Right, but I have wireguard on my opnsense. So when I want to reach https://jellyfin.example.com/ , if I am at home, it goes phone -> DNS -> proxy -> jellyfin (on the same network). If I am connected to the VPN, it goes from phone -> internet -> opnsense public ip -> wireguard subnet -> local subnet -> DNS -> proxy -> jellyfin. I see some unneeded extra steps here… Am I wrong?

Oh, I get that, but it just doesn’t make any sense to me to be physically next to the server, and connect to it via VPN…

My network is not publicly accessible. I can only access the internal services while connected to my VPN or when I’m physically at home. I connect to WG to use the local DNS (pihole) or to access the selfhosted stuff. I don’t need to be connected while I’m at home… In a way, I am always using the home DNS.

Maybe I’m misunderstanding what you’re saying…

I can stay connected, still works, but I don’t think I need the extra hoops.

I also have a different subnet for WG. Not sure I understand what you’re saying…

Same, wireguard with the 'WG Tunnel" app, which adds conditional Auto-Connect. If not on home wifi, connect to the tunnel.

I’ve been daily driving Hyprland for 4 years now. Before that it was DWM, and before that Gnome. I was never a KDE fan, don’t know why… I never disliked it, I just preferred Gnome.

60k stars for a free open source self hosted project? I’d say that’s a really healthy number. Jellyfin has 37k.