Joe

NFSv3 (udp, stateless) was always as reliable as the network infra under Linux, I found. NFSv4 made things a bit more complicated.

You don’t want any NAT / stateful connection tracking in the network path (anything that could hiccup and forget), and wired connections only for permanent storage mounts, of course.

How will running a CA limit access? eg. Do you want to do client side cert validation? That sounds like an overcomplication. Also not ideal to run a CA (have signing keys) on the proxy server.

Deemix is a good way to build up your local cache from Deezer, at which point you can serve it locally.

It will mess with artist renumeration though (which seems important to you), so you might want to find another way to compensate your favourite artists.

Welcome to the world of Carrier Grade NAT. 100.64.0.0/10 is reserved for this.

If you are lucky, you also have an IPv6 address. The catch is you need IPv6 on the client-side too.

A VPS or similar running wireguard and a proxy might bridge the gap.

It might also be possible to ask your provider for some port forwarding. Probably not, but check anyway.

Good luck!

Dynamic DNS is probably still required, unless his ISP issues dedicated or very long term IPv6 leases.

IPv6 may also “just work” nowadays, too, especially if the aim is to connect from mobile or other consumer networks. Corporate environments are still hit & mostly miss.