@allibragi

I think two things are getting mixed here: not wanting to open ports, and not wanting to expose your #homelab to the internet. Your current approach (open ports → get cert → close ports) doesn’t really solve either cleanly.

If you only need internal access, you can just use a reverse proxy (e.g. #Caddy) with a DNS challenge (like #Cloudflare API). That way Let’s Encrypt works without opening any ports at all. Combined with #Tailscale, everything stays private, but you still get a proper trusted HTTPS cert and the app works fine.

If you do want external access but still don’t want to open ports, then Cloudflare #Tunnel or Tailscale #Funnel are options. Just be aware of trade-offs: Cloudflare has upload limits (which can matter for Immich), and Funnel is still not perfect for every use case.

In short: DNS challenge solves certs without port forwarding, Tailscale keeps it private, and tunnels are only needed if you want public access without opening ports.