for selfhosting stuff, I don’t see any requirements to be bare metal. the exception is the router/firewall. if you want to do software for that, then at least have a dumb all in one router as a spare when you inevitably break something and have family waiting on you to get the network back up. in an enterprise network, i would 100% keep networking physical. only keep physical server for applications that need every ounce of performance.

you have to set the setting to make it reverse proxy aware. swag is a nginx based reverse proxy with a lot of builtin configs for various services and customizations.

if you really don’t want anyone to access your topics, you can set default permissions to none and then manually allow per topic for each user (selfhosted ntfy)

if you’re using swag, you can just add to the ntfy container label, swag=enable if swag has auto-proxy enabled.