

Cheers to your journey so far, and to your continued success!
You can absolutely do free SSL certs with Let’s Encrypt without exposing your infrastructure to the internet. Just use DNS based validation instead of HTTP, copy the required TXT records to your domain as instructed, wait for any cache/TTL of any old records to expire (generally 1-2 hours by default), and finally complete the validation.
You’ll need to renew the certs every 3 months, which could be annoying if done manually. If your Registrar has a decent API, writing a script could be a fun automation project. Alternatively I can also send you scripts that I used to use for that purpose.
Happy to help!
You can find a bit more information at the URL below, and feel free to message me if you run into any issues getting it set up.
https://letsencrypt.org/docs/challenge-types/#dns-01-challenge