I already commented on this twice here, but here it goes again: I self-host Immich with Caddy as TLS terminator, and it's far from obvious. They all run on a

I already commented on this twice here, but here it goes again: I self-host Immich with Caddy as TLS terminator, and it's far from obvious. They all run on a small N150 PC in my closet, the same PC serves as my internet router. Both Immich and Caddy run in podman-compose, and there are firewall rules that allow incoming traffic to Caddy and outgoing traffic from Caddy to update certificates. There's also a tricky setup of Systemd dependencies that make sure podman networking and firewall rules play nicely together and with other system config, like the bridge for the 2.4Gz range internal Wi-Fi and for external 5Gz Wi-Fi 6 card. If not for the LLM help, I would have spent many days figuring out all the rough edges of this setup. Which is exactly the point OP is making. Hobbying webhosting is hard nowadays.