Cloudflare tunnel is the simple answer here. Yourdomain.com points to the public instance, private.yourdomain.com points to the private instance. All you need to do is install cloudflared on any always on machine on your network and point the URLs to the internal IPs of the machines hosting the services.
The other suggestions here are fine but Cloudflare is the easiest solution to what you want plus it’s free and simple to setup and maintain.