Short version, and Deebster’s got the shape right: use a DNS-01 challenge. You prove domain control with a TXT record instead of serving a file over HTTP, so the hostname never has to be reachable from the internet. That’s what gets you a real Let’s Encrypt cert for a LAN-only name.

Mine’s acme.sh issuing a wildcard for *.lan.michaelharley.net via my registrar’s DNS API (Porkbun), with a deploy hook dropping it where Caddy reads it. Caddy’s own Cloudflare plugin is simpler, I just already had acme.sh. Local DNS is a wildcard rewrite on my router.

KeePassXc and syncthing on Linux. KeePassDx and syncthing on Android.

I run Calibre-Web in Docker (linuxserver.io image) and read on a Kobo. My desktop Calibre library on my laptop is the source of truth; Syncthing replicates it to the server where Calibre-Web serves it, and the Kobo pulls books over Kobo Sync