Personal solution:

• Openssl certs (lots of youtube videos on best practice there).
• nginx reverse proxy manager
• adguard using the dns rewirite pointing to the wildcard domain and il addresss pointing to the npm.

This is enough i find for intranet use. You can get fancy and put it over a wireguard or tailscale network too.