If you are doing a dns challenge then You need to give caddy access to your domain to perform the dns challenge. Depending on domain provider that is easy or hard. It will briefly change some records that tells let’s encrypt you own the domain and then issue the cert

Or you can do http challenge, this requires you to manually configure your domain to point to a publicly accessible caddy endpoint which is probably not what you want, maybe there is a way to make it work through a cloud flare tunnel

Who is your domain provider?

Envoy is what i use, or squid is an option

Referring to sqlite is “some database format” feels wrong

DANE provides user friction…but as OP mentioned TLS doesn’t work

Maybe not apt…but sudo dnf install nix nix-daemon

Edit: which doesn’t answer your question about free runners… but can you trust them anyway? They are running a container afaik