A vpn of some sort will always be more secure and safer. Exposing it to the internet is a convenience that you have to weigh the benefits of against the reduced security. If you don’t need the convenience then don’t worry about the extra complexity it brings.

The main benefit I see for a RP is the convenience of friends or family to just have a public facing url without having to install anything to make use of something I’m hosting.

Some people just like having a valid ssl cert or a host name to visit instead of an IP. These can be accomplished in other ways but a RP can make it easier.

In my use case I use a RP with authelia to require a password to some services, then maxmind geo filtering to limit where people can access from, and for some services the RP is set to only allow traffic from inside my network.

I’m not sure about the portainer specifics but essentially yes. The VM running docker will need the storage and then each container will need a volume mounted to them from the host. In terms of where the media is inevitably stored, that volume can be mounted by multiple containers so they can all see it and do what they need to.

Some people put it on crackers but when I was growing up we always put it in the bugles chips.

That is also why I always thought people who pretended to have witch nails by wearing bugles were weird, I was always like “why would you put cheese all over your fingers…”.

I’m using an nginx reverse proxy with maxminddb for geo filtering. I have it limited to my state instead of country. If I could reliably go more specific I would. I really only rely on external access to the reverse proxy for family. I could use a vpn myself but I’m not bothering with the inevitable and endless questions from family.

I don’t know if it’s realistic or not but I would love to use a client certificate to authenticate with the reverse proxy but I’m not sure of the compatibility with mobile devices or smart TVs. If it would work even a self signed cert that’s valid for years would be a nice layer.