all this reading about setting up kubernetes ingress controllers has led me to the conclusion that I should just set up internal services with nodeports and have an nginx load balancer outside the cluster that routes to the nodeports. Mostly because I don't want to pay extra for the built-in digitalocean load balancers.
and it turns out this is almost exactly the same setup we have at work (though with haproxy and AWS instead, and for different reasons unrelated to pricing)