Technology

With Cloudflare tunnels, I found I could only authorise one top level domain (perhaps multiple is a paid feature, I'm not sure), but I found I could run a second cloudflared in docker to authorise the second.

If you're running VMs, you can probably use tunnels no problem, with Cloudflare routing to the appropriate domain.

If you're against Cloudflare, there should be no reason you can't have nginx grab all traffic then forward the request to your apache2 server based on the host name.

It doesn't matter what the 2 sites are using for your reverse proxy in the front. All you need to do is have a simple reverse proxy up front - I use HAProxy - that routes to one or the other VM's IP address and port for its server based on the hostname coming in. That way, Site1 will receive all the traffic for Site1 as if it had been contacted directly, and Site2 will receive all of its own traffic too.

The web servers all speak the same language - they're just forwarding on HTTP(S) requests, not communicating in any special way between each other.

I mean, if you already have nginx OR apache, you could set up a vhost with the other domain name and do a proxy_pass or similar thing to the other one?

They don't need to be the same host software, you'd just need to configure one of them to know how to route it to the other instance. It's just plain HTTP(s) after all.

Reverse proxying is a feature in both nginx and apache after all. Though I'd recommend using nginx for that.

I'll give you an example of my setup.

Every server has it's own instance of Nginx Proxy Manager (not needed, but helps with using docker networking), then every service I run on docker, I just use docker networks to talk to the rproxy.

My network is designed such that all my externally available services are on one server, so I just forward 80 & 443 to that.

For every other service (not on docker), I just use 127.0.0.1 + port.

For services on other servers on my LAN, I use Internal IP + port.