DNS domains for internal only with public ACME

[matt (Matt Holt)]

You can use the DNS challenge. It simply sets a DNS record then deletes it, no need to reach your server from the outside.

How to use DNS provider modules in Caddy 2

Caddy 2 uses a new and improved DNS provider interface for solving the ACME DNS challenge. All you have to do is plug the service provider(s) you need into your build, then add the DNS challenge to your configuration! Getting a DNS provider plugin How you choose to get a custom Caddy build is up to you; we’ll describe two common methods here. Method 1: Go to the Caddy download page. Find your DNS provider in the list of modules (dns.providers.*) and select it. Download your custom Caddy …

(Note that you’ll still need to make sure you configure your network / firewall to properly restrict access in the way you’re describing.)