I use traefik combined with crowdsec, there is a plugin for that. There is some pretty good tutorial (in german) on goneuland.de

I am hosting a NC container in docker with collabora behind traefik. Works nice, but collabora sometimes breaks due to updates (e.g. forbidden characters). NC itself is smooth though.

I have several services exposed and I am using cloudflare since I have starlink and traefik as reverse proxy paired with crowdsec via a plugin. Works nice. I have not tried exposing immich yet though, that can only be reached via VPN.