I want to make some services accessible from the ethernet, say my jellyfin instance or something, and some to be available locally only (traefik dashboard, proxmox).
Is there any way to make it so that all *.local.mydomain.com are only accessible from lan? I’m planning to give my local services a local.mydomain.com domain. (traefik.local.mydomain.com, pihole.local.mydomain.com)
This is easy with Traefik. Just create one entrypoint for public services in addition to your existing entrypoint. Then point Cloudflare at your new entrypoint and add services that you intend to publicly expose to that entrypoint, then add everything else to the other entrypoint that isn’t connected to Cloudflared