dnscrypt-proxy VS cloudflared

If you're changing your DNS, you should be setting up system-wide DNS over HTTPS anyway, and most programs that implement DNS over HTTPS (like dnscrypt-proxy) also choose the lowest latency server from a list of servers on their own

You don't even need a Weepy En, just get dnscrypt-proxy. It runs a local DNS server that will connect to multiple others of your choice using DNSSEC or DoH.

See the wiki for installation guide https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Installation

It should be noted that DNSCrypt v2 offers a unique advantage in the form of relays (Anonymized DNSCrypt), which ensure that domain names and client IP addresses from which DNS requests originate are not visible to providers as well (though this is subject to significantly increased latency). DNSCrypt also makes it easier to utilize multiple resolvers of one's choosing in a round robin configuration (though this can be done with DoT via clients like Stubby as well, it is a bit more time-consuming to set up).

I care a lot about performance, so it'll be great to have an ads block list for DNSCrypt, minimized in size, and using wildcards: https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Filters

You could also use dnscrypt-proxy (or Simple DNSCrypt for a GUI) with custom blocklists to prevent known malicious sites from loading.

dnscrypt-proxy (instructions for a server) supports DNS-over-HTTPS (DoH) and DNSCrypt

Also, change your ISP's DNS addresses from your router if possible, use something like DNScrypt (linux, windows, OS) or yogadns (for windows) (easier but not free)

Running your own local recursive caching DNS resolver is always good. Something like a Pihole for home networks works well. You can also host your own DNS resolver on a VPS, and then connect to it using DNSCrypt.

As an alternative to traditional ingress, you can use cloudflared to expose web apps on Cloudflare via encrypted tunnels: https://github.com/cloudflare/cloudflared

It's not an issue anymore. Your main concerns are power and internet stability. Plus, upload speed. The rest can be worked out.

https://www.cloudflare.com/products/tunnel/

https://github.com/cloudflare/cloudflared

https://developers.cloudflare.com/cloudflare-one/connections...

I would suggest a reverse proxy tunnel. There is a great and mostly free one I personally use by Cloudflare. You will need a domain, cloudflare account and install the cloudflared client on your machine. For security you can lock down this tunnel in many ways as cloudflare gives you many many options. Zero trust is a good one to look at if you are wanting to secure what ever you want to expose with a login through google or GitHub.

I shared the same feeling until I gave up on "fixing" nextcloud for external access. Slapped cloudflared tunnel on it. You may have to disable Rocket Loader to get the homepage to work properly but after that it just works.

mariadb: # https://github.com/linuxserver/docker-mariadb/releases image: lscr.io/linuxserver/mariadb:${MARIADB_VERSION:-latest} container_name: nextcloud_mariadb environment: - PUID=${PUID} - PGID=${PGID} - TZ=${TZ} - MYSQL_ROOT_PASSWORD=${NEXTCLOUD_MARIADB_ROOT_PASSWORD} - MYSQL_DATABASE=nextcloud - MYSQL_USER=nextcloud - MYSQL_PASSWORD=${NEXTCLOUD_MARIADB_PASSWORD} volumes: - ${NEXTCLOUD_PATH}/mariadb:/config security_opt: - no-new-privileges:true restart: unless-stopped labels: - "com.centurylinklabs.watchtower.enable=true" redis: # https://hub.docker.com/\_/redis?tab=tags image: redis:${REDIS_VERSION:-latest} container_name: nextcloud_redis security_opt: - no-new-privileges:true restart: unless-stopped labels: - "com.centurylinklabs.watchtower.enable=true" cloudflared: # https://github.com/cloudflare/cloudflared/releases image: cloudflare/cloudflared:${CLOUDFLARED_VERSION:-latest} container_name: nextcloud_cloudflared_tunnel command: tunnel run environment: - TUNNEL_TOKEN=${CLOUDFLARED_TUNNEL_TOKEN} restart: unless-stopped labels: - "com.centurylinklabs.watchtower.enable=true" watchtower: ## https://containrrr.dev/watchtower/ image: containrrr/watchtower:${WATCHTOWER_VERSION:-latest} container_name: nextcloud_watchtower environment: - WATCHTOWER_CLEANUP=${WATCHTOWER_CLEANUP:-false} - WATCHTOWER_LABEL_ENABLE=${WATCHTOWER_LABEL_ENABLE:-false} - WATCHTOWER_SCHEDULE=${WATCHTOWER_SCHEDULE:-0 0 0 * * *} ## https://pkg.go.dev/github.com/robfig/[email protected]#hdr-CRON\_Expression\_Format volumes: - /var/run/docker.sock:/var/run/docker.sock - /etc/localtime:/etc/localtime:ro restart: unless-stopped

An alternative to static IP would be to use the Cloudflared proxy/tunnel. https://github.com/cloudflare/cloudflared

https://github.com/cloudflare/cloudflared/ here ya go

Yep! Actually, it was quite easy to set up. I used a client called cloudflared - but actually, I used this addon for Home Assistant. There's simple some instructions, I guess if you're not using the Home Assistant addon, you could check out the original cloudflared repo.