traefik works well with docker and doing both http and DNS acme proofs with many providers. tunnel, point DNS to tunnel, set up reverse proxy, first container is whoami, once that's reachable, configure traefix to give whoami a cert. rinse and repeat for each service. make it easy on yourself and also use a client cert so only a cert holder gets in. otherwise do a waf. I'm for hire BTW.