Exactly the opposite for me, using official container images is a major time save.

The containers will store their data in volumes, and ideally those volumes are individual ZFS datasets. The containers themselves are stateless, and you can just boot them up with the volume to “restore” them.

However if you want to learn proxmox anyway this is a moot point anyway.

Some concerns:

• get multiple smaller harddrives and put them into some kind of RAID / zpool with redundancy. the drives will fail.
• there is absolutely zero reason to have a VM per service when a container will do. There are no advantages. But VMs will take significantly more resources and be harder to right-size. There is no restore/backup advantage using VMs.
• for that reason there is also no reason to use proxmox in the first place, unless you want to learn proxmox. Truenas scale for example comes with pre-installed k3s.
• I would get a separate hardware firewall because it makes easier to expand the network later.

Anything based on nagios supports custom checks, via any executable script.

apt install nginx
cp -r my-files/* /var/www/

I wouldn’t use it unless you have a separate room somewhere, they are VERY loud.

I disagree with this, container runtimes are a software like all others where logging needs to be configured. You can do so in the config of the container runtime environment.

Containers actually make this significantly easier because you only need to configure it once and it will be applied to all containers.

Docker stores that stdout per default in a log file in var/lib/docker/containers/…

Containers don’t do log rotation by default and the container itself has no say in the matter. You have to configure it in your container runtime config.

Roles in authentik are for permissions in authentik. You want a group instead. Group memberships are send via OIDC.

This is probably the way, because a traditional “mail server” is actually 4-5 different servers working together.

• postfix for SMTP
• dovecot for IMAP
• amavis to plug in…
• spamassassin as anti spam
• clam-av as antivirus

And they can all be very easily misconfigured to break everything completely. Great learning experience though.

Nextcloud has collabora integrated.

I would put this stuff behind VPN.

Seems weird to me, the router would need to do deep packet inspection of DNS and selectively block specific ones. It feels more like you’ve set up your DNS to do forwarding instead of resolution. Can you post a network diagram and the DNS config?

Just to be sure you do dig A @server $domain (with the “A”) and can confirm the following

SERVER is your server

;; ANSWER SECTION is empty (or doesn’t exist)

;; AUTHORITY SECTION mentions your local DNS server

Also check

dig NS @server $domain

Is your server in the answer section?

Here is how I would diagnose (I’m assuming you have Linux / WSL on a client)

1. Check the DNS record is actually set (yes do it again)
2. Do these steps on the client:
3. dig $domain check which server answered
4. dig a $domain should give a record
5. dig a $domain @server to make sure you’re querying the right server

If none work, probably network issue (DNS boind to wrong IP, firewall, etc)

If 3 and 5 work but 4 doesn’t, your DNS isn’t authorative.

If only 5 works DNS settings on the client is wrong.