Nice :)

Nice, ok hmm… sounds like you are using the router for internal DNS, did you set all the services to point at caddy?

Eg you could try a quick hack in hosts (assuming the caddy ip is 192.168.10.10)

192.168.10.10 grafana.domain.example
192.168.10.10 prometheus.domain.example
192.168.10.10 jellyfin.domain.example

And then navigate to one of the services over https

Main thing is all your internal DNS records need to point at caddy, and then it forwards to the real container IP

Not strictly required but could be worthwhile to get a dedicated internal dns server up… I use technitium, or there’s pi hole or a few other options …

If you are doing a dns challenge then You need to give caddy access to your domain to perform the dns challenge. Depending on domain provider that is easy or hard. It will briefly change some records that tells let’s encrypt you own the domain and then issue the cert

Or you can do http challenge, this requires you to manually configure your domain to point to a publicly accessible caddy endpoint which is probably not what you want, maybe there is a way to make it work through a cloud flare tunnel

Who is your domain provider?

Envoy is what i use, or squid is an option

DANE provides user friction…but as OP mentioned TLS doesn’t work

Maybe not apt…but sudo dnf install nix nix-daemon

Edit: which doesn’t answer your question about free runners… but can you trust them anyway? They are running a container afaik