My impression of Starfield (after release, at least) was, that it was a bunch of pretty well intended and implemented subsystems (as is, to my knowledge quite common in game development; each team works on a different one), but they just don’t fit really well together. All the subsystems are good parts of a theoretically good overall big picture, but the complexity seemed too high for them to actually flesh out the big picture.

Technically it all works, but IMO you feel the conceptual gaps whenever you transition (UX wise) from one gameplay mechanic to the next. It just doesn’t (or didn’t) feel like a cohesive game.

No, since at the moment it wants to manage certificates, but I don’t intend to run pangolin as my main reverse proxy.

Pangolin is the most user friendly self hosted alternative to Cloudflare tunnels. There are dozens alternatives, but none with that feature set and such a UI.

I talk fully about software. Add appropriate nftable rules to the container network and that’s it.

Well, a big advantage of containers is, that you can isolate them pretty aggressively. So if you run a container that is supposed to serve content on a single HTTP port, expose only that port, mount no unnecessary volumes and run it on a network that blocks all outgoing traffic. Ideally the only thing left will be incoming traffic on the one port the service is supposed to serve.