You don’t have to expose Nginx publicly. It can exist privately on your network. I have my own domain and DNS server internally. For example nginx.home.datallboy.com and jellyfin.home.datallboy.com will resolve to NPM server at 192.168.1.10. Then nginx can listen for jellyfin.home.datallboy.com, and proxy those connections to my Jellyfin VM at 192.168.1.20.

Since I own my domain (datallboy.com), I let Nginx Proxy Manager do DNS challenge which is only used to authenticate that I own the domain. This will insert a TXT record on public DNS records for verification, and it can be removed afterwards. LetsEncrypt will then issue a certificate for https://jellyfin.home.datallboy.com which I can only access locally on my network since it only resolves to private IP addresses. The only thing “exposed” is that LetsEncrypt issued a certificate to your domain, which isn’t accessible to the internet anyways.

You do not have to create your own CA server.

LetsEncrypt provides free certificates. I would setup Nginx Proxy Manager and use DNS challenge with your dyndns provider to get HTTPS on your home services.

It comes down to using secure passwords, 2 factor authentication, and updating software as soon as you can.

Check out Cloudflare’s zero tier tunnel to only expose the services you need without port forwarding. Added benefit of masking your home’s IP behind Cloudflare to prevent DDOS. Only downside is you need your own domain.

Get a dedicated NAS server with 3.5" drives for bulk storage. Used SAS drives on eBay are pretty cheap. Use iSCSI or NFS shares mounted to your bulk data directories for Nextcloud and Jellyfin. Buy some SSDs for local storage on the DL380 servers and use those as system disks for your VMs.

You could install Proxmox Backup Server on one of your nodes and backup the VM disks on SSD pool to the NAS and have a backup then.

Proxmox, Nextcloud, and Jellyfin user here. My setup separates groups of services into their own VMs. Docker is just another way to package and deploy applications by simplifying the process.

So Nextcloud and Jellyfin get their own VMs, and I deploy the applications via Docker on the separate VMs. If you want to utilize Portainer, you can deploy an agent to each of these VMs.

Lightweight applications I typically deploy to separate LXC containers. Portainer, Pi-hole, NGINX would all get separate LXC containers. You can connect to the other VM Portainer agents from the LXC Portainer server.