Good resources for setting up a domain name to a local Caddy instance

I’ve been using Linux for decades, I’ve worked as a software engineer/architect/sre for around a decade, but networking has always been my biggest gap in knowledge.

I have a local server, I have caddy spun up, a glinet router running their version of openwrt, and I have a domain name purchased through porkbun.

I am looking to setup “local.domain.com” to point to my local server, ideally without exposing it publicly, and enable devices on my home network to be able to access it from that url. Id also like to be able to access containers running on that server by something like “searxng.local.domain.com” or “local.domain.com/searxng” aka without using the port suffix. Id also like to enable https.

I have read so many guides that have fragments of what I need, but nothing that ties enough together to get it working. And with all the options around different domain registers, let’s encrypt, reverse proxies, etc, im struggling just a bit.

Are their any guides (prefer text over YouTube, but beggars cant be choosers) that people recommend that encompass the whole process, instead of just pieces? Id like to understand it instead of just fumble through it.

You pretty much have four options, ranging from fully local to network level to VPN to public.

1.) Good old hosts file. Pro: Easy on linux. Cons: Doesn’t automatically update, needs to be installed manually on each device, some devices (phones) are harder to setup.

2.) Set DNS records using your router to your local ip, or if it does not support adding DNS records, then use a service like pi hole as your DNS server. Even external DNS providers like Adguard or Cloudflare should work, if you register with an account. You should be able to set up a DNS record for each subdomain, or do something like *.myhost.internal to catch all subdomains. Using the .internal TLD is highly recommended in this setup. Pros: Simple to set up, the router should inform all devices about the changes in DNS. Cons: To get rid of SSL warnings you will need to install the Caddy Root Certificate as a trusted agent on each device.

3.) Use a service like tailscale or netbird that offers automatic DNS and allows you to bind services (ports) to domain names. Pro: Allows access from anywhere. Cons: Needs to be installed on every device accessing it.

4.) Setting up a public DNS with a private IP address. Makes things a lot more complicated if you want to use let’s encrypt. Will need to do something like split dns and has to expose the port for the ACME challenge.

Instead of using let’s encrypt, you may again install the Root Certificates like in step 2 on every device to reduce the complexity by a good amount. Beware that binding public DNS to local IPs is considered bad practice, as it allows for DNS rebinding attacks. Some browsers and devices will complain (unless you use a .internal domain, but these can’t be registered publicly). Pro: If done properly, then, in principle, it should work on any device without setup. Cons: The hardest way of setting things up. Need to open up the network to allow automatic SSL certification. Some devices see this as a security threat.

If you decide on one of these paths, it is easier to recommend a guide for a specific setup. I feel like your question is mixing up some of these options. I’d also be happy to answer questions on anything but 4.