I managed this by getting a gTLD (digit-only .xyz is cheapest) for internal-only services and then running a Caddy instance to reverse-proxy to my internal serv

I managed this by getting a gTLD (digit-only .xyz is cheapest) for internal-only services and then running a Caddy instance to reverse-proxy to my internal services. I don't port forward or open ports to that Caddy instance, so it's not available externally.