SSL using lets encrypt

[alisohail]

Awesome project!

I have one suggestion:

Currently, your "+ local DNS" setup guide doesn’t support SSL certificates. I’d like to propose a third configuration:

Use Case:

• I want to access my service using my proper domain (e.g., domain.com) instead of .lan, with HTTPS enabled.
• I’d like to point my domain to a local IP address, keeping the service private and not exposed to the external world (I’ll be using Tailscale for secure remote access).

It would be great to have a configuration supporting this setup. I understand many people may not want to use a “Cloudflare Tunnel,” since that involves routing traffic through an external cloud server. A lot of users might prefer a setup that allows SSL + personal domain + local DNS access.

For external access, I can use Tailscale on my device, making it part of my network from anywhere while keeping everything private with a valid SSL certificate. In essence, this would be a “buff” version of your .local setup.

I hope this makes sense and is clear.

[Pharkie]

Thanks for the suggestion, agree there's a use case here.

The approach would be: Traefik gets a wildcard Let's Encrypt cert for your real domain via DNS-01 challenge, and Pi-hole resolves those domains to local IPs. Traffic stays on your LAN with valid HTTPS.

The tricky part is keeping a clear separation between what's local-only and what's exposed externally. Right now .lan = local, yourdomain.com = external via Tunnel. If everything uses the same domain you lose that distinction. A separate subdomain pattern (e.g. *.local.yourdomain.com) could work but adds complexity. Tailscale is a bit bigger to support than Cloudflare tunnel. Cloudflare Tunnel is end-to-end encrypted, I understand.

I don't see a way to easily add this as a supported configuration right now, but if you want to set it up yourself, look at Traefik's certificatesResolvers with dnsChallenge.

If you get it working, feel free to open a PR or fork. Or we can discuss further here if helpful.

[alisohail]

I will try to give it a shot.. i was thinking of creating a similar version of yml where user can choose either to use .lan(current yml) or proper domain(i will create new) for LOCAL access using SSL basically. I will let you know if I am able to finish it :)

[Pharkie]

Yep makes sense and *.local.yourdomain.com could work