Piwigo is pretty good hey

yes it it.  Also, I played a bit with port 443 forwarding and https configuration in Apache, and it finally kind of works.

Dynamic DNS

I have used  https://desec.io/ after trying also no-ip before.  Works fine.  In the Proximus BBOX I did setup the dyndns client parameters:

Provider: Custom
User Name: myhostIchoseTheNameOf.dedyn.io (as on desec.io: my domain)
Password: (my password at desec.io)
Hostname: myhostIchoseTheNameOf.dedyn.io
Custom Service:
HTTPS: On
Server: update.dedyn.io
Port: 443
Request:  ?hostname=%5BmyhostIchoseTheNameOf.dedyn.io%5D&myip=%5BIP%5D
Update Interval: 3600

DHCP

The HTTPS server needs a fixed IP address so we can do port forwarding in the next step.  Just assign one in the DSL router dialogs

Port forwarding

Forward only port 443 to the fixed IP address you assigned to the HTTPS server

SSL

Obtaining the first certificate was OK after a lot of reading, and some trial and error.  I still have to document how this can be done through let's encrypt

Apache:

 <VirtualHost *:443>
        ServerAdmin admin@myserver.lan
        DocumentRoot /var/www/html/piwigo
        ServerName myhostIchoseTheNameOf.dedyn.io

        SSLEngine on
        SSLProtocol all -SSLv2
        SSLCertificateFile /etc/letsencrypt/live/myhostIchoseTheNameOf.dedyn.io/cert.pem
        SSLCertificateKeyFile /etc/letsencrypt/live/myhostIchoseTheNameOf.dedyn.io/privkey.pem
        SSLCertificateChainFile /etc/letsencrypt/live/myhostIchoseTheNameOf.dedyn.io/fullchain.pem
     <Directory /var/www/html/piwigo/>
        Options +FollowSymlinks
        AllowOverride All
        Require all granted
     </Directory>

     ErrorLog ${APACHE_LOG_DIR}/error.log
     CustomLog ${APACHE_LOG_DIR}/access.log combined

</VirtualHost>