Your split setup makes sense, but juggling Netbird DNS + reverse proxy ACLs + Cloudflare can get complex fast.

You might want to check out Syncloud — it’s a fully open source self-hosting platform that handles HTTPS, auth, and app installs (Nextcloud, Gogs, etc.) out of the box. Runs on any hardware and you don’t have to babysit configs. Could simplify the VPS side of things at least.