My "internal" (local hosts + server nodes) are on its own VPN with wireguard. Even with a VPN, I've letsencrypt provided certs on some of em because it's nice,

My "internal" (local hosts + server nodes) are on its own VPN with wireguard. Even with a VPN, I've letsencrypt provided certs on some of em because it's nice, but it's not strictly necessary. People being able to know that I've things running in my own /8 is not a major security problem.