There are a ton of reverse proxy options that manage the cert for you

A reverse proxy is a trick? That’s like standard practice for web servers.

Tailscale would work as another user said. You could run TOR too. I’ve got a TOR service that I can SSH into for “plan b” if my VPN is down. It doesn’t need port forwarding.

https://nvd.nist.gov/vuln/detail/CVE-2025-34158

Maybe Picoshare

I’d recommend pihole->dnscrypt->mullvads DNS server.

Move the ports you are exposing from the qbit container to the wireguard container. The VPN container should be the only one exposing ports in this case.

But like someone else said, the gluetun image works really well for this.