You don’t have to expose Nginx publicly. It can exist privately on your network. I have my own domain and DNS server internally. For example nginx.home.datallboy.com and jellyfin.home.datallboy.com will resolve to NPM server at 192.168.1.10. Then nginx can listen for jellyfin.home.datallboy.com, and proxy those connections to my Jellyfin VM at 192.168.1.20.

Since I own my domain (datallboy.com), I let Nginx Proxy Manager do DNS challenge which is only used to authenticate that I own the domain. This will insert a TXT record on public DNS records for verification, and it can be removed afterwards. LetsEncrypt will then issue a certificate for https://jellyfin.home.datallboy.com which I can only access locally on my network since it only resolves to private IP addresses. The only thing “exposed” is that LetsEncrypt issued a certificate to your domain, which isn’t accessible to the internet anyways.

You do not have to create your own CA server.

LetsEncrypt provides free certificates. I would setup Nginx Proxy Manager and use DNS challenge with your dyndns provider to get HTTPS on your home services.

AMD is a better and newer card regardless. That would be my pick.

Proxmox, Nextcloud, and Jellyfin user here. My setup separates groups of services into their own VMs. Docker is just another way to package and deploy applications by simplifying the process.

So Nextcloud and Jellyfin get their own VMs, and I deploy the applications via Docker on the separate VMs. If you want to utilize Portainer, you can deploy an agent to each of these VMs.

Lightweight applications I typically deploy to separate LXC containers. Portainer, Pi-hole, NGINX would all get separate LXC containers. You can connect to the other VM Portainer agents from the LXC Portainer server.