https://en.wikipedia.org/wiki/Reverse_proxy
If you use LetsEncrypt's DNS-01 challenge to setup the SSL automatically, you can even deploy valid working SSL for IPs in the private range (192.168.x.x, 10.x.x.x etc etc), allowing auto-deployment of SSL for private services on your LAN, not just publicly accessible/exposed IPs. You can get around port forwarding during initial letsencrypt setup with this too, as all happens via DNS providers public APIs.
> https://letsencrypt.org/docs/challenge-types/#dns-01-challen...
Caddy is really easy to deploy as a Docker instance as well. There are many, many ways to accomplish LetsEncyrypt with HA though! It's really just an example of a common generic reverse proxy problem - searching for "reverse proxy letsencrypt" will show you many other ways to do it too. If you are using Docker to host your services at small scale, there are some really clever options now that auto-configure Caddy and SSL via letsencrypt all just using docker compose: