The (wildcard) certs are the same, as it's what caddy is pulling via API. You can either build the cloudflare module into caddy via docker build, or use a prebuilt version. It doesn't create two separate certs for local and remote.

It works really well for me, and is actually the most straight forward way to get valid certs for internal services I've found. Since they're wildcard, my internal domains don't get exposed through certificate authorities.

Remember that we're talking about a server on your local network, and a device on the local network to make the connection for the stream. We aren't talking about streaming over the internet.

• Client looks up server via DNS
• Client connects to public IP
• Client handshakes to server
• Server announces to client available connections (public, local)
• Client continues connections with local address

There is no need for tailscale or anything, this is a local connection. The only thing the public address is doing is the initial call to the server.

Plex does this on its own. It's one of the features they provide. The client/service knows when the server is local even though you go outside to make the initial connection. They go through a lot of trouble to do this. You connect externally it brokers the initial connection proxies date of back and forth to see if you can talk to each other directly, your client knows your server is now local and it switches over.

I don't know if any other video hosting package that does this. Jellyfin certainly would not. I 'think' if you threw a tailscale in the middle, It would be able to do it without hair pinning as long as you were using a local exit node instead of tailnet. They'd still probably go through that local exit node.