Thank you again for the response. The summary is very helpful too.

It looks like I don’t need the reverse proxy, since the sensitive services* support authentication and HTTPS.

I would need the lighttpd service to be available over unsecured HTTP too, but if that’s not possible I could always use a different subdomain.

• A small music and film library