Fifty pounds??? Yeah that’s not going to work with just front rack ears, even if the batteries were all the way to the front.

If it’s all internal (and you haven’t set up any extra firewall zones or rules) then you won’t need any firewall rules to allow it.

You should probably be able to just ping immich.homelab.internal right now, and make an http request and get something back too. Even if it’s an http error, that still means you’re talking to an http server successfully.

I haven’t used opnsense in years, and I’ve never used caddy, so I don’t know if the config is right, but it looks reasonable and the concepts are the same as what I’m used to.

Measure the screw holes and check them against other ears. They might be a fairly common pattern.

Also make sure that the ears will properly support the weight of the UPS. Lead-acid batteries are hefty. I can’t tell from a quick search how it’s supposed to be set up. It might need ears front and back. Or, you might find full rails.

If all else fails, get a rack shelf and just let it sit on it. Or get some scrap wood and/or steel and fabricate something.

Can’t get any simpler than the terminal, can you? I just paste links into the terminal after a yt-dlp command.

You don’t need an external domain. Use .internal as your tld and you can use whatever domain your want. jellyfin.homelab.internal, for example.

I own a domain and run my internal stuff under internal records. Part of the reason for doing it this way is I can use the DNS challenge for issuing LE certs to the internal services automatically.

And no a reverse proxy will not expose anything to the Internet, unless you also open the port in your firewall (and forward it in NAT if it’s on the lan and you use NAT).