Might I suggest Fast Reverse Proxy ( https://github.com/fatedier/frp )

It’s a great solution if you don’t have a public IP or can’t/don’t want to open any ports.

I found it super easy to setup and configure. I put caddy in front of the server side for mine to ssl offload there. But you could also route everything down the tunnel it makes and use a local reverse proxy to handle SSL offloading

I also use .lan I used to use .local for years until I started to have conflict issues with .local resolution on Android when they started using mdns