SSO/OIDC vs forward-auth with authelia 2fa

So I currently have a homelab with some apps (Opencloud, Immich, homeassistant, etc) behind caddy. I dont have split-horizon DNS, but I access those apps on *.lan (eg opencloud.lan) locally or over VPN. For remote access I have now setup my domain (eg home.mydomain.com) behind another caddy with authelia forward-auth. So Authelia does 2FA login on auth.home.mydomain.com, and then redirects to the service. One issue is I get another (second) login screen of the service after loggin in with authelia. Another problem is is that APPS usually don't play well with forward auth, eg, the immich app doesn't like to be redirected to auth.home.mydomain.com when it tries to connect to immich.home.mydomain.com. Same for webdav (I use that for keepassium / obsidian with opencloud). So, for now I can only access those services/apps over VPN with opencloud.lan etc.

I would consider this setup secure. No service is directly internet-facing. You either need to login with Authelia (the only internet-facing service) or be connected with VPN.

I do would like to consolidate the setup to split-horizon DNS. So I access *.home.mydomain.com from internal AND external and drop the *.lan caddy. At the same time I would setup OIDC / SSO so I won't be presented with double-login-screens. Anyone experience with this? A drawback in my opinion is that all the services would be directly internet facing, so if there is a zero-day in for example immich or opencloud login screen, the network might be compromised, and reading things like this: https://www.reddit.com/r/immich/comments/1t8wupz/oidc_is_nonexistent_and_docs_are_misleading/ already makes me weary…

Another setup idea I've come up with is to do split-horizon DNS, but just bypass Authelia completely over LAN/VPN. This would still require 'apps' to connect over VPN, and not solve the double-login-screen issue. But at least it would consolidate the domains (everything on mydomain.com) and be secure (IMO). Eg as Caddyfile:

remote_ip 192.168.1.0/24 10.1.8.0/24 handle @trusted { reverse_proxy 192.168.1.6:8123 } handle { ..... } # Authelia } 

Anyone running similar setup or have insights? Thanks!