dns challenge (for either internal or external TLS)

certman-prod.yaml

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
  namespace: cert-manager
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: <your email>

    privateKeySecretRef:
      name: letsencrypt-prod

    solvers:
    - selector: {}
      dns01:
        cloudflare:
          email: <your email>
          apiKeySecretRef:
            name: cloudflare-api-key
            key: key

httpproxy.yaml

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    ingress.kubernetes.io/force-ssl-redirect: "true"
    kubernetes.io/ingress.allow-http: "false"
    kubernetes.io/ingress.class: contour
    kubernetes.io/tls-acme: "true"
  name: registry
  namespace: kube-public
spec:
  rules:
  - host: registry.<fqdn>
    http:
      paths:
      - backend:
          serviceName: registry
          servicePort: 5000
  tls:
  - hosts:
    - registry.<fqdn>
    secretName: tls-registry
---
apiVersion: projectcontour.io/v1
kind: HTTPProxy
metadata:
  name: registry
  namespace: kube-public
spec:
  virtualhost:
    fqdn: registry.<fqdn>
    tls:
      secretName: tls-registry
  routes:
    - conditions:
      - prefix: /
      services:
        - name: registry
          port: 5000

notes

FQDN must be valid (home.lan won't work), but it does not have to be exposed to the outside world so long as internal hosts know the name (DNS or host file edits both work fine).
Check cert-manager docs for dns verifiers other than cloudflare.