On: Just want simple TLS for your .internal network?

[qwertox]

You don't need to publish the IP addresses publicly if you use an internal DNS server. I think even Pi-hole could do this.