radar

You can, that would actually give you security. Not sure how many people do that. I assumed a straight reverse proxy without any auth

Reverse proxy doesn't really get you much security. If there is an application level issue a reverse proxy will not help

I use GNU pass synced through an internal Gitea. Have wireguard to sync remotely. Works pretty good, I would recommend not setting an expiration on the key, the git history keeps the old encryption anyways.