Hacker News Reader

"it allows Traefik to get letsencrypt certificates even for internal services not exposed to the outside world"

But something has to be exposed to get these certs to the internal services?

You don't have to expose any ports. It uses ACME DNS challenge, which is supported by Cloudflare and other large nameserver providers. https://doc.traefik.io/traefik/https/acme/#dnschallenge

you can also use your home router to do this if you run something like OPNSense (there is also pfsense but that uses a much older freebsd kernel that does not support newer NICs)

Reply on news.ycombinator.com