This is close to make my setup is as well, mine is all in docker though and with a treafik reverse proxy as the only entrypoint. To help minimize my security risk I have a few middlewares, crowdsec and geofilter. Everyone that requires access are all in one country so I drop all other connections.

I do have private and internal applications as well and use Netbird self-hosted over tailscale.

Also because docker networking can be a little permissive I updated the nftables to drop attempted requests to my local network.

I never heard of pangelin thanks for bringing my attention to it.