4 subdomain vhosts proxying to local docker ports; SAN cert from fleet CA; workstation chain-verified (ssl_verify=0 all four). Detail: https://projects.knownelement.com/issues/697