Thanks for elaborating. Thats exactly my usecase. You can use lets encrypt certs with a dns challenge I believe. You wildcard a subdomain like *.abc.def.com

Then you set your services to e.g. homeassistant.abc.def.com both on proxy and local dns.

I believe you have to expose your ports once to get the cert and close them immediately. You set the domain to point to the public ip of your router, get the challenge done, close ports and the public domain goes nowhere.

Install the cert, point the local dns to your server ip, done.

If you need more info, let me know.