I have a cname that points all *.domain.com requests to 127.0.0.1 — then I run a single instance of @traefik to handle HTTPS termination using letsencrypt. It routed the requested hostname to the container via a label on the container. Once it’s setup it’s pretty painless and kind of a “set and forget” type setup.