If your goal is to improve security you would have to look into e2e encryption. This means network traffic needs to be encrypted both between client and proxy as well as between proxy and service. You didn’t elaborate on your proxmox/network setup. I will assume that you have multiple proxmox hosts and external router perhaps with switch between them. Traffic this way flows between multiple devices.

Some solutions

• You could run another proxy on same VM as service just to encrypt traffic if service doesn’t support that. Then have your proxy connect to that proxy instead of service directly. This way unencrypted traffic doesn’t leave VM. Step up would be to use certificate validation. Step up from there would be to use internal certificate authority and issue certificates from there as well as validate using CA cert.
• Another alternative is to use overlay network between proxy and VM. There are bunch of different options. There are more advanced projects combining zero trust concepts like nebula.
• if you start building advanced overlay networks you may as well look at kubernetes as it streamlines deployment of both services and underlying infrastructure. You could deploy calico with wire guard network. Setup gets more complicated for simple home lab. All boils down to why you do self hosting. If it’s to learn tech then go for it all the way. If you want to focus on reliability and simplicity don’t overcomplicate things. Many people run everything on single node just running docker and docker networks between services to separate internal services from proxy traffic.