You seem to have descibed your port forwards backwards It is the router forwarding the ports to the gateway pi (and potentially other devices), not gateway pi and other devices forwarding to the router. The forwards to servers are incoming from the internet.

(Theoretically you could have your pi physically between the router and the internet (modem) acting as a sort of pre-router, but this would be unusual. Perhaps you could describe your physical setup more clearly. What is physically/wirelessly connected to what, to the internet.)

I’m liking the simplicity of dockcheck

https://github.com/mag37/dockcheck

Use Caddy for reverse proxy. It’s magic. Just put in config the subdomain/domain and localhost port to point to, it will fetch and configure and keep certificates up to date with zero effort. You’ll forget certificates exist. It just works.