Generate and use a limited self-signed certificate. This is easier to setup than Let’s Encrypt certificates, but will cause warnings in browsers and due to being very basic won’t work with some applications.
your solution is fine though… but prefer sftp over ftp for added security. the s implies secure and is part of ssh, so if you have ssh installed on your linux server (and LXC containers or VM’s) anyhow, you may as well use sftp for performance and security advantage if that’s an issue for you. otherwise your workaround is fine. you may bump into some concurrency issues, so it may help to force both NC-A and NC-B to regularly scan fies.