Caddy

Cloudflare Tunnel with Docker: Publish an App Without Opening a Port

cloudflared makes an outbound-only connection to Cloudflare's edge, and Caddy reverse-proxies your apps behind it with automatic TLS — the exact compose files, and the DNS challenge trap that silently blocks new certificates.