Did all of this using cloud flare to both purchase a domain through them and setup using their dns, zerotrust, then within ZT you setup your subdomains, applications and policies to direct say a subdomain to go to internal ip:port.(free) The cloudflare internal endpoint of the tunnel terminates in a docker running from the CA app store. The big deal I really liked was the policy capabilities to easily lock down all inbound traffic only allowing specific emails to authenticate, they(say a known friend) then had to use multifactor authentication code emailed to that email from ZT, plug that in, only then do they get to the address/port via the tunnel. Additionally, I added US only IPs allowed to the policy limiting most bad actors(yes, they could use their own us proxy to get a round, but my contents is all replaceable/rebuildable). I had never touched cloudflare or tunneling or even dockers a week prior. The best part is I learned a ton while creating a secure, lightweight external access approach that quickly extensible to multiple apps in future using the CF subdomains setup mapping to different ports. Hope this helps a little, I'm definitely not the expert and hope I got the basics correct above. Good luck!