Wrote up how my homelab proxying strategy evolved over four phases — from port forwarding with DDNS to a VPS running nothing but HAProxy for L4 passthrough.
The key insight: keep the VPS dumb. SNI inspection, encrypted passthrough, nothing else. TLS termination belongs on hardware you control.
Comparison table of L7-on-VPS vs L4-passthrough vs direct port forwarding, plus thoughts on Traefik for automatic Docker service discovery.
https://blog.dpinkerton.com/posts/evolving-reverse-proxy-strategy/
#selfhosting #homelab #haproxy #caddy #traefik #reverseproxy
David Pinkerton
npub1jz…aaju6
2026-02-08 06:06:35 UTC
Author Public Key
npub1jz0rlhp9ngs3at2kfhzcnc62sxh0y9rxt40x3z003wmdguljky9quaaju6Published at
2026-02-08 06:06:35 UTCEvent JSON
{
"id": "67cb996745bfe99bca9c863904c8b825ecfb044351d57eeb4268b2bd8593ec67",
"pubkey": "909e3fdc259a211ead564dc589e34a81aef214665d5e6889ef8bb6d473f2b10a",
"created_at": 1770530795,
"kind": 1,
"tags": [
[
"t",
"selfhosting"
],
[
"t",
"homelab"
],
[
"t",
"haproxy"
],
[
"t",
"caddy"
],
[
"t",
"traefik"
],
[
"t",
"reverseproxy"
]
],
"content": "Wrote up how my homelab proxying strategy evolved over four phases — from port forwarding with DDNS to a VPS running nothing but HAProxy for L4 passthrough.\n\nThe key insight: keep the VPS dumb. SNI inspection, encrypted passthrough, nothing else. TLS termination belongs on hardware you control.\n\nComparison table of L7-on-VPS vs L4-passthrough vs direct port forwarding, plus thoughts on Traefik for automatic Docker service discovery.\n\nhttps://blog.dpinkerton.com/posts/evolving-reverse-proxy-strategy/\n\n#selfhosting #homelab #haproxy #caddy #traefik #reverseproxy",
"sig": "2997f48dcbd88b6f21ed0b6986fc58522cc31e3f9e24e5763f10022187aa4f22f9aa36e446f83969fd2052a415e6720fbb1e38423dda34594579bebe10a34e23"
}