Regarding certificates. I use Caddy for things like that. Even stuff that I don’t want publicly available. It is technically public, but relatively secure.

I use a combination of basic authentication plus a rate limit so the password cannot be brute forced. And then I have a bypass so that auth is not required on my home network. I think it works pretty well.