I just do hairpin NAT sure people well say not the best but it just works and don’t have to maintain a separate DNS server.

Adguard home has a DNS rewrite function that you can use to rewrite local DNS queries.

I use it to rewrite my queries at home to point to the LAN IP. When I am out I get my public IP from normal resolvers.

I have opnsense, and it was pretty easy. I use DNS overrides and a local reverse proxy. When I’m on the home network, the local dns overrides point to the local reverse proxy. When I’m outside the home, public DNS records point to my VPS, which reverse proxies the traffic to my home machine. This way I’m only hitting the VPS when I’m outside the home. Much more efficient.

I think Side of Burritos’ youtube channel has a guide on how to set this up, but it’s fairly straightforward.

Okay lots of good info here but just to make sure it was clear that you are kinda solving two different but related problems. Connectivity with WireGuard or other VPN and split-horizon or multi-horizon DNS (Wikipedia) which also called a view sometimes (like BIND) and can also be done with two different DNS servers. You can sorta do it with AdGuard but it is tedious to maintain. If you are using a wildcard rewrite it works alright but that isn’t necessarily the same as a CNAME or subzone delegation.

The next pice I’m not sure I saw mentioned is that WireGuard is not like other VPNs in that if two nodes are on the same network they will generally communicate directly peer to peer even over WireGuard addresses so you don’t really need to worry about traffic hairpin like you described unless you configure it to do so (which is more like traditional VPN would act). Tailscale is similar in concept but it uses different terms and technologies.

Anyway not sure if that helped or made it more confusing but there are may ways to solve it so good luck! FWIW, my home network is currently set up with a public zone on a commercial provider. It has a wildcard CNAME to something like proxy.domain and that is an A record containing the WireGuard addresses. Then my local DNS overrides the one A record for the proxy internally which I only get when WG is off. I would rate this solution adequately functional but medium level of janky, 8/10 would use again :D

Although I do have mine exposed to the internet, I do think this is the simpliest way:

Have an additional DNS resolver capable of overriding your outbound request to your server to loop back instead. I’m not sure what you’ll need to do different if you’re using a domain for your certificate, you could likely add your local IPs to your DNS return. But using domains allows you to wildcard your DNS override to catch all connections you may have using subdomains

E: if anyone could let me know if they see this comment, it seems my instance is having issues federating

I ran into a similar issue when visiting some family. Even though I was connected to home via VPN, my devices wouldn’t pull servers by their IPs. Our networks were setup too similarly. I was able to fix it by editing my conf for the WG connection and added my static servers as allowed IPs. While still having to self host a server for accounting at work, we did a similar split setup so they would be able to use RDP to their desktops but all other traffic was ignored and handled locally. This forum post has pretty good, short explanation with some example config scenarios https://forum.mikrotik.com/t/wireguard-allowed-ips-unofficial-wireguard-documentation/156426

I just use Avahi to use a .local domain when at home. That way felt easier. Also, I have separate bookmarks for “heimdall” and “heimdall-away” on my phone.

There are Wireguard clients that connect based on wifi / mobile status. On f-droid WG Tunnel, WG Auto Connect, or Rethink should do.