I use tailscale and dns authorized letsencrypt certs for "internal" services and it has worked pretty well.