ZFS comes from a plugin in OMV. You have to install omv-extras first, then install the plugin omvextras-zfs. Make sure you also install the proxmox kernel and reboot the server before installing zfs.

Some devices will prompt you to upgrade the firmware and won’t let you do it without internet access, AFTER you’re logged in to their platform.

Thanks for the great explanation.

So, currently, as I said, I’m using nginx proxy manager and do this:

• reverse proxy to all my services inside the internal network on http: *arr stuff, rss reader, jellyfin and some other minor things. All of them use name.local.home notation. I’m using a local DNS for this, of course.
• reverse proxy to just two services externally on https under wildcard certificates - both are non-standard names and the names are not related to the services themselves. For both these services I use Authelia with 2FA, so even if an attacker guesses the subdomain name, they’ll have to bypass that. As far as I can see in my logs, there are no attempts to breach my services. This is what I want to replicate and I’m planning on testing it.

On the other hand, You gave me a good idea about using *.lab.domain.com getting resolved by the local DNS and the main *.domain.com by my public DNS. I’ll give this a try too in the near future. Another plan for me is to start using Authentik, as I saw it’s a bit better than Authelia in some areas, even though it may be overkill for a little project - I’ll have to see.