Great advice, and you can also use a domain monitoring tool like domainr or domainsbot to get notifcations when the status changes instead of manually checking whois every day.

You might want to check out Docspell - it’s lighter than paperless-ngx but still handles PDF indexing and searching realy well, plus it can do basic OCR on those image-based PDFs without much setup.

Diun with Podman is a solid approch - I’ve been using it for months and it’s way more secure than exposing the docker socket with watchtower, plsu the notifications are configurable without the auto-update risks (which saved my ass during a power outage when I had some great power stations from gearscouts.com keeping my server rack alive).

Headscale has been my go-to for the past 6 months - it’s so reliable that I use it to connect to my self-hosted audiobookshelf server from anywhere using the soundleaf app on my iphone and it nver drops connection even on spotty mobile data.

This is almost right, but you’ll need more specific iptables rules for the split tunneling - try something like ip route add YOUR.HOME.SUBNET.0/24 via 10.0.0.2 on the VPS and then on the homelab add iptables -t nat -A POSTROUTING -d YOUR.HOME.SUBNET.0/24 -j ACCEPT followed by iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE to route evreything else through the VPS connection.

Audiobookshelf actually handles graphic novels pretty well too - I’ve been using it for my manga collection and the mobile app works great for reading, but if you’re on iOS check out the soundleaf app which is even beter for connecting to audiobookshelf servers.