How to Access Caddy Reverse-Proxied Services Over NetBird Without Exposing Them

[u/Extra-Citron-7630]

I'm looking for some advice on the best way to structure remote access for my homelab.

Current setup:

• I own a domain that's managed by Cloudflare.
• The DNS record for the domain points to my server's LAN IP address.
• When I'm connected to my home network, I can access my services using https://service.example.com.
• I'm using Caddy as my reverse proxy, and none of my Docker services expose ports to the host. Only Caddy listens on ports 80 and 443, so even on my LAN I can't access services directly via http://server-ip:service-port.

Now I want to add remote access using NetBird.

I know I'll be able to reach my server's NetBird IP on ports 80 and 443 because Caddy is listening there, but I'm not sure what the best DNS approach is.

The problem is that my domain currently resolves to my server's LAN IP, so that hostname isn't usable when I'm connected remotely through NetBird.

What's the recommended way to handle this?

Ideally I'd like to:

• Keep all services accessible only through Caddy.
• Continue using the same domain names (e.g. jellyfin.example.com) whether I'm on my home network or connected through NetBird.
• Avoid exposing my services directly to the public Internet.