I have a shortname.cc domain which I use for testing. This allows me to issue Let's Encrypt certificates for *.shortname.cc, which includes local.shortname.cc.

I have a shortname.cc domain which I use for testing. This allows me to issue Let's Encrypt certificates for *.shortname.cc, which includes local.shortname.cc. The internal DNS server masks the public one, so that I can assign local IPs at will, use HTTP or HTTPS at will, and when I'm outside of the network, the devices will contact the public DNS server and use the actual public IP of the network to access a limited set of servers (like ejabberd). These servers then stay accessible on the inside but through the local IPs, so that they don't have to leave the local network touching the edge router (which also solves some NAT issues on WebSocket connections).