I have a similar setup, with a public domain hosted by cloudflare. Internally, I use caddy with the DNS feature pointing to the cloudflare using their API and letsencrypt certs.
Something like this: https://webenclave.com/2024/11/07/setting-up-a-secure-local-network-with-caddy-cloudflare-dns-and-lets-encrypt/
I can also share more details, maybe my compose files and caddy setup if you need them.












But… why? I mean, who’s targeting Arch? Sounds like the Arch team has some info that they won’t release (for now), but this is so confusing to me…