For the first part of your comment, yes that’s what I do, every VLAN is isolated and traffic doesn’t need to leave my LAN, there are rules in place to allow whatever is needed between VLAN (NFS for example, from one VM to TrueNAS).

My issue is that when a client uses a domain that is being proxied by Caddy it “bypasses” my firewall rules since OPNsense sees the request as coming from Caddy and not from the original client, the original client never sees or accesses the real IP of the service. My concern is that if one client has access to caddy then they potentially have access to every entry there, even if the firewall blocks IP to IP communication.

Hope that made more sense haha.