Same here,

All I do on top of what you said is use Traefik for reverse proxy and let's encrypt.