I use Caddy with the Cloudflare DNS plugin for Let’s Encrypt DNS based challenges, should work for wildcard too but only have a couple subdomains so never tried to do that. My DNS entries are public but point at private IP ranges, e.g. nc.PRIVATEDOMAIN.COM resolves to 192.168.1.20 where Caddy sends the traffic to my Nextcloud docker