For instance how can I use my *.domain.com SSL certs and NPM to route containers to a subdomain without exposing them? The main domain is exposed.
You need a DNS service that works with Let’s encrypt
I don’t get it. Npm is a package manager. It doesn’t handle certificates.
You need a DNS service like route 53 (AWS) or similar where let’s encrypt connects via an API and creates the DNS token.
OP isn’t referring to the package manager. They’re talking about Nginx Proxy Manager