Yes my.subdomain.com works perfectly. and yes i changed the cloudflare dns to the same local ip as the my,subdomain and it is now working. i thought guac would be running on a different ip address to the cloudron machine

Indeed on Cloudron the app needs to specify which ports are forwarded from outside to the app container. Currently HA has no ports setup there.

We can easily add port 1400 for this, but it is not clear how this is protected by HA. Is this designed to be used in a trusted home network or fine to be exposed on the public?

Yes I think that would be the idea, maybe a free flow text input which binds the mentioned device(s) into the container. Similar to what we do for vaapi device access https://git.cloudron.io/platform/box/-/blob/master/src/docker.js?ref_type=heads#L409