I've solved the IP exposure issue with CNAME records and a local DNS server. So if I want to run a Plex server at example.com, I'll set plex.example.com to be a CNAME for plex.internal and just have the local DNS server resolve what IP address plex.internal is at. Easy way to get HTTPS addresses for internal IP addresses without having the IP address listed publicly.