Regarding Lets Encrypt you don’t your server doesn’t need to be accessible from the internet if you use the DNS-01 challenge. Caddy with the caddy-dns plugin for your provider can do that automatically for you.