Hi Simon, I’m happy you find an alternative solution.
About DNS challenge you may remember this thread NS8 and DNS-01 wildcard certificates.
To invoke cluster-admin APIs from an external host this README could help ns8-core/core/api-server/README.md at main · NethServer/ns8-core · GitHub.