Does the bt hub let you turn off DHCP? I had a similar issue with my ISP router, but it let me turn off dhcp and then I ran pihole which can run its own DHCP server.

Then, the DHCP server can tell all clients to use your preferred DNS server.

I haven’t used adguard, but it can probably do the same. If not, you can run a DHCP client on the same box probably.

Not being able to install local apps is a valid issue. But if you are really concerned about a work laptop, I wouldn’t trust something just because it’s web based. Depending on the company, they can access that data if they really wanted to just alomst as easily as a file on disk.

How much are you scraping? You may end up getting your home up blocked.

Do you need to expose the services to the entire Internet or can you use something like tailscale or zerotier (these require installing an app on each remote device, but don’t open up ports to the internet).

That’s great. Can I set the subnet router to use my local DNS? So service.mydomain.com will still route appropriately?

Same here. Well worth it for $10 a year

Thanks. Authelia looks promising, but I can find anything about tls client auth.

Edit: actually maybe caddy supports this directly? https://caddyserver.com/docs/json/apps/http/servers/tls_connection_policies/client_authentication/

How do you have this set up? Is it possible to have a single verification process in front of several exposed services? Like as part of a reverse proxy?

Or mergerfs if you are not too concerned with performance

This is my exact setup as well. Proxmox with one beefy vm dedicated just to docker and then a few other vms for non docker workloads (eg, home assistant, pihole, jelltfin). I can probably run those in docket as well, but the to worked better as vms when I set them up

This is great info thank you

Definitely more expensive, but you can get used ones from a few generations ago for cheap on eBay

I’m curious which part you think is overkill and how you would redo this? I have a proxmox cluster and run docker amongst other things, but haven’t set up any sort of high availability.

I don’t need live migrations, but something that could help with load balancing and reducing any potential downtime if a host fails would be great.

Is the internal drive replaceable? That might be a better option. Alternatively, 256gb is more than enough to install Linux (or proxmox) and serve a lot of useful apps. You only need a ton of space if you are planning on storing media.

It’s confusing. I think they are under zero trust now

I use vaultwarden (though I don’t expose it to the internet), but just because it’s FOSS doesn’t mean it’s not vulnerable to bugs or security issues.

Yeah, then I can see the appeal of keeping everything in the same configs.

Not saying I don’t believe you, but do you have any examples where changing the external port causes an issue? I change the port on almost every single docker container from what the default is.

Same here. I can’t think of an instance when this hasn’t worked. Perhaps if you have multiple applications that depend on each other? But you can just put those in the same compose file.

Completely a personal preference, but this is one reason I prefer caddy. I like to keep the configs separate and not clutter up my compose files.

It means I need to update two things when adding a new service (a compose file plus my caddy file), but I like the separation of concerns.

It also lets makes my proxy config consistent for all services, regardless of whether that run in docket or elsewhere.

Any specific reason you think they should be backwards? I have only limited exposure to the alternatives, but caddy was the easiest for me to set up when I was looking for a reverse proxy.

My main issue with caddy was having to compile in any extensions manually, but you don’t even need to do that anymore.