One front door, not six
Six services, and every client is expected to know all six hostnames. Each service grew its own copy of authentication, rate limiting and TLS — six copies, six chances to get it wrong, and a client that has to be redeployed every time a service moves.
Everything crossing from the outside world into your network is north-south traffic, and it should cross at one place.
Boundaries, outermost first: Private network: Orders (service), Billing (service), Users (service) Outside every boundary: Mobile app, Web app, an empty slot for the on the boundary Connections: Web app calls on the boundary — HTTPS (step 1) Mobile app calls on the boundary on the boundary calls Orders (step 2) on the boundary calls Users on the boundary calls Billing