You can't use Let's Encrypt for private DNS zones in the general case.

"Running your own CA" like it's a big ceremony is precisely what I'm saying ought not to be necessary.

Do you "run" your own random password generation service PaaS with custom Kubernetes controllers and everything? That's what someone else suggested, and not in jest!

But it's not really that much work. Disclaimer, I'm the author: 1) https://gruchalski.com/posts/2020-09-07-certificate-authorit..., 2) https://gruchalski.com/posts/2021-03-28-firebuild-rootfs-grp.... There are many options for various levels of entry.