I use wireguard for all that, it is self hosted and I do not have to have accounts elsewhere, once I have my OpenWRT up and running and my static IPs running to it I will move wireguard there. I have QR codes setup so that I can give people a taste of pihole for a short period of time when I am away from my LAN, of course when they are on my guest wifi they get pihole the whole time.

Just a side note for any 2FA I use vaultwarden.

Cool I have different docker-compose.yml files for each service did not even think to put them in one.

I am a fan of Immich but know nothing about Synology. Does Synology have a subscription or something? Immich has done a much better job at tagging things and putting them in to albums than Apple’s Photos ever did for me, it took the stuff that Apple had tagged and than did a much better job.