Hm, okay, so everything works now, I just need to think through the best system to avoid getting rate limited by Let's Encrypt if DNS for a domain isn't pointed at the server yet. XD

EDIT: looks like Caddy does have a feature for what I need but it's not enabled by default. I will look at the docs.