FYI, all the certs you generate are public record, so it might be a good idea to use a wildcard route in Caddy. That will make it only generates one cert, so no one can find your internal domain names. Especially if your Caddy instance is accessible from the Internet, and you’re expecting external connections not to be able to access domains with only internal DNS records

Yep!

That would probably work, until Plex decides to introduce another subscription tier on top of the lifetime license, and/or demand more money from its paying users. I could totally see them doing that

I’ll take it if you haven’t already given it away. This Plex change is not great for me, since I’m using remote access. I’ve got a Jellyfin server too, but I’m finding it less convenient for me, mostly for various nitpick reasons