Local SSL for Services, Sanity Check

I am in the process of setting up SSL for access to most of my Local/VPN only containers. This is mostly for for bitwarden on iOS autofill, but has some other benefits. Does my current setup sound correct? any flaws or did I overkill it? Some notes up front:

1. Due to cash limits currently I am unable to upgrade my router, so I am on xfinity X1 router atm.
2. I do have preexisting NPM, DNS and external services, up to this point I have only been using unraids IP to access the LOCAL containers.

—

1. Added an API Token in Cloudflair
   1. Permission: Zone DNS
   2. Resource: Specific Zone "mydomain.com"
2. Installed Pi-Hole on Unraid adding FTLCONF_dns_listeningMode=all, FTLCONF_webserver_api_password="strongPassword", and FTLCONF_misc_dnsmasq_lines=address/internal.mydomain.com. I also had to use br0 with static IP since port 53 is reserved for VM's (maybe?).
3. NPM I had already and use to serve a couple of other services. I added a Cert using the API from Cloudflair and used *.internal.mydomain.com
   1. Added an An Access List with only my tailnet and local IP
   2. added a proxy host "app.internal.mydomain.com" assigned the cert and saved and Access List. This part I got worried
4. Unraid Directly
   1. I added a static DNS and 1st is pihole IP first, then 2 others.
   2. I had to enable Host Access to Custom Networks. So Tailscale could see pi-hole. So it could resolve the "app.internal.mydomain.com" through it, with an exit node enabled.
5. Tailscale
   1. Added a Split DNS to tailscale with pi-hole IP nameserver and restricted to "internal.mydomain.com"