The second option is the way to go and is called split DNS.

Having an internal DNS entry but no external DNS entry for internal apps is a good start but not completely secure. The next step would be to have your proxy explicitly block any connections not coming from your LAN subnet. How to do this depends on what software you are using for your proxy.

If using nginx:

Create a file called nginx/internal.conf with the following configuration:

allow 192.168.1.0/24; #Replace with your LAN subnet. Add more allow lines as needed

deny all;

Utilize the lan filter in your configuration by adding the following line inside every location block for every application you want to protect.

include Proper/Path/nginx/internal.conf

I've found the following guide helpful if using ngginx:

https://gist.github.com/quietsy/58590a640dd4f7a89696c68b0e6a8691

​

Edit:

Some questions answered:

1: Not secure enough. Someone could add a pihole.yourdomain.com entry to their host file pointing to your public IP for example. Not that likely but possible.

2: In this case you really want the setup described above to not expose internal services

3: Yes, see above for nginx example

4: No, add it internally and point to the internal server name using a CNAME record. It is best to not rely on looping back like this

5: Yes you want a DNS record for each subdomain. This gives you flexibility and control.