TLS certificates for internal services done right

The article explains how to properly implement TLS certificates for internal services by using "split-horizon DNS" configuration instead of self-signed certificates. Rather than restricting internal domains to private extensions like .internal, the author recommends using a public domain (e.g., tuxnet.dev) that resolves to internal IPs for VPN users and public IPs for external DNS resolvers, allowing Let's Encrypt certificates to be used while protecting the service with a WAF. The solution uses NetBird for DNS management, acme.sh for certificate issuance, and nginx as a reverse proxy with WAF capabilities.