Our VMware costs have doubled for our last 3 renewals. We had a project this year to move to another hypervisor. Most of our hardware was old, and we were able to replace all of our hardware AND buy the license for the new hypervisor and it’s still cheaper than renewing one year of VMware.
I have just recently started messing with Authentik. And I can confirm OIDC claims and whatnot are an absolute nightmare. I have some experience setting up SAML stuff from my work, but I only do that if our main guy is out and I always struggle with it there too.
Your setup sounds the most like what I am doing now, minus the DMZ. But all of my containers are rootless. I am running everything on TrueNAS right now.
I think I will lean more on Authentik, as the provisioning of users and giving them access to services through that is very easy. I will probably stick with Cloudflare for the time being, but I will look more into Pangolin.
There is an iOS/macOS app called “Pi-hole Remote” that can manage multiple PiHole instances at once. I use that because it will make changes on both instances at once for me.
Other than that, I log in to each device and copy paste.
I was fortunate enough to get a .io domain with my first initial and last name (I have a very common last name), and I have stuck with that ever since. I am a bit concerned with the political stuff around it, as the domain may be going away as some territory changes hands. But I think at this point there are enough large companies using the domain that I’m hoping it would be protected if the country ends up losing the domain.