I have this exact situation, where I have a Pangolin tunnel (used to be Cloudflare before) and everything gets routed there. I'm having a .local domain resolve to the server in LAN, but this requires a self-signed certificate so only my personal devices use it.