adresses of your router and the one of the find- my- ip- site are different it could mean that your provider uses CG-NAT (because ipv4- addresses are scarce, the provider doesn’t give you a real publicly accessible address). This means you can’t access your router from the Internet. Try IPv6 or contact your provider to get a publicly accessible ipv4- address.
• because the above mentioned IP- address of your router might change, dyndns is used. Configure it in your router and test it. Test if the DNS- name you have set up resolves to your ip- address (nslookup or ping it).
• to make your service available to the Internet you need to configure port forwarding in your router (or add your server as exposed host - means all ports are forwarded to the Internet). This means the router passes request to itself on to your internal server. Careful: everybody can access whatever services you expose. Advice: it’s a good idea to use a VPN. Setup a VPN-server in your Lan and only port-forward its port in the router. Connect to the VPN from the outside - Afterwards use the internal services through the vpn- connection.
• scripts and the internal ip: the dyndns name needs to be used instead of the IP. Find a way to make the scripts use that name to resolve it to your external IP.