Put Caddy in front of everything as the reverse proxy. Automatic TLS certificates, clean subdomain routing, zero manual cert management. Every internal service gets its own address. One config file controls all the traffic.