Selfhosted

I know this is beyond the scope of your question but you are at a very similar place like i was over a year ago.

For the reverse proxy you want ingnx manager and it will handle all of your reverse proxies just fine.

But what i really want to recommend is to change up that debian into proxmox,

Proxmox is a debian based efficient server OS. Basically every service you run now can Easily be run as its own isolated container with very little overhang.

Best of all there is a community for Helper script that will install entire services including Nginx but even nextcloud from a single command.

https://community-scripts.github.io/ProxmoxVE/scripts?id=nginxproxymanager

There's Nginx proxy manager if you want to set it up. But I'd rather go with Tailscale instead.

Caddy

It’s three lines of configuration

jellyfin.example.com {
  reverse_proxy http://localhost:8083/
}

Automatic https with let’sencrypt, simplicity of a single binary, downgrade is as simple as replace binary & restart service.

I use Nginx Proxy Manager running as a docker container. Its a gui that makes administration more straight forward. It points at all my services (docker and otherwise) and handles the SSL for me. Because I don't want to have any ports open I use DNS challenge ACME and NPM has built in support for a number APIs from large public DNS providers to automate that.

Since your a beginner, youll find nginx proxy manager easiest, it has a nice ui, and at this stage you are probably less intrested in the 10/10 fastest lighweight setup and more intrested in getting stuff working.

Did traefik become uncool? I only read about caddy/nginx/ha here.

I prefer doing nginx on the host (vs a container), & have different configs for each service. You can have multiple services on the same port, it can be controlled via DNS instead (i.e.: access Jellyfin.domain.com & bitwarden.domain.com, both of 443).

Ive tried Caddy once or twice but couldn’t get it working, so i just stick with nginx & cert or to automatically get certificates from my internal CA

Reverse proxying was tricky for me, I started with Nginx Proxy Manager and it started out fine, was able to reverse proxy my services in the staging phase however, once I tried to get production SSL/TLS certificates it kept running into errors (this was a while ago I can’t remember exactly) so that pushed me to SWAG and swag worked great! Reverse proxying was straight forward, SSL/TLS certificates worked well however, overall it felt slow, so now I’m using Traefik and so far have no complaints.

It’s honestly whatever works for you and what you prefer having.

Nginx Proxy Manager was easy to learn as a beginner. I'd recommend it as a learning tool, if nothing else, and if you want to switch to other solutions later you can.

IMO, look into the linuxserver.io fork of NGINX, called SWAG.

It comes preloaded with a bunch of fantastic addons for security.

Quite easy to get set up, if you've got an idea about how it works.

I recommend Caddy. It's very easy to deploy, and configuring it is a snap. This tutorial helped me out a bunch. There is a Docker version of Caddy, tho I have never used it. I figured, Caddy would do better installed on bare metal. I use Caddy in conjunction with Duckdns.org. Caddy also takes care of renewing your certs when it's time.

What is your goal, simplest to configure? industry standard? Secure options set by default? Do you need a gui or are you fine with config files?

A lot of people aren't big fans of Nginx Proxy Manager, which is separate from Nginx. But I like it. It's got a nice gui, and the part I really like is the letsencrypt ssl certs baked in. You can get a new one, for a new service with a click of a button, and it auto renews your certs, so you don't have to worry about it once it's set up.