Nineteen Subdomains, One Allowed IP

One DNS record, *.example.com, maps to a single IP address, 203.0.113.10. After establishing this record, no further DNS modifications are necessary to publish a service. A form in Nginx Proxy Manager (NPM) requires four inputs: the domain name, container name, container port, and a checkbox to request a certificate. Once the form is filled out, the service becomes accessible via HTTPS without any manual intervention, as Claude Code takes care of creating the compose file, network, proxy host, and certificate.

Nineteen such proxy hosts were generated using this method, each with distinct authentication methods ranging from real user accounts to single shared passwords, setup wizards, and no authentication at all.

The wildcard DNS record allows all names created under *.example.com to resolve immediately, eliminating any propagation delays. However, the certificates are not wildcard; they are issued individually for each hostname by Let's Encrypt. This results in a continuous renewal cycle for the certificates, keeping port 80 open on the firewall.

Any attempt to close port 80 would result in a silent failure, as the sites would continue to serve on port 443 using the existing certificates. A genuine wildcard certificate would close port 80, but this would require proxy write access to the DNS zone, which was not granted.

The network is created once, outside NPM, and is shared among all containers. Every service is declared to use this network. The NPM form allows specifying a container name and port, which is then reachable inside the shared network without exposing any ports to the host. Nginx proxies requests to the respective services without publishing any host ports.

The proxy gateway container, also on this network, serves as a central point for all inbound traffic to be routed through. It logs the client IP as the VPS's public address, masking its own identity. This setup ensures that all nineteen services are reachable from a single private network while keeping the actual firewall rules and access controls minimal.