Question about Caddy Proxy Filters

Using hass.io (docker on ubuntu) and using the caddy plugin for remote access. I have caddy proxying several subdomains internally on my network that I don’t want accessible from the outside world. In order to have caddy proxy these, I needed to create cnames in my registrar pointing to my public IP.

All works well - but I don’t want these other subs externally accessible. I’d like to restrict to 192.168.1.x IPs which can be done with caddy via the filter syntax, but I can’t figure out the syntax when configuring via the caddy plugin in hass. for Example, I want to continue to allow ha.mydomain.com in from externally, but not plex.mydomain.com (only from 192.x.x.x addresses)

here is the caddy config https://caddyserver.com/docs/http.ipfilter, but it’s not JSON formatted and not sure how the configuration in HASS converts to the caddyfile.

Anyone else come across this?

thanks!