I use all three.
CF tunnels to access generic apps I want public.
Tailscale to have remote access to my home network.
Wireguard tunnel going to a VPS for apps that I don't feel comfortable running through CF due to the bandwidth (Jellyfin, AzuraCast).
I totally could move everything that's on CF tunnels over to Wireguard, but I see no need to do it. Cloudflare is trustworthy enough and I like the additional protection it offers.
Other than Navidrome (which is probably your best option right now), I also use AzuraCast. It's essentially an internet radio playing my playlists 24/7 that I (or anyone, but I obviously don't just share it with strangers) can listen to from anywhere.
I've had great success with this script. It's a script that makes a Wireguard tunnel between your local network and the VPS, so no opening of ports at home needed. It's made for Oracle VPS though, but it'd probably work elsewhere too.
My current setup is this:
Cloudflare DNS -> Caddy (VPS) -> Wireguard tunnel -> NginxPM (Home) -> services
You can just have the Wireguard tunnel go straight to docker though.
Tailscale, and a Cloudflare Tunnel going to Nginx Proxy Manager. So all three, in a way.
Can't really go wrong with ext4 for filesystem.
Make a partition with fdisk, format it with mkfs. As for fstab make sure to mount it via either disk ID or UUID.
If you need details just Google it. There's a shitton of guides out there.
Yeah, that's the problem when something like that is free. It's better to always have backups.
I use my Oracle VPS just for Wireguard to bypass CGNAT. I wouldn't host anything important there.
Also one thing to consider is that running 3 Proxmox machines will allow you to use HA (High Availability). Meaning if one of your hosts go down, others can pick up the slack.
Just one node means everything depends on it.
Just 6 days now. It was going for 31 days before, but I did a reboot just to make sure everything works properly.