Limit

I use nginx proxy manager with dns challenge to get a *.example.com cert that I then use to host services internally. I just checked, it supports dns challenge for porkbun, you may want to give it a try again. Also, you shouldn't really need to forward dns to duckdns. You can have public dns records point to an internal ip.

This is what I do, I have example.com (dns registered with cloudflare but should work the same with porkbun) I then create an a record for portainer.example.com to 192.168.0.5.

Internally my nginxproxymanager is running at 192.168.0.5 and portainer is running at https://192.168.0.6:9443

Then in nginxproxymanager I create a dns challenge (you'll have to look up some videos on how to do this, it's not very difficult it usually just takes a api key and secret key) then I create a new proxy host for portainer.example.com pointing to https://192.168.0.6:9443 and you select the *.example.com as your ssl cert for the proxy host

Now internally go to https://portainer.example.com and it should work.

I'm a big fan of duplicati. You can install it on Linux, windows, (not sure about mac) and use it to send backups anywhere. Backup to your nas, to s3, smb share, whatever.