Treat plain nginx and Nginx Proxy Manager as the same edge job with different control planes: one public listener pair on 80/443, Host-based routing to unpublished upstreams, and TLS terminated before any app container. With NPM, map each Proxy Host to the Compose service name and its internal listen port on a shared user-defined network; with raw nginx, do the same via proxy_pass to that service DNS. Leave app ports off the host publish list so a forgotten -p cannot skip TLS or access lists, and keep the NPM admin UI on localhost or an internal-only network reached over an SSH tunnel.

After the first host is live I confirm the leaf SAN matches the advertised name, force-SSL is a single redirect hop, and the upstream still sees the original Host plus X-Forwarded-Proto. A fresh 502 is almost always reachability from the proxy container to the service name or a typo’d internal port — curl the upstream by service DNS from inside the proxy container first, then the same path through the public hostname, and compare status and Location before blaming the app process.