You don't need public DNS. You can use whatever domain you want if you use your own DNS server (though you should use one you own, or something under the .internal TLD).
Likewise, you can issue whatever certs you want if you trust the CA.
But LE does support wildcard certs. You can get them with certbot or other tools.
Personally I use traefik, which has LE support built in. It automatically gets an individual cert for each service. If you use caddy, I'm sure it has something similar.
You're thinking of a theocracy.
But the UK has a state religion, the Church of England, but they're neither a theocracy nor an ethnostate.