I also have internal only traffic, but I still use let’s encrypt. I self signed for a couple of years, but switching to proper certificates made things much simpler and better. Especially on mobile. I use a combination of my own domain and caddy. and duckdns, since my domain registrar does not have an api caddy can use, but I can point my domain to my duckdns domain and it works 👍