Please help to configure HAProxy to serve certifficate on internal LAN too

ha11oga11o

Hello all,

please dont shoot me on sight, im one of those who kinda set up things by following tutorials and actually see things how they look like on screen. And English is not my native language either.

I setted up HAProxy with pfSense package for Nextcloud which works as VM at ip 192.168.1.214. It has self signed cert.
I created ACME with Porkbun as wildcard and all that works totally fine.

BUT i have big issue which i dont know how to solve. When im acessing by nextcloud.mydomain.xx in LOCAL LAN it serves page fine, but it uses self signed cert.

Will someone, please, by example show me how to create working rule which will force pfSense to serve 192.168.1.214 and all its translation or whatever exclusively outside? Bare in mind that 214 has to be able to lurk in 192.168.1.0/24 also, since data storage is served by NFS on TrueNas.

192.168.1.1 (pfSense IP),
192.168.1.214 (Nextcloud IP)

All works fine from outside, but from local LAN it bypase HAProxy, and serve nextcloud internal cert with correct domain name nextcloud.mydomain.xx . Well it seems that only bypas cert part since domain works. Somehow it resolve.

This is what dig command does from local lan:

;; ANSWER SECTION:
nextcloud.domain.xx. 3600    IN      A       192.168.1.1
nextcloud.domain.xx. 3600    IN      A       192.168.1.214

;; Query time: 0 msec
;; SERVER: 192.168.1.1#53(192.168.1.1) (UDP)
;; WHEN: Thu Oct 30 08:48:37 CET 2025
;; MSG SIZE  rcvd: 83

Main problem here is that Nextcloud app go stuck when we are on local network. It does not work since it gets different cert. It does not even ask do we want to accept it or not. Even if does it will be bit weird to do that every time we come home.

Many thnx in advance!