I kind of wish more device type things had IPv6 plus a letsencrypt client built in. DNS record + tell it it’s own hostname and you are good to go. 🙂 I do just pay for certicates for a few things too.