![](https://lemmy.ca/pictrs/image/6e29ed11-fb39-48ad-a959-19aeebcfbe65.png)
![](https://lemmy.world/pictrs/image/8286e071-7449-4413-a084-1eb5242e2cf4.png)
I’m definitely not a network pro, but it sounds like you’re looking to do something similar to what I have.
I’ve got nginx proxy manager as my reverse proxy with pi-hole for local DNS. All traffic goes through the pi-hole and anything going to mydomain.com has DNS entries pointing to nginx. I’ve set nginx up so service.lan.mydomain.com is for anything local and just service.mydomain.com for anything external with wildcard SSL certs for both (*.domain doesn’t seem to cover *.lan.domain so add certs for both - probably because it’s a sub-subdomain).
The Cloudflare tunnel can then just get directed to service.mydomain.com instead of the IP of the service.
Unfortunately there isn’t really an all-in-one guide. TechnoTim has info on the Pi-hole config side and wildcard certificates, but I think he uses it with traefik.
NPM is pretty straightforward. If you find a site isn’t working, try turning on Web Socket support.
I’d say just search for guides on each part individually:
I can try to help if you run into any issues.