[stavros]

Unfortunately, you can't use this to tunnel multiple subdomains, unless you tunnel an entire domain. That's because Cloudflare won't let you issue third-level wildcard certificates, so you can't proxy *.lab.mydomain.com. Maybe I should just get my homelab a domain and be done with it, but right now running everything over Tailscale seems like a better solution.

[ricktdotorg]

FYI you can get third-level certs wildcard or not if you subscribe to their Advanced Certificate Manager product.