I have a single Podman stack & Podman network - ingress via Caddy with crowdsec that forwards stuff to the various things I've got going. All self-contained in the Podman network.

I want to put Caddy in a VM to establish a "DMZ" (separate kernel) as I've seen recommended for directly internet-facing infrastructure. But to do that, I'll break my single Podman network across two "servers".
Because it is across two "servers", I need to publish the ports for the services on the non-VM server so that the VM can address them externally - which allows the services to talk to the internet (even if they don't need it) and allows the services to talk to each other on published ports (before I could have separate networks for each service, so BookOrbit can't talk to Jellyfin for instance).

How can I have the Caddy in the VM that deals with the WWW forward things to the server running everything but retain that closed Podman network topology?

And ancillary Q, what other things should be in that "DMZ" VM? Auth ODIC? Headscale? Just Caddy?
Edit: Caddy forwards everything to the Auth OIDC which forwards it along if the connection attempt is logged in. Will be adding mTLS to bypass that check eventually. That's why I'm thinking Auth ODIC should be in the "DMZ" VM too.

And lastly, Podman networking works just like Docker networking, so any topology is transferable if you've solved this in Docker!

WRT = with respect to

Likely AI, because otherwise they just made up some quotes on their own. Either is egregious journalistic malpractice. But we all know which one it was.

The maintainer reported in the comments of the article that he is exclusively misquoted in the 2nd half of the article (including misquoted calling himself a “gatekeeper”).

Edit: I did confirm all misquotes from archive versions of the blog and ars article. But I also read the blog yesterday and have memory and it hasn’t changed

Edit 2: Ars took down the article, replaced with archive.org. And here’s the blog archive version

https://web.archive.org/web/20260213082753/https://theshamblog.com/an-ai-agent-published-a-hit-piece-on-me/

Edit 3: they have posted a retraction notice and the original link now says the story is retracted instead of being a 404 https://arstechnica.com/staff/2026/02/editors-note-retraction-of-article-containing-fabricated-quotations/

Edit 4:
The maintainer, Scott, posted about getting AI zooped twice as well:

https://theshamblog.com/an-ai-agent-published-a-hit-piece-on-me-part-2/

Edit 5: the retraction notice is shit; doesn’t even say what was retracted. It also makes it sound like only the quotes were the only LLM-generated thing; it’s much much more likely the latter half of the article is LLM-generated in its entirety

:3

Alt text: SMASH BROS ANNOUNCER: COUGHING BABY!!!

shitty wiimote speaker: uuaaaa uaaa EUUCUH
EEUUCUH UAAAAA

SMASH BROS ANNOUNCER: HYDROGEN....
BOOOMB!

shitty wiimote speaker: EXTREMELY LOUD DECOMPRESSED DETONATION NOISE

Shrimp maxxing == never leave your chair, stay shrimpin at your desk, wonder why you have back pain

I have had IPv6 off for a long time now, but it feels like now is time to actually try. I'm planning on setting the WAN side to DHCPv6 and the LAN side to Static IPv6 to match the IPv4 settings. https://docs.opnsense.org/manual/ipv6.html (I see people say "talk to your ISP about dynamic or static and what block size" but I would rather collapse into a singularity than contact my ISP unforced, so I shan't do that)

I've tried to read about IPv6 but I just don't have enough knowledge-ground to stand on to make sense of it in an actionable way.

From what I have read and (mildly) understood, I think I know that IPv6 addresses are directly identifying; no longer does everything on the internet see the IPv4 of your router only - now things see your specific device's IPv6 that's a... subset? of the router's IPv6 range (not single IP) assigned. https://superuser.com/a/1735921 People describe it as a different way to network, which I guess means no matter what I read I'm still not sure what to do.

I want IPv6 to work exactly like IPv4: router has WAN IPv4 address and masquerades for every device in the network. I don't want Google knowing exactly which computer contacted them from inside my LAN, I want them to put in the work to finger print my device with various ways that are likely illegal in the EU.

How do I prevent that IPv6 privacy issue, or did I misunderstand how IPv6 works?