Firstly, wildcards are convenient but they break your functionality of to which you are connecting which is half of what TLS does. That may or may not be important to you.
You are implying that https is supposed to be done by the individual server and not reverse proxy. Since otherwise you could not “authenticating the server”
Short answer, it should work as you describe, everything local, no need to expose anything.
More information is needed to help.
Its either the caddy setup, maybe proxmox internal networking? Or most likely DNS, its almost always DNS.
Its good practice to handle https on a reverse proxy. Also who actually does cert pinning?
My guess, auto updates for major versions is not good practice. Installations potentially corrupt and users come screaming to the project maintainers instead of searching the blame by themselfe.
forgejo defined the lifecycle for every version so just add a calendar entry for when the supports runs out and then update the 3 characters in the docker compose file.
Consumer Hardware has feature enterprise/datacenter Hardware does not have and the otherway around.
High End Consumer CPUs for example clock way higher and therefore have better single core performance, which can be a benefit.
Non ECC memory and overclocked memory like on Consumer Hardware is often faster, especially when you compare price to performance.
Especially when things like a minecraft server is not optimized for a 128-core CPU or even 32-core CPU.