Go for it, Ironfox is brilliant.

wireguard on the host

Ahh. Of course. I don’t know why I hadn’t thought of that.

Should I consider deploying a reverse proxy? I hear that setting one up can be painful.

I notice you have multiple reverse-proxy services under ‘networks’ - do you set up a separate network for each service?

Ahh. But what if you already used a VPN on the client for normal browsing etc - can you have two VPNs configured?

Apologies for the dumb noob question, but if your iOS device is VPNed to your home server, how does it access the open internet? Does it do this via the VPN?