You can use DNS01 for services not accessible from the outside. I use a caddy reverse proxy, with a wildcard cert for *.mydomain.com. caddy handles that for me automagically. Needed? Maybe not, but it’s a whole lot prettier, and I learned new things about certs and caddy :)

But… why? I mean, who’s targeting Arch? Sounds like the Arch team has some info that they won’t release (for now), but this is so confusing to me…