Everyone has an opinion, and at the end of the day, whatever works best for you is what you should stick with.
I like Traefik because you can mount /var/run/docker.sock:/var/run/docker.sock:ro
to Traefik, then it can read labels from containers, and automatically wire up new instances based on labels on them. I'm sure there's equivalent in other reverse proxy solutions, but as I said, it works for me and I like it.
I give that container my Cloudflare origin certificate, everything gets encrypted in transit to Cloudflare, and then Cloudflare handles all the SSL management for me, as well as provide extra layer of DDOS protection.
Yep! Basicall, they sit between you and your visitors as a reverse proxy. When you domain is accessed through their infrastructure (you set this up via DNS), they’ll sign SSL for you domains so you don’t need to worry about it. Using the origin certificate secures communication from your server to theirs, so there’s no point in the chain being left in the open. They’ll even do DDOS protection and some basic web application firewall for free as well.
Additionally, since they’re globally distributed, your website could have static content cached closer to your visitor, thereby giving a faster experience.
They’ve also added lots of great stuff to help with locking down remote access to your internal infrastructure. For example if I want to SSH into my homelab, I don’t have to expose my SSH globally, and when I try to access it, I get a browser pop up asking me to login to my SSO, and then grants access.
I really enjoy and recommend trying their free offering.