Networking, DNS and remote access

Every service you add brings a port, a certificate problem and a login form. Handled one at a time, that is a growing pile of things to keep patched and a growing number of ways to be wrong. Handled once, at the edge, it is a single file you can read end to end.

That is the whole shape of this category. One proxy terminating TLS for everything, one way in from outside, and a resolver that makes internal names work. Get those three right and most of the rest of self-hosting stops being a networking problem.

The default: Caddy in front, WireGuard for the way in#

Caddy terminates TLS for every service on the box. It idles around 25 MB, scores 1 on ops load, and a working site with automatic HTTPS, HTTP redirect, OCSP stapling and unattended renewal is three lines:

jellyfin.example.com {
	reverse_proxy jellyfin:8096
}

For internal names it mints its own local CA, so https://nas.internal stops throwing warnings. The cost is modules: the stock binary and official image ship no DNS provider plugins, so wildcard certificates mean building with xcaddy and rebuilding on every upgrade.

For remote access, wg-easy gives you a WireGuard server with a QR code per device. Treat v15 as a different product from v14: there is no migration path at all, the latest tag still points at v14, and the licence changed to AGPL-3.0-only.

Two situations where those defaults are wrong.

Your containers change most weeks and you redeploy stacks constantly. Then Traefik, which builds its routing table from Docker labels so a new service routes itself. Budget 60 MB idle and ops 3, and know that pasted v2 snippets fail silently on v3: matcher values need backticks, Headers became Header, IPWhiteList became IPAllowList, and a stale label produces a 404 from whichever router did match rather than an error.

Both ends are behind CGNAT. A WireGuard server needs a reachable endpoint. Headscale instead runs the coordination server for official Tailscale clients, so you get NAT traversal and MagicDNS without your device inventory living at a vendor. It is pre-1.0, you must upgrade one minor at a time, and v0.29.3 documents a Tailscale client floor of v1.80.0.

DNS blocking is not security#

Pi-hole and AdGuard Home are worth running. They cut ads, kill a lot of telemetry, and make an entire household's browsing quieter for 60 to 100 MB. What they do not do is protect anything. They see only queries that arrive on port 53, and browser DoH, phone private-DNS profiles and TVs with hardcoded resolvers bypass them entirely. If you want them enforced, block outbound 53 and 853 to everything except your resolver at the firewall. That is a firewall control, not a Pi-hole feature.

Pick AdGuard Home when you want DoH, DoT and DoQ built in without a cloudflared sidecar. Pick Pi-hole for group-based per-device rules and the larger list ecosystem. Pick Technitium DNS Server only when you actually own a domain and need authoritative zones, DNSSEC signing or split horizon, and know that creating a primary zone for example.com makes that server authoritative for every name under it, so any public record you did not copy in returns NXDOMAIN, mail included.

The mistakes people actually make#

• Exposing an app's own login. Nginx Proxy Manager's port 81 ships admin@example.com / changeme with no rate limiting. Technitium's console is admin / admin on 5380. These are documented publicly and scanned for within hours.
• Bind-mounting acme.json that does not exist yet. Docker creates a directory with that name, Traefik cannot persist certificates, and it re-requests them every restart until Let's Encrypt rate limits you. Run touch acme.json && chmod 600 acme.json first.
• Forgetting websockets. Nginx Proxy Manager has websocket support off per host by default. The app loads, live updates never arrive, and the nginx error log stays empty.
• Editing config that is read once. Technitium's DNS_SERVER_* variables apply only when no config file exists. AdGuard Home overwrites its own YAML while running. Pi-hole v6 renamed every Docker variable and ignores the old ones silently.
• Leaving the Docker socket writable. Traefik with socket access is a compromise path to host root. Mount it :ro at minimum, and prefer a socket proxy that whitelists only the container and event endpoints.

What to read next#

Reverse proxy and TLS is the build instructions for the default above, and Reverse proxy generator writes the config for you. Remote access without port forwarding covers the VPN choice properly, DNS for self-hosters covers subdomains and split horizon, and A security baseline for a home server is where the firewall rules that make DNS filtering stick actually live. For head-to-head calls: Caddy vs Traefik, Caddy vs NPM, Pi-hole vs AdGuard Home and Headscale vs wg-easy. Check Port conflict checker before you add anything that wants 53, 80 or 443.