It can happen that your internal services are still reachable from externally, by calling the external IP and setting the Host header manually to sub.mylan.home, even if that were pointing to an internal address. Traefik would only compare the Host header. To secure this you might also add an IP filter for the internal host, but I‘m not sure whether that’d be secure enough.

Sounds good. I think I’ll look into also switching from my Conbee II to a CC2652 based adapter, which might allow me to slowly transition from one system to the other with both adapters running in parallel.

In what ways is it really better? I‘ve switched from deconz to ZHA two years ago, and dread the reconnecting…

Go read the first few chapters of the Bobiverse series. First book: „We are legion“ This will answer your question in spectacular ways.