I usually use HTTPS, because a lot of web features only work over HTTPS.

You can use Let’s Encrypt DNS challenges to get real TLS certificates for internal hosts, instead of having to use your own CA or self-signed certificates.

Don’t. Use a VPN like Tailscale or Wireguard. Tailscale uses the Wireguard protocol but it’s very easy to configure, and will automatically set up a peer-to-peer mesh network for you (each node on the VPN can directly reach any other node, without having to route through a central server).

The only things that should be exposed publicly are things that absolutely need to be - for example, parts of Home Assistant need to be publicly exposed if you use the Google Assistant or Alexa integrations, since Google and Amazon need to be able to reach it.