I’ve always felt like this is an area with a huge gap. I’ve got my own fragile, cobbled-together bullshit that works for me, but it’s far from ideal or reliable if I’m being honest. I do love Ansible’s general idea of relying on standard, always-ish available protocols like ssh as a universal connection method, and I think it could work well as the bulletproof lower layer when you want to use direct control over the CLI tools and configuration files, like what git provides for anything requiring version control, but ansible needs a slick management interface like github/forgejo provides on top of git, to fill in the higher level UI for when you need a wider scope to get an overview of what’s going on or to make general configuration changes without needing to get your hands dirty. Ideally it would look a lot like Proxmox itself does, just, not specific to Proxmox. Like if I want to add my Steam Deck, and I’ve got ssh enabled on it and it’s not asleep, it should be able to ansible its way in there somehow to at least get whatever basic details it can. Maybe that’s only basic system information at first, but from there I could work on customizing it. That’s what I would consider the ideal, for me at least.

Yes, all three are supported configurations. Technically all four, since “I don’t know” is apparently a completely valid and functional configuration too.

I’ll add a vote to all the people suggesting Yunohost. Yunohost is a perfect place to get your feet wet with basically no experience required. I’ve played with it myself and it does a good job of simplifying and holding your hand without oversimplifying or keeping you on a strict, tight leash. It even helps you deal with common newbie issues like dynamic IPs so you can become more reliably available on the internet, something that a lot of other guides just assume you’re going to have a static IP assigned by your ISP or VPS and handwave away the complexity of what you’ll have to do if you have a dynamic IP like most home connections. (Experienced self-hosters gradually discover that having access to a static IP somewhere, anywhere, makes life a lot easier, but don’t worry, you’ll get there too eventually, it’s not important when getting started)

You can get started by working your way through the process here.

I’d recommend using conductive filament if you can or even just coating it with conductive paint before it touches anything electrically sensitive might do the trick. It doesn’t have to be a great conductor, just a tiny bit of conductivity will prevent any significant static charges from building up.

Ugh, I hate it when tools to “simplify” an already relatively simple process actually oversimplify it to the point of making it horribly complex to work around their “simplification”. A few points I’d like to answer from your post:

• Nginx-Proxy-Manager is dumb for, as far as I can see, not allowing you to follow the standardized method of answering challenges that supports any DNS provider and instead only seems to allow its “magic simplified process” that only works with select DNS providers
• https://dns.he.net/ is a nice free DNS service that you could use for your “keep domain at bluehost but use DNS servers elsewhere” strategy, and this is a totally valid and reasonable configuration – however, it apparently won’t help with Nginx-Proxy-Manager due to above stupidity
• This leaves your only DNS hosting service option as Cloudflare, as you correctly identified. This is a fine option but you know what they say about free services especially when they’ve got big for-profit companies behind them, if you’re not paying for the product, then you ARE the product, so beware of becoming vendor-locked and enshittified when they inevitably decide to try to monetize you somehow (if they’re not already doing so behind the scenes).
• Yes you can transfer your domain to a supported provider. This is kind of a “nuclear option” to get it to work with some shitty web-UI like Nginx-Proxy-Manager just because they’re too lazy to support actual standards or play nice with manual configurations, but it’s straightforward, albeit a little bit slow process (can take several days for things to switch over)
• There is no “renewal cost” for transferring a domain other than having to pay for 1 year minimum of the new provider’s normal annual registration costs. This gets added to your existing expiry, generally speaking, or your old time gets refunded, so either way you’re not losing anything, however things can get complex if you’ve only recently registered or renewed it, for example

If you’re very happy with Bluehost and want to stay there (I have no idea if they’re any good I’m not familiar with them but I will say charging $90 for an SSL certificate seems a bit absurd) then Cloudflare is probably the path of least resistance.

If you don’t mind transferring your domain and waiting for that process, that’s also a good approach.

But personally, I would drop Nginx-Proxy-Manager like a hot potato and work your way through setting up something like Caddy instead, doing mostly the same magic that NPM does (unfortunate acronym for anyone who’s more familiar with Node Package Manager) but using a very open and flexible system, supporting plugins for different providers to support DNS challenges for example

One final option that I’m going to throw out there, is if you intend on connecting your web server to the public internet anyway, and you’re able to live without a wildcard DNS (this just means it has to create a different certificate for each subdomain you add, not a big deal when a program is already managing them for you in my opinion) then you can just forget about the DNS challenge altogether and use a regular HTTP challenge. Again, fully standards compliant. Doesn’t matter what DNS or web server you’re using. As long as it has an internet connection so it can talk to the encryption certificate server and verify that it is who it says it is, you’re good to go, no need for DNS keys and such. Frankly I find the HTTP method just as simple if not simpler in most cases. Again, they’re oversimplifying to the point of making it more complex.

I have installed sunshine and moonlight on every computer I own and I use it so often I barely remember what computer I’m actually on anymore.