> Furthermore, because it is self hosted there are several physical machines at different locations which serve as backups and are selected by updating the DNS

> Furthermore, because it is self hosted there are several physical machines at different locations which serve as backups and are selected by updating the DNS records, which I believe is incompatible with a basic lets encrypt system. There’s nothing incompatible. You just request and update certs on each machine separately, with certbot. No caddy or whatever new hotness of the year required.