Right, i think we are talking about 2 different but very close things. Jet’s post is talking about a setup similar to mine, which is a wildcard certificate which LetsEncrypt only issue with a DNS-01 challenge, which, as you stated, requires the TXT record and not a text file on the server that the HTTP-01 challenge requires. Yes the HTTP-01 challenge would fail for an internal ip because letsencrypt wouldn’t be able to reach your site to check the acme challenge text file. But for sanity’s sake you can setup a wildcard cert for your homelab. Traefik makes it pretty painless and now you are not having to configure DNS records for your subdomains. For added security your A record on your dns can point to your internal IP address of your reverse proxy which gives everything routed through your proxy TLS but no-one outside your network can access it.