I have a webspace with its own domain my-domain.org run on an external hoster.
At home I have a (Synology) NAS running a reverse proxy and a Let’s Encrypt certificate for the subdomain home.my-domain.org. The subdomain points to my DynDNS and I can reach my NAS internally and externally using the subdomain. For simplicity I use sub-subdomains to access my services, eg. Homeassistant is internally accessible through ha.home.my-domain.org. Those sub-subdomains are also part of the certificate using subject alternative names.
Now I want to segment my Network into multiple VLANs and servers.
One server would eg. be in VLAN 10 and only run an internal webserver acessible publicly on port 80/443. Another server would be in VLAN 20 and serve Homeassistant internally (port 8123).
How would I have to set it up so all internally/externally accessible servers use the Let’s Encrypt certificate?
Do I have to move the proxy server into a DMZ and make it handle all internal and external traffic? Eg. have it in VLAN 30 and make it fully accessible from the internet and the other VLANs and it would resolve the sub-subdomains and redirect the request into the appropriate VLAN?
Additional notes: I am using an Unifi Dream Machine as router/firewall and Unifi switches for the VLAN segmentation.
