> use public DNS and Let's Encrypt garbageware and leak details of your internal network

Wildcard letsencrypt + internal DNS means you don't leak anything and you don't have to deal with the awkwardness of installing certificates.