https/TLS/SSL usually uses domain names for the certificates. Using local IPs or localhost therefore doesn’t really work.
You can create your own certs manually or let a reverse proxy like Traefik do it for you, but they are not trusted by the browser, so you would need to click “risk and accept” or import them locally.
If you do have a domain with a DNS provider, you can use LetsEncrypt to create certificates, with dnsChallenge the domain target IP doesn’t even have to be reachable on the Internet. But you need a DNS registrar that is supported by tools like certbot, lego or acme.sh. Then you can point you public DNS to your private IP (no one else can access it) or add it to your home router or hosts file.
When you want the Docker container only to be accessible on the node itself, you can use ports: 127.0.0.1:80:80 to only bind to localhost and expose the port.