ACME.sh? I love that little tool.

Cert renewal via DNS-01, independent of any other services or ports. Set it up like 7 years ago and haven’t had to touch it since.