Real HTTPS for self-hosted services, without opening a single port

Secure HTTPS for local services without opening ports: containers bind to localhost, Nginx Proxy Manager issues Let’s Encrypt certificates via DNS‑challenge, Ta