You say you run your containers rootless with systemd quadlets. Are you publishing the containerized apps’ ports to the host and reverse proxying your applications like that or have you somehow managed to attach your (presumably also containerized rootless reverse proxy) and your containers to the same network?

The latter is what I’m struggling with, so currently all my applications are in their own network that the reverse proxy is also connected to. But from what I’ve gathered, that means the proxy and each application need to share a network namespace which apparently isn’t possible in rootless mode unless all applications share the same network namespace.