I did something similar, though I've done a slight bifurcation-
*.i.domain.tld -> the actual internal host/IP (internal dns is adguard)
*.domain.tld all resolve internally using a DNS rewrite to a keepalived VIP that's shared between a few hosts serving caddy that handle automatic wildcard cert renewals / SSL / reverse proxy.
While I talk to things via *.domain.tld, a lot of my other services also talk to each other through this method - having some degree of reverse proxy HA was kinda necessary after introducing this sort of dependency.