I host all my services as Docker containers on a VPS at NetCup. Among these, only one is exposed to the public: Caddy. Because of that, everything — UDP/TCP packets and HTTP(s) requests — is routed through Caddy, which either forwards the packets/requests to the appropriate container or serves static files directly.
To facilitate this setup, the Caddy container is configured to share a network with all service containers. However, for services requiring, e.g., a database (like NextCloud), the database remains inaccessible to Caddy. Instead, it is connected through a dedicated network shared exclusively between the service and the database container.