Just keep in mind that in order to generate certificates for letsencrypt, you will need a public domain (which you can remap internally) afterwards. Letsencrypt connects back to the instance from outside, so a valid public IP is needed (at least for a short time)