TIL: wildcard (sub-)subdomain DDNS for pfSense using Cloudflare

I now seem to have a need for sub-subdomain DDNS because I want to start using Immich to potentially replace the photo sync part of Proton Drive. Apparently, Immich seems to have a hard time supporting subpath-based reverse proxying. As I’m quite used to that approach, I naturally covered this topic in a blog post. My trusted DDNS provider (FreeDNS) reserves wildcard records for paid accounts, which I totally understand. Still, I’m unwilling to pay for this. In general, if you don’t intend to shell out money, pay close attention to not become the product. Which is probably how Cloudflare gathers its heuristics data, given that nowadays every second homelab installment seems to hide behind a Cloudflare TLS-terminating reverse proxy. The point I’m trying to make is this: using Cloudflare for DDNS seems safe, as long as you omit the reverse-proxying part and therefore, TLS termination. Cloudflare will only respond to DNS queries, and not handle actual traffic. These steps allow you to…