Well yes, it is one hop, because you’ve got the router doing TLS termination. Inside your network you point to the server that has the TLS certs. Outside of the network you do port forwarding, or use a tunnel with cloudflare agents.
Why is the router involved at all? It’s all local traffic. The external traffic comes through the cloud flare tunnel, right? Maybe I’m not understanding the architecture you’ve got.
If you are establishing a TLS connection to a server, the server will need a certificate. It sounds like you’re trying to have two instances of a reverse proxy - one on the server, and one on the router. It may be my ignorance of the particulars, but my immediate thought is that you should select one point in the network to do reverse proxying.
This is exactly it. Instead of focusing on refining and renewing their products, Tesla burned billions on self-driving, while simultaneously hamstringing themselves by removing radar and lidar. That’s before the cybertruck and roadster 2 interfered.
Lucid, from what I can tell, has done this work. Their new motors are the size of a carryon. The interior volume is enormous. That’s what the flagships should be like at Tesla, but they screwed up.