Traefik

A cheap VPS fronts everything: TLS, auth at the door, Crowdsec bouncing the scanners, then proxying over the overlay to services whose disks it can’t even see. Plus the TLS error whose message will not help you.

One Traefik per host, wildcard certs via DNS-01 with zero open ports, and routing declared as labels on the containers themselves. Plus three footguns, ranked by how many hours each took from me.