I ended up going with tailscale. Every other option exposed my secret services to the Internet, even if behind a password. Tailscale was ridiculously easy to set up too. The docker compose I used had Heimdall in it too so I was able put all my links on there. Procedure is connect with tailscale app -> go to http://illegalshit -> click/tap on relevant link. I might pull back on my Nginx proxy targets and port forwards for this more secure system.
What happens if tailscale goes down though?
I looked at Epyc because I wanted to bandwidth to run u.2 drives at full speed and it wasn't until Epyc or Threadripper that you could get much more than 40 lanes in a single socket. I've got to find another way to saturate 10g and give up on 25g. My home automation is run on a Home Assistant Yellow and works perfectly, for what it does.