Short version, and Deebster’s got the shape right: use a DNS-01 challenge. You prove domain control with a TXT record instead of serving a file over HTTP, so the hostname never has to be reachable from the internet. That’s what gets you a real Let’s Encrypt cert for a LAN-only name.

Mine’s acme.sh issuing a wildcard for *.lan.michaelharley.net via my registrar’s DNS API (Porkbun), with a deploy hook dropping it where Caddy reads it. Caddy’s own Cloudflare plugin is simpler, I just already had acme.sh. Local DNS is a wildcard rewrite on my router.

Sorry about the managed post at first.

I’m new to the community so sorry about the basic question but is this type of post ok here? This is a blog post that I put on my site. Do we prefer to have the full post like this with the link or do we prefer to just have a link and intro?

KeePassXc and syncthing on Linux. KeePassDx and syncthing on Android.

I run Calibre-Web in Docker (linuxserver.io image) and read on a Kobo. My desktop Calibre library on my laptop is the source of truth; Syncthing replicates it to the server where Calibre-Web serves it, and the Kobo pulls books over Kobo Sync