chuchichaestli

Guess it depends heavenly on which stack you are working. We use drone.io (can be selfhosted if that's a requirement) and are actually quite happy with it.

Instead of opening ports on your firewall, you could introduce a mesh. I'm using nebula by slack, rest is 90's style with apache /nginx, lego for le dns-challenged certs, and the nebula lighthouse as a proxy. Works fine, is secure and does not bind 443 on your router to.a specific pi.