I’d rather have that risk than to screw myself over due to my own incompetence

Yup, that’s my reasoning too :D

Personally I stick with Bitwarden because one thing I want to stay around if I nuke (accidentally, or deliberately) my homelab is my password manager!

Yes this is how I do things. I run two instances of nginx proxy, one public facing and one private. External requests are routed to the public proxy and my local dns has CNAME records for all the domains my services run on forwarding to the internal proxy. That way I have a couple of subdomains exposed publicly (Plex, nextcloud and home assistant) through subdomains declared in my public name server and many, many more on the internal proxy whose domain records exist only on my local dns.