This is how I do it. It works internally and externally, though it's more than OP needs. :)

To add to what's been said (in case it's useful to others), it's worth looking at SWAG and Authelia to do the proxying for services visible to the Internet. I run them in a Docker container and it does all the proxying, takes care of the SSL certificate and auto-renews it, and adds MFA to the services you run that support it (all browsing, MFA-aware apps, etc).

Another thing I like about SWAG's setup is that you select which services/hostnames you want to expose, name them in the SUBDOMAINS environment variable in Docker (easy to remove one if you take a service down, for maintenance, etc), and then each has its own config file in Nginx's proxy-confs directory that does the https://name.domain -> http://IP:port redirection for that service (e.g. wordpress.subdomain.conf), assuming the traffic has met whatever MFA and geo-whitelisting stuff you have set up.

I also have Cloudflare protecting the traffic (proxying the domain's A record and the wildcard CNAME) to my public address, which adds another layer.

Ok that makes sense. I'm not trying to tie any of this to my external domain though, I just want to proxy Lan names at the moment.

I have a domain set up for home assistant though Cloudflare and I don't want anything else to be externally accessible.

So what I'm currently trying to do is have radarr.crypt, Sonarr.crypt, plex.crypt, openwrt.crypt hit the correct lanIP:port

I can't do that with just my DNS because that's just for lanIP not port

So I'm trying to have the *.crypt go to the Nginx IP and have that proxy the name to the IP and port.

I've been prodding it all day and even had ChatGPT have a go at it but I'm getting nowhere.

And this is why I don't like Nginx.

I have managed to get Nginx working and even got a pretty UI for it, but just can't get it to proxy my IP addresses to names.

It ain't a big deal, Heimdall does the job for now, just thought it would be a nice way to dip my toes in.