I have a similar setup, with a public domain hosted by cloudflare. Internally, I use caddy with the DNS feature pointing to the cloudflare using their API and letsencrypt certs.

Something like this: webenclave.com/…/setting-up-a-secure-local-networ…

I can also share more details, maybe my compose files and caddy setup if you need them.