If you are already messaging around with Dockers, check out NGINX Proxy Manager. It simples the NGINX stuff and gives you a nice interface. So if your make that docker with 8080 and 8443 exposed, in your router port forward 80 to 8080 and 443 to 8443. Then when you go to ramble.chat or plex.ramble.chat it will point to the proper service.

point plex.ramble.chat (cname) to ramble.chat in your registrar. Point ramble.chat (A record) to your public ip (dyndns if you don't have a static)

In NGINX you make a host, plex.ramble.chat and point that to where it lives in your network 10.0.10.5 port 32400 for example.

On the ssl tab, request new cert for plex.ramble.chat with let's encrypt.

Check all the boxes. Now when you go to https://Plex.ramble.chat it will take you to your Plex instance! I would do the same with overseer but not the *arrs. I do req.ramble.chat

Personally I use wireguard. A bit more involved to set up but slimmer IMO. When I put the app on my Android I barely noticed a battery hit with my always on VPN but I can hit my network anywhere from my phone.

Hope this helps!