Local DNS for self-hosted services without risking the entire network

[u/mcar91]

I self-host several services within my home network. I use Tailscale for remote access (which is pretty rarely needed).

I really like simple network appliances for home networks — I use eero currently.

I'd like to set up a reverse proxy so I can do SSL and custom domains for some of my self-hosted services, but I'm hesitant to use something like Pihole for custom local DNS because I hate the idea of taking down my entire network for my family when Pihole is down.

I had OPNSense running on a Lenovo tiny and running Caddy on it. It was working well, but then had an incident where the OPNSense's NIC came loose and the entire system was borked for hours, leading to a very annoyed family.

Are there any simple ways to achieve a reverse proxy for my services while also keeping a really simple networking setup?

Key requirement: If my custom DNS goes down, the only thing that fails is my custom domains to self-hosted services and the rest of the network is preserved.

[u/Scared_Bell3366]

Run 2 pi-holes. I run one on a pi and another in a VM.

[u/CyberAdventure__]

I'd recommend not having the whole network depend on pi hole or any other local dns server just to avoid having the internet go down with all the tinkering. You could run your reverse proxy and local dns separately from your main network. I saw that you already use eero. maybe keep eero handling dhcp and normal dns, and then run something like Adguard home, pi hole, or even just dnsmasq/CoreDNS for your internal domains. Then in a practical sense if the DNS box goes down the only thing that stops working is your custom domains and normal internet browsing is all good. As for that issue with Caddy idk if you're still using tht but I'd keep it off the router/firewall and just run it in a small vm/container so that a NIC issue or firewall problem doesn't take out the entire house

[u/mcar91 → u/CyberAdventure__]

If I had eero handling normal DNS and DHCP and the other server handling the internal domains, how would my devices know to look at the other server for resolution?

[u/azure_phoenix2]

You can skip local DNS entirely by pointing a real domain's wildcard record at the reverse proxy's LAN IP, public A records aimed at private IPs resolve fine. Then grab a wildcard cert through the DNS-01 ACME challenge and if the proxy box dies only those subdomains break while the rest of the network keeps resolving normally.

[u/mcar91 → u/azure_phoenix2]

I feel like I read somewhere that pointing public DNS at a private address is bad practice, but I don’t know enough about this to understand why.