@sarah@sosial.link, I can recommend a Reverse Proxy like Traefik, which can automatically get a cert from LetsEncrypt without having an internet inbound connection. It can verify the domain with something like Cloudflare. My server at home is not reachable from the internet but has valid SSL. I built my whole homelab with this as foundation, so I can give a few pointers.