Bump. I wanted to do such a thing with Traefik and my project Octobalena.
Creating a CNAME that points to device-hash.balena-devices.com produces a 404 since the Balena VPN is not forwarding traffic to anything without a Host: header equal to *.balena-devices.com or something of that nature, which cannot be discerned from my end. So as a result, I cannot pass traffic to my device via a CNAME and have a webserver/reverse proxy on the device directing that to different containers, would be an awesome thing to support.
Alternatively I can teach people how to use load balancers and bypass the Balena public url feature entirely if this can’t be supported, which would be a shame considering this is so close to being elegant as mentioned earlier!