We've recently switched to a scheme where we run a Nginx reverse-proxy with LetsEncrypt. Everything is in docker containers.

Based on this:

https://medium.com/@pentacent/nginx-and-lets-encrypt-with-do...

Now, in our setup, everything is running on a different port, so it is easy to set up additional services all coming from the same hostname with the same IP address.