Replying to @dave@lemmy.pootis.network
@dave rudimentary split dns. All my FQDN are using a compliant example.com my network serves those app.example.com, my AdGuard does rewrites for them and in the public space i A DNS to them using Tailscale IP.
May not be approved by enterprise architects but works with no public port openings