I have a flint 2 (glinet) as my firewall as well, I had read somewhere that I should install vanilla OpenWRT so I did (I have added stuff to it so I like coming up with different flavours when talking to people like rocky road). I have Caddy running in docker on a pi in my LAN I have a password file of some sort that Caddyfile references at the top. Don’t ask me how I formatted it because I do not remember that part but take my secondary pihole as an example of using a domain that cannot be reached, touched from outside of my lan.

‘pihole52.mydomain.ca { @allowed { remote_ip 10.0.0.0/8 } handle @allowed { redir / /admin{uri} reverse_proxy 10.0.69.52:31415 } handle { respond “Not available from this network” 403 } import easydns_tls log { output file /var/log/caddy/pihole52.log format json } }’

While other places on my domain can be reach outside of my vLANs. I have to secure some things up as I found that my SearXNG is open to the WAN.