If you have caddy as a reverse proxy inside podman user namespace separated networks, they don’t take the upstream client IP address and instead you get local IP addresses assigned to logs. Socket activation is kinda required if you want to get the client’s real IP address in your logs.

I use openSUSE MicroOS as the container host, with podman. It was a bit tricky to install it in my Hetzner VPS and get used to how MicroOS handles system updates (it’s an immutable system), but I am quite happy with it. I found it interesting and decided to try out so I could learn how to use the system.

With Encrypted Client Hello you can have some more privacy on obtaining certificates for wildcard domains, IIRC.