I’m happy with 90 day certs for homelab stuff: I’m not worried about anyone MITMing my network. I figure the short lived certs are more important for people who provide services with a significant external user-base, or who process sensitive transactions.

I have my certbot set to check every 12 hours and renew at 60 days. Renewing every 3 days would be 20x more load on Let’s Encrypt systems, and that feels like abuse of a free service for my use case.

Tandoor definitely has a self-hosted path, including SSO integrations. It has a fair API that I’ve used to link it to nutrition data at USDA and my grocery store for prices. I suspect I could use the API to transfer a shopping list to the grocery store’s ordering system, but I don’t like the pickup or delivery systems. I’ve been pretty happy with tandoor’s import-from-web results, although the ingredient amounts often need some editing.