I use Caddy V2. Configuration can be even simpler than the below. It automatically sorts out the SSL certs from Let’s Encrypt for you. If you use Cloudflare DNS challenge like I do, you can get SSL without the server having to be exposed to the internet.

cloud.example.com {
  encode zstd gzip
  tls {
    dns cloudflare {$CLOUDFLARE_API_TOKEN}
    resolvers 1.1.1.1 1.0.0.1
  }
  reverse_proxy nextcloud.my.local.domain:80
}

If you want it exposed then you can just use the default HTTP challenge.

cloud.example.com {
  encode zstd gzip
  reverse_proxy nextcloud.my.local.domain:80
}

And yes you can add any number of sites on subdomains like this and it will reverse proxy them to the correct server based on the domain name.