okay I think I figured out a solution for myself, so, INFODUMP TIME!
FIrst, some non-solutions:
mDNS won't work for two reasons: A, you can't get a TLS certificate for an mDNS name, and B, mDNS doesn't propagate over *any* VPN (OpenVPN, WireGuard, L2TP), and the whole point is that I want to run services that can be accessible to clients from wherever, including on the VPN