Split-Horizon DNS: One Hostname, Two Network Paths, and a Lot of TLS Confusion
The same hostname can resolve to a local reverse proxy on LAN and a Cloudflare Tunnel externally. That is clean when DNS, SNI, certificates, and origin routing agree—and maddening when one layer quietly takes the other path.