Best ways to learn pen testing / testing my security?

Most of my docker services run locally, stuff that nobody needs access to, but I do have some things that are just more useful to have exposed through my cloudflare domain. For example, Immich for easy photo / album sharing, Open Cloud for file sharing, Romm so that friends can play games, etc. I already have some basic precautions put into place, geofence for my country, basic rate limiting, crowdsec, and traefik (idk if traefik actually helps here or just routes stuff). Everything local I access through t