My plan to use Caddy as my reverse proxy in front of Sandstorm hit a wall. If I'm reading this Caddy forum post properly, Caddy expects to manage all client-facing TLS itself. That's a problem for me, because I don't want to change the certificate management for my existing Sandstorm instance.
If you use the default Sandstorm setup, you get your own sandcats.io subdomain. That's what I have, and I'm all but certain that I can get Caddy to manage my existing Sandstorm server behind another domain, but it would be complicated to have Caddy take over management of the existing sandcats.io subdomain.
Next, I considered using SNIProxy from the Sandstorm documentation here. But the SNIProxy project page lists the project as deprecated since December, 2023. That's frustrating, but the other options don't look great.
I see some newer projects that attempt to fill the same niche as SNIProxy, but I'm not sure how mature they are. This looks promising.