Add use case: Run a Private Reverse Proxy with LEGO

src/components/NavigationDocs.jsx

@@ -1006,6 +1006,10 @@ export const docsNavigation = [
                         title: 'Private Proxy Without Inbound Ports',
                         href: '/use-cases/security/private-no-inbound',
                     },
+                    {
+                        title: 'Private Proxy with LEGO',
+                        href: '/use-cases/security/private-proxy-with-lego',
+                    },
                 ],
             },
             { title: 'Homelab', href: '/use-cases/homelab' },

src/pages/use-cases/security/index.mdx

@@ -35,6 +35,11 @@ NetBird is built on zero trust principles:
             name: 'Private Proxy Without Inbound Ports',
             description: 'Publish internal services through a reverse proxy with no public inbound ports',
         },
+        {
+            href: '/use-cases/security/private-proxy-with-lego',
+            name: 'Private Proxy with LEGO',
+            description: 'Full Docker Compose walkthrough: wildcard certificates over DNS-01 with LEGO and automated renewal',
+        },
         {
             href: '/manage/access-control/posture-checks',
             name: 'Posture Checks',

src/pages/use-cases/security/private-no-inbound.mdx

@@ -78,6 +78,7 @@ curl -v https://app.proxy.example.com/
 
 ## Related
 
+- [NetBird Reverse Proxy with LEGO DNS Challenge](/use-cases/security/private-proxy-with-lego) — a complete Docker Compose walkthrough of this pattern with LEGO, a wildcard certificate directory, and automated renewal.
 - [Bring Your Own Proxy](/manage/reverse-proxy/bring-your-own-proxy) — full BYOP setup and the account-scoped proxy token.
 - [TLS certificate configuration](/manage/reverse-proxy#tls-certificate-configuration) — all certificate modes (ACME, static, wildcard).
 - [NetBird-Only Access](/manage/reverse-proxy/authentication#net-bird-only-access-private-services) — restrict services to your NetBird network.