Kamal proxy is good enough to sit behind a load balancer. I would not let it be what a client sees. There are some major features missing and it just hasn’t been battle tested enough to be subjected to DDoS type traffic, etc.

Overall, I do like the Kamal approach which basically boils down to the fact that instead of a complicated cluster orchestration system the developers decide which machines code runs on.

Once it has real support for doing DB migrations as a part of its deploys, a proxy that is less magical and more feature rich, and its CLI fixes some poorly documented and frankly somewhat annoying issues it will be a real workhorse.

I am also curious about Dokku + k3s. I have used Dokku for a long time but only on a single host.

What’s your use case for custom certs? Why are the automatically issued Let’s Encrypt ones not enough?