Thanks for the info, I appreciate it.

I am a newbie so I am not sure I understand correctly. Tell me if my understanding is good.

Your Pi-Hole act as your DNS, so the VPS use the pi-hole through the tunnel to check for the translation IP, as set through the DNS directive in the wg file. For example, my pi-hole is at 10.0.20.5, so the DNS will be that address.

On the local side, the pi-hole is the DNS for all the services on that subnet and each service automatically populate their host name on pi-hole. I can configure the DNS server in my router/firewall (OPNSense in my case)

So when I ping service.example.com, it goes through the VPS, which queries the pi-hole through the tunnel and translates the address to the local subnet IP if applicable.

So when I have the wg connection active and my pi-hole is the DNS, every web request will go through the pi-hole. If the IP address is inside the range of AllowedIPs, the connection will go through the tunnel to the service, otherwise, the connection will go through outside the wg tunnel.

Does that make sense?

How does WG work on the local side of the network? Do you need to connect each VM/CT to the wireguard instance?

I am currently setting up my home network again, and my VPS will tunnel through my home network and NPM will be run locally on the local VLAN for services and redirect from there.

I wonder if there is any advantage to run NPM on the VPS instead of locally?

I’ve been with my partner for 13 years and I’d say you still change a lot between 34 and 43, as you put it. The difference is that as we get older, we are usually more accepting of all the little things we used to find annoying.

I find that my core values are stronger, but everything else is less annoying overall. It makes accepting that your partner is changing a lot easier to deal with, so long as their changes aren’t in contradiction with your core values.

It is a lot simpler nowadays. Download Caddy, put a 2 line config and you are good to go.

PR speak need to die and anyone caught using it should be shamed into oblivion.