Do I need a separate Nginx and Certbot container for every site?

One Nginx reverse proxy can handle multiple sites. Publish ports 80 and 443 on that container, then configure a server block for each domain to proxy requests to the right service.

Put Nginx and the services it needs to reach on a shared Docker network. If the projects use separate Compose files, create an external network and attach the relevant containers to it. The backend services don't need host ports published just for Nginx to reach them.

You can also use one Certbot setup to manage certificates for the domains. Make sure Nginx can read the certificate files and gets reloaded after renewal so it picks up the updated certificates.

Separate proxies per project are possible, but they complicate port ownership on a single VPS. Only one container can normally bind a given host IP and port, so you'd still need something in front to route traffic or use different ports or IPs.

A shared proxy also means a configuration mistake or outage there can affect every site. That tradeoff may matter if you want the projects to be isolated.

If you're open to alternatives, Caddy can act as the shared reverse proxy and handle certificates too. Traefik is another option. Neither requires a separate proxy for every service, though sticking with Nginx is perfectly reasonable if you want to learn its configuration.

For several subdomains, a wildcard certificate is another option. It uses a DNS challenge to prove control of the domain, so it doesn't depend on routing an HTTP challenge to each site. You still need a renewal process and a way to get the renewed certificate into Nginx.