This is the way.

I do this. PFsense DNS resolver, and have loopback enabled.

DNS for all the domains points at a reverse proxy (Caddy) that handles valid HTTPS termination. So all my services have valid HTTPS certs, and devices on my network can access them normally.

One of the largest problems for a neurodivergent people is neurotypicals misunderstanding how they communicate and assuming that they are being an asshole simply based on how neurotypical people communicate or miscommunicate with each other.

Not understanding or playing into the neurotypical communication method of constantly lying by way of direction and expecting others to read between the lines often comes off as being an asshole or worse if they assume that you have unmentioned motives.