the main problem i have isn't internal to my network, unfortunately, but that any call to my domain gets intercepted by cloudflare and sent to auth, which is good for security but kills API access to my services...

Yeah, but wireguard has two problems for me: I do not have install privileges on company devices, and even if I did, if they use a VPN to access company networks, doesn't that interfere with any VPN access to my home server?

You're right about the spotty support for Service Tokens, so far i could only find a planned inclusion in paperless, and maybe a cludge for homeassistant? a PR in Home Assistant Companion.

I've found a Reddit post recommending the usage of mTLS cert rules, but looking into that I just feel overwhelmed.

If you're using zsh, it's got a tool called zmv. edit: you have to activate ot by autoload zmv