The API based challenges are better since you don’t even need to make the site externally accessible to get certificates.

Let’s encrypt and similar services support those and for popular registrars (aws, porkbun, etc,) here are existing plugins for caddy, swag (nginx proxy with built in cert support) and a few others.

I thought zerossl used let’s encrypt behind the scenes (for their free certs at least).

Edit: they don’t mention that on their website, perhaps they don’t.

To further simplify.

For step 1+2 , the router might have a built in DNS resolver which would eliminate the need to maintain another container or service.

For step 5, depending in the router software, with a single target (e.g. a nas running docker services) you might also be able to add a wildcard rule to catch any query for *.local.domain.com to resolve to that machine. This would simplify adding things in the future as the only thing remaining would be the caddy config.