I have AdGuard Home running on OPNSense as a local DNS with a wild card for for the ‘local domain’ pointing to Caddy

in Caddy I have this section:

*.<domain>.net {
#header X-Frame-Options "SAMEORIGIN"
        tls internal
        encode gzip
        import sec-headers
        @sub1 host pve.<domain>.net
        @sub2 host kasm.<domain>.net
       ...
       handle @sub1 {
                import sec-headers
                reverse_proxy * https://10.1.1.11:8006/ {
                        transport http {
                                tls_insecure_skip_verify
                        }
                #       header_up Host {host}
                       header_up X-Real-IP {remote}
                       header_up X-Forwarded-For {remote}
                       header_up X-Forwarded-Port {server_port}
                       header_up X-Forwarded-Proto {scheme}
                }
        }
        handle @sub2 {
                import sec-headers
                reverse_proxy  https://10.1.1.119/ {
                        transport http {
                                tls_insecure_skip_verify
                        }
                #       header_up Host {host}
                       header_up X-Real-IP {remote}
                       header_up X-Forwarded-For {remote}
                       header_up X-Forwarded-Port {server_port}
                       header_up X-Forwarded-Proto {scheme}
                }
        }
...