nginx reverse proxy that just forward HTTPS traffic - docker

Question

From where we start
We have a web application myapp made of Docker containers. The 3 main containers are database, backend and reverse_proxy. The reverse_proxy runs NGINX with a conf like this:
server {
listen 443 ssl;
server_name myapp;
ssl_certificate /run/secrets/myapp.crt;
ssl_certificate_key /run/secrets/myapp.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5;
set $backend http://backend:8000;
# The backend HTTP api
location /api/ {
resolver 127.0.0.11;
proxy_pass $backend;
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_redirect off;
proxy_buffering off;
proxy_request_buffering off;
}
# The frontend Single Page Application
location / {
root /app/dist;
index index.html;
try_files $uri $uri/ /index.html;
}
location /static {
alias /app/static;
}
}
We run the containers with Docker Swarm (with volumes, secrets and default network), and everything is ok.
What we want to achieve
We have a Debian VM somewhere on the web that we want to use as a demo platform for multiple versions of myapp, for example 1.0.0, 1.1.0, and 1.2.0. We plan to run the 3 stacks with Docker Swarm, exposing a different ports for example 127.0.0.1:6000, 127.0.0.1:6001 and 127.0.0.1:6002.
Then we plan to run a reverse proxy for each of these stack, that would just forward the HTTPS traffic to the stack matching the URL, and serve an index.html file to point the available myapp version:
Docker container Docker Swarm secrets
main NGINX
+-------------------+ +-------------------------------+ +-----+
| | | stack for myapp 1.0.0 | | |
| URL=https://myapp.com/1.0.0/... 6000 | 443 HTTP |<-->| |
| | <----------------> | reverse_proxy <-> back <-> db | | |
| | HTTPS +-------------------------------+ | |
| | | | |
| | volumes | |
| | | |
| | | |
| | +-------------------------------+ | |
443 | | | stack for myapp 1.1.0 | | |
client <----->| URL=https://myapp.com/1.1.0/... 6001 | 443 HTTP |<-->| |
HTTPS | | <----------------> | reverse_proxy <-> back <-> db | | |
| | HTTPS +-------------------------------+ | |
| | | | |
| | volumes | |
| | | |
| | | |
| | +-------------------------------+ | |
| | | stack for myapp 1.2.0 | | |
| URL=https://myapp.com/1.2.0/... 6002 | 443 HTTP |<-->| |
| | <----------------> | reverse_proxy <-> back <-> db | | |
+-------------------+ HTTP +-------------------------------+ +-----+
|
volumes
Questions
Is the good approach/design/architecture?
Is it ok to have the 3 secondary reverse proxies in the Docker stack manage the SSL (encrypt/decrypt, know the certificate and private key), and the main reverse proxy to just forward the HTTPS traffic? If so, what would its config look like, is it documented?