If you're looking to keep things neat, you can actually have Caddy itself renew all the certs, including the ones you aren't actually planning to use Caddy to serve.

Then, you can use the caddy-events-exec plugin to notify/reload other services that rely on the certs Caddy is managing. That keeps all your certificate management in a single place.

That said, headers are pretty easy to wrangle in Caddy, like, really really easy. It can handle your wildcard too with the caddy-dns/cloudflare module.

Getting Caddy with those two modules is as straightforward as ticking the boxes for those on the download page, or building it using the Caddy docker builder helper (see "Adding custom Caddy modules").

If you use Compose, you can even specify the Dockerfile inline now! Which I really love, it's very neat. My custom Caddy build looks like this:

networks:
  proxy:
    name: proxy

services:
  caddy:
    build:
      dockerfile_inline: |
        FROM caddy:2-builder AS builder
        RUN xcaddy build latest \
          --with github.com/caddy-dns/cloudflare \
          --with github.com/lucaslorentz/caddy-docker-proxy/v2
        FROM caddy:2
        COPY --from=builder /usr/bin/caddy /usr/bin/caddy
    restart: unless-stopped
    command: caddy docker-proxy --ingress-networks proxy
    ports:
      - 80:80/tcp
      - 443:443/tcp
    networks:
      - default
      - proxy
    volumes:
      - /var/run:/var/run
      - caddy:/data

The lucaslorentz/caddy-docker-proxy gives it capabilities similar to Traefik in terms of using container labels to dynamically proxy stuff that I put in the proxy network, so I don't even use a Caddyfile at all. Just docker compose build caddy and you're up to date.