I am hosting a NC container in docker with collabora behind traefik. Works nice, but collabora sometimes breaks due to updates (e.g. forbidden characters). NC itself is smooth though.

I have several services exposed and I am using cloudflare since I have starlink and traefik as reverse proxy paired with crowdsec via a plugin. Works nice. I have not tried exposing immich yet though, that can only be reached via VPN.