He does refer to the pi as a gateway, so you would be right about it coming before the router. In that case, the pi would be the device handling NAT and forwarding ports.
So I think he's describing it accurately... it's just not a common setup to see these days.
I have my reverse proxy in a cluster, so it'll survive one of the nodes going offline. My router is still a SPoF, though, as is my modem. Not to mention the physical stuff, like a tree falling on the cable lines.
For a home environment, there's realistically always going to be a couple SPoFs, you can just move it around a bit.
You'll need a single DNS request, known as a "bootstrap" request. Your ISP will see a single DNS request to Google or Cloudflare or whatever, then everything after that will just look like normal https traffic.
That said, if your ISP is blocking and denying ALL dns requests for some reason (making the bootstrap request impossible), then you could still define the address locally. At that point, though, the ISP is likely blocking the IP addresses, too, so resolving the address is a bit moot.
Are you trying to send the DNS request through the tunnel?
I use DoH, which sends DNS requests through https. It essentially looks like normal https traffic (encrypted), so your ISP shouldn't be able to hijack it and no additional tunnels are required. CF supports doh at the usual 1.1.1.1 address, even, if you want to keep using them. Otherwise plenty of other providers support doh, as well.
Saying something is "self hosted" when it's actually hosted by a cloud provider is sort of like saying something was "self coded" when it was actually coded by an LLM.
Imagine Reddit, but every user stores a random piece of reddit in an instance on their device. They're all still normal users, so they can't block users from Reddit or from specific subs, even though their instance contributes to the whole. Their instance doesn't represent the entirety of Reddit, or even the entirety of a single sub, it's just a random chunk of Reddit.
BUT a user can be made a sub mod, which now gives them extra power over other users, but only in that one sub. It doesn't matter whether any portion of that sub is stored on their instance, all that matters is that they're a sub mod.
So you, as a pleb, have no control over what's stored on your instance, but a mod has full control over their community (which may or may not partially exist on your instance).
I recently added Anubis and its validation rate is under 40%. In other words, 60% of the incoming requests are likely bots and are now getting blocked. Definitely recommend.
Why not both? My initial idea was to flash to NOR and then configure openwrt to a sort of "minimal usable state". That is, I'd have the basic functions required run my home network: basic routing between local networks and WAN. Then I'd copy that image to NAND and that would be when I installed the "extras", like SQM and whatnot. That way, if I ever broke it beyond repair, I could just flip the switches and copy the NOR back to NAND and start over with that minimal usable config.I sort of followed my plan, but I think things have changed enough that it would not be the simple restart that I hoped it would.I still think it's a good idea, though.
The Nest ones? I haven't seen anything online of folks successfully flashing one. The first steps would probably be to solder on a USBC port and see what kind of access you can get over serial. There's a picture of a Nest board (not the Pro) here, as well as info on what appears to be the correct usb connector. The OP also mentions that the Nest is lacking the developer button, but my guess would be that the function is still accessible by shorting the correct TPs. It doesn't seem like that OP ever went through with the project, though, so maybe you'll be the first!
Interesting. Looks like he's actually using an R4. I've got an R3, myself, though. I use mine as my gateway router and it certainly seems under utilized. I've got SQM, adblocking, DDNS, DoH proxying, multiple VPN interfaces, and it's a 'router on a stick' for my home networks (at 2.5gbe). Despite all of that, the CPU load never seems to budge and I'm only using a tenth of the RAM. I'm personally a bit torn on the device; on one hand, it certainly seems like it can do a lot more. It even has a m.2 slot for SATA/nvme, so it could definitely provide NAS or even some bigger applications. On the other hand though, I feel like it's such a critical piece of infrastructure that I don't want to introduce a bunch of non-router-related functions and risk one of those extra functions crashing the system and bringing down my whole network.
He does refer to the pi as a gateway, so you would be right about it coming before the router. In that case, the pi would be the device handling NAT and forwarding ports.
So I think he's describing it accurately... it's just not a common setup to see these days.