I posted this in a sibling thread, but it's also appropriate here.

I self-host Immich with Caddy, and it's complex, really.

Caddy runs in podman compose next to Immich, there are firewall rules to allow traffic in and out and proper dependencies in custom systemd units in case podman networking goes bust after firewall rules are reloaded and a readme that covers all that.

Exactly the point OP is making.