*TLS

You could just use a reverse proxy at the edge and Let’s encrypt certs. Caddy works with only a few lines of config.