Caddy: enabling valid internal SSL certificates with ACME DNS challenge

This is a practical how-to guide showing how to provision valid SSL/TLS certificates for internal Docker services without exposing them to the internet by using Caddy's DNS ACME challenge (DigitalOcean DNS provider), a dnsmasq wildcard record, a custom-built Caddy Docker image including the digitalocean DNS module, and a docker-compose configuration to run and manage the reverse-proxy and certificates.