Personal solution:

• Openssl certs (lots of youtube videos on best practice there).
• nginx reverse proxy manager
• adguard home using the dns rewrite pointing to the wildcard domain.

This is enough i find for intranet use. You can get fancy and put it over a wireguard or tailscale network too.

I have been experimenting with this recently. I just have tailscale pointing to adguard on a vm i use as an exit node and run nginx to handle the reverse proxy.

Tailscale can use relays if it cant find a way to make a p2p connection. Check the documentation. There is a command you can run to see whats using the relay.