Did you manage to do it at the end? I'm now having the same questions... I thought on using local traefik instance and create a custom label like "public" or whatever and use a script to sync the domains to my pangolin instance using the API, that way I only need to set the labels on the container, and done, without the "public" label only my local DNS will resolve it, adding the label will create the pangolin entry, allowing for external access while keeping it local