.localhost Domains

OP: If you're already using Caddy, why not just use a purchased domain (you can get some for a few dollars) with a DNS-01 challenge? This way you don't need to add self-signed certificates to your trust store and browsers/devices don't complain. You'll still keep your services private to your internal network, and Caddy will automatically keep all managed certificates renewed so there's no manual intervention once everything is set up.

> You'll still keep your services private to your internal network,

Is that a new thing? I heard previously that if you wanted to do DNS/domain for local network you had to expose the list external.

It's not, just a different way of satisfying the certificate challenge. Look into a DNS-01 challenge vs a HTTP-01 challenge. Let's Encrypt has a good breakdown: https://letsencrypt.org/docs/challenge-types/.

Gotcha and that lets us avoid to expose internals? that seems like a win win win, I should totally do this!