No downside, it's just there to incentivize people to buy the product. They give the impression of a "good deal".

I'll watch and will likely enjoy it but I don't have any expectations it'll be like older episodes

ProtonVPN has been solid for me. Switched to wireguard recently and have been able to completely saturate my 1gbps fiber link

Nice, I happen to be on vacation this month. Should have lots of time to build the factory

I think the reason why its generally suggested to use a VPN is because it reduces the risk of intrusion to almost zero. Folks that are not network/sys admin savy would feel safer with the lowest risk solution. Using the port forward method, there could be configuration mistakes made which would unintentionally expose a different service or parts of their home network they don't want exposed. And then there's the possibility of application vulnerabilities which is less of an issue when only VPN users can access the application. That being said, I do expose some services via port forwarding but that's only because I'm comfortable with ensuring its secure.

Reverse proxy is really useful when you have more than one service to expose to the internet because you only have to expose one port. It also automates the certificate creation & simplifies firewall rules inside the home network

This is really all you need to get started. Assuming you have built caddy with the cloudflare dns module

{
    acme_dns cloudflare cloudflare_api_key
    email your@email.com
}
pihole.yourdomain.com {
    reverse_proxy http://192.168.0.4/
}

Your cloudflare API key needs this: "API Token: Zone.Zone:Read and Zone.DNS:Edit permissions for the domain(s) you're managing with Caddy"

One thing to mention, you probably want to configure the DNS settings on the caddy LXC to be something like 1.1.1.1 or 8.8.8.8 instead of pihole.

You have a typo. Its "acme_dns" not "dms"

test comment

There are some legitimate reasons to have a separate keyboard. I use Keepass2Android's keyboard to enter passwords from Keepass. This way, there's direct access to the password database instead of copying passwords/usernames/other fields to the system clipboard.

Now what's the difference between the 3 speeds?

I really could care less what it looks like. It just needs to be functional/practicle

Not quite sure what your issues are but you do have to make sure websocket proxying is configured if the app uses it https://www.nginx.com/blog/websocket-nginx/

I also switched over to Caddy about a year ago. Got tired of messing around with scripts to make letsencrypt work. Caddy has a lot of good defaults so you don't have to worry about setting the right headers or any websocket configurations. Its really just as simple as specifying the hostname & the reverse_proxy directive

Wow, that's a lot of CPU usage