jwilder/nginx-proxy with lets encrypt docker compose with exposed port, works with jwilder/nginx-proxy and jrcs/letsencrypt-nginx-proxy-companion for SSL/TLS secure access. Runs on network bridge mode so that external containers can trigger action.

nginxproxy_docker_compose.yml

# Here external ports are set to 80 (http) and 443 (https with SSL/TLS).  
# Change this to a different port if you have a port mapping on your router 
# for external access.
#
# This should auto generate certificates and act as a proxy between containers 
# and the exposed port when the following is included in your app:
#    environment:
#      - VIRTUAL_HOST=nextcloud.example.com
#      - LETSENCRYPT_HOST=nextcloud.example.com
#
# Where nextcloud.example.com is the domain you have configured to direct to your IP
#
#  Also need to include seperate file in directory of this yml called uploadsize.conf with the contents:
# client_max_body_size 2G;
# This sets max size of the files nginx will handle.  Remove mount line from below if you want default 2M.


version: '2'

volumes:
  certs:
  confd:
  vhostd:
  nginxhtml:

# Volumes are generated here instead of bind mounts for tidyness.  Only nginx-proxy needs this data so no need to store it in the host filesystem

services:
  proxy:
    image: jwilder/nginx-proxy
    container_name: proxy
    ports:
      - 80:80
      - 443:443
    volumes:
      - /var/run/docker.sock:/tmp/docker.sock:ro
      - ./uploadsize.conf:/etc/nginx/conf.d/uploadsize.conf:ro
      - confd:/etc/nginx/conf.d
      - vhostd:/etc/nginx/vhost.d
      - nginxhtml:/usr/share/nginx/html
      - certs:/etc/nginx/certs:ro
    network_mode: bridge

  letsencrypt:
    image: jrcs/letsencrypt-nginx-proxy-companion
    container_name: letsencrypt-companion
    volumes_from:
      - proxy
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - certs:/etc/nginx/certs:rw
    network_mode: bridge