Oh perfect

Just wanted to ask since I’ve been bitten by that.

I do something similar, but I have them all under <service>.home.<example.com>

But that’s because I do have resources outside. Just helps my mental model to name space them.

I know the feeling. Ive already configured almost all services to be header auth or disabled auth entirely if possible, and just put them all behind a SSO forward proxy (nginx + authentik)

I also played around with injecting a tiny script into the proxied response to just add a small drop down menu with all services I've got available. .. while that worked, finding a good place to inject that menu was a chore so it's currently disabled again :)