It’s getting harder and harder to win this fight. I’m Romanian and I’m afraid on sunday our poor/uneducated people will vote for the far right. I don’t even have any idea if I can leave for other country because everywhere you look the far right is gaining political territory.

FUCK NAZIS! FUCK FASCISM!!

Thanks for the great explanation.

So, currently, as I said, I’m using nginx proxy manager and do this:

• reverse proxy to all my services inside the internal network on http: *arr stuff, rss reader, jellyfin and some other minor things. All of them use name.local.home notation. I’m using a local DNS for this, of course.
• reverse proxy to just two services externally on https under wildcard certificates - both are non-standard names and the names are not related to the services themselves. For both these services I use Authelia with 2FA, so even if an attacker guesses the subdomain name, they’ll have to bypass that. As far as I can see in my logs, there are no attempts to breach my services. This is what I want to replicate and I’m planning on testing it.

On the other hand, You gave me a good idea about using *.lab.domain.com getting resolved by the local DNS and the main *.domain.com by my public DNS. I’ll give this a try too in the near future. Another plan for me is to start using Authentik, as I saw it’s a bit better than Authelia in some areas, even though it may be overkill for a little project - I’ll have to see.

WhatsApp has had this for years. Telegram too.