There is the passwd LDAP backend, not sure if it works for full auth though.

I’m aware that this isn’t how DNS works, but I’d imagine it is possible to have a DNS server that when it receives a query from the internet looks at the requested domain and translates it to an internal domain and in turn query that one, returning the result without revealing the internal domain. Something like a ALIAS virtual record provided by some services (but wont work against a internal DNS).

As for Traefik acting as a reverse proxy for internal network addresses, yeah that’s the way it works. However in this case I have several instances of Traefik running on a subset of IP-addresses on a public subnet. So essentially we want to loadbalance several Traefik loadbalancers using DNS.

Is it really a problem that they want to stay faithful to the original game? You say it yourself that FIRS is available as an option for people who want something more advanced to work with, along with all the other NewGRFs.

Is it possible to just run your own SIP-trunk? We’re not intending on sending or receiving calls from external numbers outside of our little network.

What do you mean by “a block of external phone numbers?” We’d like to simply have our own internal numbers ideally, nothing to connect to the regular phone network.