Thanks, I’d like to know more about how to go about this approach.

I guess in my head, I want to achieve the following (however I go about it):

• Access mydomain.com from outside my network and hit some kind of blank page that wouldn’t necessarily suggest to the public that anything exists here
• Access mydomain.com from inside my network and hit a login page of some kind (Authelia or otherwise), to then gain access to the Homepage container running in Docker (essentially a dashboard to all my services)
• Access secure.mydomain.com from outside my network and route through to the same as above, only this would be via the Tailscale IP address/container running on my stack to allow for remote access
• Route all HTTP requests to HTTPS
• Use the added protection that Cloudflare brings (orange clouds where possible)
• SSL certificates for all services
• Ability to turn up extra Docker containers and auto-obtain SSL certs for them Ensure that everything else on my NAS and network is secure/inaccessible other than the services I expose through Traefik.

I have no idea where Cloudflare factors in (if at all), nor how Pi-hole factors in (if at all).

Internal stuff I’ve been absolutely fine with. Stick a domain name, a reverse proxy and DNS in front of me and it’s like I’m learning how to code a Hello World app all over again.