Traekif can reverse proxy just about anything include ssh.

That being said I don't. For stuff like ssh I connect with wireguard first then ssh. For stuff like immich I directly expose that behind traefik so I can share images with others. For stuff like vaultwarden I have that behind traefik but internal only so you need wireguard first then you connect to vaultwarden.local.domain.com

this is nginx / openresty config - upstream is just definition of server / bunch of servers if you do loadbalancing - you can specify load balancing strategies and stuff. Or when want to separate server layer from proxy layer.

stream {
  upstream something {
     server xxx:123;
     server yyy:321;
  }
  server {
     listen 666;
     proxy_pass something;
  }
}

https://docs.nginx.com/nginx/admin-guide/load-balancer/tcp-udp-load-balancer/

I use openresty with autossl, it renews certificates automatically. The only problem is maintaining subdomain allowance otherwise bots will ddos letsencrypt with random domain names, after some quota they will soft ban you for a week to create certificates for new domains / subdomains.