Caddy.

HTTPS for services the internet can't reach

Let's Encrypt's usual challenge asks you to be publicly reachable. A home lab isn't. DNS-01 and a wildcard certificate solve it in one line of Caddy — plus the gotcha that breaks renewal without telling you.