Think of the path the user go form their browser to your service as a children’s connect the dots game. They must go from their browser, to the internet, … eventually to your service, each step doing one thing to get closer to the service and back. Both Traefik and Nginx reverse proxy does the same thing, routing traffic from the entry point to your service, so you don’t need both.

I think the path currently might look something like this:

User -> Internet -> Cloudflare DNS (port 80/443) -> Cloudflare Tunnel (inside your network) -> Traefik (port 80/443) -> Service A

And now you want to add an extra route that goes something like:

User -> Internet -> Cloudflare DNS (port 80/443) -> Cloudflare Tunnel (inside your network) -> Nginx Reverse Proxy (can’t use port 80/443 because it’s taken by Traefik, so port XYZ but that costs a fee) -> Service B

If this understanding is correct, I’d recommend simplifying to just either Traefik or Nginx, as both does the same job of routing traffic from your entrypoint (Cloudflare tunnel) to your service.

For a Traefik based setup, you’d ideally put it on a bridged host network in docker, and have it listen there. Add individual service you’d want to expose (i.e. just the container of the web server for the app, not the database) to that network, and apply the appropriate container labels to expose it. It’d then be able to handle all the appropriate routing for you.

I don’t use Nginx, so I can’t touch on that, but I’d imagine similar setup in which you have Nginx listen to 80/443, then have it route the request to your service as needed based on whatever setup mechanism it uses.