Although I do have mine exposed to the internet, I do think this is the simpliest way:

Have an additional DNS resolver capable of overriding your outbound request to your server to loop back instead. I’m not sure what you’ll need to do different if you’re using a domain for your certificate, you could likely add your local IPs to your DNS return. But using domains allows you to wildcard your DNS override to catch all connections you may have using subdomains

E: if anyone could let me know if they see this comment, it seems my instance is having issues federating