Networking and Certificates

DNS

CoreDNS is the client-facing resolver for private host and application names. It answers the authoritative private view and forwards every other query to Pi-hole. Pi-hole filters unwanted domains before forwarding permitted public queries upstream.

    sequenceDiagram
  autonumber
  participant Client as Household client
  participant Core as CoreDNS
  participant Pi as Pi-hole
  participant Upstream as Public DNS

  Client->>Core: Resolve a name
  alt Local name
    Core-->>Client: Authoritative local answer
  else Other name
    Core->>Pi: Forward query
    Pi->>Upstream: Forward permitted query
    Upstream-->>Pi: DNS answer
    Pi-->>Core: Filtered result
    Core-->>Client: DNS answer
  end
  

The one-directional chain prevents forwarding loops. It also means Pi-hole sees CoreDNS rather than every original client, trading per-device attribution for one consistent private-resolution path.

Ingress and certificates

Traefik is the shared application ingress. Public certificates use the normal ACME ecosystem, while step-ca supplies a private ACME authority for internal services. Managed systems explicitly trust the private root.

Centralizing routing and certificates keeps individual applications simpler and lets internal services use stable names and HTTPS without making them publicly reachable.

Remote access

WireGuard, managed through the wg-easy Compose project, provides private remote access. The container owns its tunnel interface, forwarding, and NAT behavior rather than leaving a second undocumented ruleset on the host.

The VPN extends trusted private access; it does not turn internal administrative interfaces into public services.