Replying to @CompactFlax@discuss.tchncs.de
Firstly, wildcards are convenient but they break your functionality of to which you are connecting which is half of what TLS does. That may or may not be important to you.
You are implying that https is supposed to be done by the individual server and not reverse proxy. Since otherwise you could not “authenticating the server”
Replying to @Spiffyman@slrpnk.net
Short answer, it should work as you describe, everything local, no need to expose anything.
More information is needed to help.
Its either the caddy setup, maybe proxmox internal networking? Or most likely DNS, its almost always DNS.
Replying to @CompactFlax@discuss.tchncs.de
Its good practice to handle https on a reverse proxy. Also who actually does cert pinning?
Replying to @antianarchist@sopuli.xyz
My guess, auto updates for major versions is not good practice. Installations potentially corrupt and users come screaming to the project maintainers instead of searching the blame by themselfe.
forgejo defined the lifecycle for every version so just add a calendar entry for when the supports runs out and then update the 3 characters in the docker compose file.
netbird uses wireguard as vpn protocol