I completely agree with you and will take it even further.

I don't even futz with nginx anymore. You don't need to do that with tunnels. This assumes you have created a tunnel with required domain name. Very, very easy to setup.

1. Create container 2. Open Cloudflare ZeroTrust 3. Create a hostname for the new service or app; heim.example.com -> http://localhost:port 4. Save it. 5. Done. -> access the service from http://heim.example.com from anywhere in the world 5. For extra security, register the app in zerotrust with an email verification policy with emails you trust or use a token, or what ever auth you like.