Let's encrypt can issue certs without needing a public route to your machine if you use the dns challenge. Here's what I do:

1. Add a public A record (or host file) local.mydomain.tld to 127.0.0.1.

2. Host my dns with cloudflare (other providers have plugins too), and install the caddy plugin to do the dns challenge for certs.

3. Caddy can then get certs for local.mydomain.tld and serve them locally.