Question on Tailscale Access Control & Cloudflare DNS

I was watching this video over the weekend and I had some follow up questions. I've created the single Cloudflare DNS record for a `CNAME` record `*.mydomain.com` that points to my `caddy.*.ts.net` FQDN (still waiting for that change to actually be made).

The Caddyfile Alex used was

“`

# immich

immich.rdu.dotsandstuff.dev {

reverse_proxy http://10.42.0.42:2283

import cloudflare

}

# audiobookshelf

audiobooks.rdu.dotsandstuff.dev {

reverse_proxy http://10.42.0.42:2284

import cloudflare

}

# jellyfin

jellyfin.rdu.dotsandstuff.dev {

reverse_proxy http://10.42.0.42:2285

import cloudflare

}
“`

Does that one single Cloudflare DNS record handle all of these? Because in the video it only showed `*.rdu` and it pointed at Alex's caddy *.ts.net FQDN. Or do you need to create an individual CNAME record for each of these (by installing Tailscale on each Proxmox LXC container and pointing the correct FQDN at the service).

Additionally, I was looking into Access Control policies and I wanted to mess with blocking devices/people with specific tags from accessing services on my tailnet. Is that possible with the single CNAME record `*.mydomain.com` or would I need to create an individual CNAME record for each service and have Tailscale on each service?