Reverse proxy doesn't really get you much security. If there is an application level issue a reverse proxy will not help

I use GNU pass synced through an internal Gitea. Have wireguard to sync remotely. Works pretty good, I would recommend not setting an expiration on the key, the git history keeps the old encryption anyways.

I game on Debian unstable daily. I don't have the newest hardware but most things work about as well as Windows

You can, that would actually give you security. Not sure how many people do that. I assumed a straight reverse proxy without any auth

Let me sing you a song boys of fire and flame

Come me boys and heave with me, let's get of this cursed sea

Give me a spade and I'll give you a hole