If you have an internal network with domain services, then you could host it with port forwarding enabled to enable certificate assignment, then close the port off after it communicates with letsencrypt. (I've done this with things like Vaultwarden/Bitwarden.)