My setup: My domain-> vps <-wireguard->home ubuntu server behind 4G modem. My home server runs letsencrypt certbot for .mydomain.com My ubuntu server at home runs adguard home as DNS/DHCP/Android Private VPN. I have rules for adguard to forward any client coming from home lan 192.168.1. accessing mydomain.com to go directly to my home server local ip.

That way I run same certs and can access my local services via same urls - immich.mydomain.com runs from outside and inside my network, with ultra fast local uploads without using my modem data, etc.