You should also use a default self-signed cert for something generic like “localhost” on your reverse proxy so random IP scan don’t see any domain when they hit your IP, but legitimate queries coming through the domain name still see the right cert.

I had a hard time too when I first tried to get netbird going but reading the https://docs.netbird.io/manage/access-control section of the docs cleared things up, especially the part about not putting all your devices in the same group.