Caddy selective proxy based on network source

I'm most familiar with haproxy and nginx but wanted to try caddy out. I'm running caddy in docker and have it successfully working as a reverse proxy for all my other docker apps with entries in the config file like:

*.example.com, example.com { tls { dns cloudflare {env.CLOUDFLARE_API_TOKEN} resolvers 1.1.1.1 }

@test host test.example.com
handle @test {
    reverse_proxy test:8888
}

I'd like to start to allow external access via vpn to a few of the subdomains it proxies for to let family access a few services. I haven't tried tailscale yet and probably will, but most likely I'll just use wireguard on my opnsense box and have policy to only allow traffic to my app host on 443.

What's the best way to only proxy for traffic originating from the lan subnet and then pick the few subdomains that will also accept traffic from the tunnel IPs?

I might also add forward auth on top just for the experience if there's any recommendations there.