My Cosmos Cloud server and where to go next

Goals

I’ve setup a Cosmos Cloud server at home to start better understanding self hosting/homelab/etc. Usual stuff. Goals were:

1. Can’t become a second job
2. Want to follow good security practices and not just blow my foot off because i’m ignorant
3. Expose it to the web so I learn about that as well.

Setup

I got it off the ground a few years ago and have been mostly happy. The stack is WAY overbuilt (and solves other needs), but looks something like:

NAS:
Ubiquiti NAS (7 bay thing)

Server:
MS-01 with 96gb of Ram and some yeston GPU running LTS Ubuntu (not even headless)

Router:
UDM SE (technically a lvl 3 switch as well, although i’ve barely touched that)

Domain Hosting:
Cloudflare

Usecase

It’s mostly hosting Jellyfin, Immich, Memos, Paperless, Metube, and some personal projects (mock up games and what not, just learning more about containers ideally).

I was very happy that it’s all HTTPS behind the cloudflare proxy and has mfa auth and what not on just about every endpoint. Lets me expose metube if I want and hit it up real quick to download something but keep it behind an account (not that i need this but yay proof of concept).

The one main issue i’ve run into has been that I CANNOT find a way to connect locally without it being http. There’s a toggle for insecure access over LAN in cosmos, but I’ve read/tried other ways like just putting a DNS entry in the router and had mixed success (often it works for a bit, then a cert fails, then it doesn’t, then it works again…etc). Love to fix it (since immich is almost useless without local connections as it can’t handle large files) but can live without it.

The other nagging point has been that there’s really only “Admin/User/Guest” rights in the Cosmos model, and it means that if I want something like Paperless exposed to one user, but not to another, i’m out of luck.

So What’s Next?

I’m trying to still live in the world of turnkey/not full config, but recognize i’m mostly at the edge of that. I assume Proxmox is on the horizon because it’s what everyone mentions, and being someone who likes functional programming I know i’ll take a stab at NixOS some day, but I’m expecting that to be a “several months, oh look a second job” thing. Podman has come up but I’m wary how far off the beaten path that’ll lead me. Would like to avoid “well just one more day with this compose and i’ll have it converted”

Really though I’d like to better understand the kinds of issues i’m already having. It’s wild to me that a fairly “beginner” stack like this has still lead me to tons of “huh that’s fucking weird, good luck” conversations, especially with the unsolved local access stuff. I’ve done some searching and found mixed resources on better understanding how to really look into your network traffic, and was hoping for some guidance on a good starting point.

Overall really just looking for recommendations on where to head next with my limited free time. I know reinstall the OS is probably near the top just so i get rid of some gremlins, but beyond that I’m kind of at a loss.