[maxgashkov]

I've settled on using .internal and Knot as a authoritative NS, step CA + ACME to issue short-lived certs, and a Split DNS resolver from Tailscale as the only external dependency (mostly as a convenience for when I'm on the road).

I do have a luxury of all the homelab VMs being rebuildable via IaC, so I've just injected CA trust at that step.

The biggest PITA so far were 3rd party docker images, each with its own way to inject custom CA.

iOS devices were surprisingly easy to handle.