Firstly, wildcards are convenient but they break your functionality of to which you are connecting which is half of what TLS does. That may or may not be important to you.

You are implying that https is supposed to be done by the individual server and not reverse proxy. Since otherwise you could not “authenticating the server”

Short answer, it should work as you describe, everything local, no need to expose anything.

More information is needed to help.

Its either the caddy setup, maybe proxmox internal networking? Or most likely DNS, its almost always DNS.

Its good practice to handle https on a reverse proxy. Also who actually does cert pinning?

My guess, auto updates for major versions is not good practice. Installations potentially corrupt and users come screaming to the project maintainers instead of searching the blame by themselfe.

forgejo defined the lifecycle for every version so just add a calendar entry for when the supports runs out and then update the 3 characters in the docker compose file.

netbird uses wireguard as vpn protocol

It is always surprising to me that LEA can be competent and can work together internationally to take down really really bad crime like copyright infringement when big money is involved.

/s (not really)