I give all my services a proper subdomain so SSL works. But I keep all my services internal and run a pi.hole with DNS for my local services. (I use wireguard to vpn into my network to access everything).

If internet goes out, DNS to my local services still works fine since it is being served directly from my pi.hole.