I Was DEFINITELY Using The Wrong DNS Setup

A walkthrough of setting up a private DNS chain for self-hosted home lab services that achieves valid TLS certificates, no browser warnings, and remote accessibility without exposing your home IP. The setup combines a local DNS server (AdGuard), a public DNS provider (DNSimple) pointing to a private IP, Caddy as a reverse proxy with automated DNS-01 challenge certificate issuance via the DNSimple plugin, and Tailscale/Headscale for remote access. Key pitfalls covered include browser certificate warnings with local-only DNS, the risks of relying on obscure subdomains for security, and the limitations of security by obscurity.