Unless there is some new revolutionary tech, things like the ESP32 have no driving factor to become obsolete.
If you are relying on BT/WiFi/LoRa then there is a possibility of RF frequency regulations changing.

But it is already an overpowered device for the majority of its applications and it’s cheap

Wouldn’t it be better to have highly available storage for the git repo?
Something like Ceph, Minio, Seaweedfs, GarageFS etc.
Cause git is file system based.

my router and my reverse proxy (traefik) is able to receive the necessary SSL/TLS certificates however

From something like LetsEncrypt?
As an HTTP-01 Challenge? Not an DNS-01 challenge?
Http challenge means that port 80 is accessible from the public internet (because that’s how LE can confirm it can reach your server via the public DNS records, proof of server ownership).
DNS-01 is about proof of DNS record ownership, and doesn’t prove public internet access.

Also, what are you self hosting?
Does it really need to be publicly accessible? Or just accessible by you and people you trust?

You need to control a domain, so LE can verify you are the controller of the domain, then LE will issue you a certificate saying you are the controller of the domain.

For a wildcard LE cert, you need to use the DNS challenge method.
Essentially the ACME client (or certbot or whatever) will talk to LE and say “I want a DNS challenge for *.example.com”.
LE will reply “ok, your order number 69, and your challenge code is DEADBEEF”.
ACME then interacts with your public nameserver (or you have to do this manually) and add the challenge code as a txt record _acme-challenge.example.com. (I’ve been caught out by the fact LE uses Google DNS for resolution, and Google will only follow 1 level of NS records from the root authorative nameserver).
All the while, LE is checking for that record. When it finds the record, it mints a wildcard certificate.
ACME then periodically checks in with LE asking for order 69. Once LE has minted the cert, it will return it to acme.
And now you have a wildcard cert.

So, how to use it on a local domain?
Use a split horizon DNS method.
Ensure your DHCP is handing out a local DNS for resolving.
Configure that local DNS to then use 8.8.8.8 or whatever as it’s upstream.
Then load in static/override records to the local DNS.
Pihole can do this. OPNSense/pfSense can do this. Unifi can do some of this.

How does this work?
Any device on your network that wants to know the IP of example.example.com will ask it’s configured DNS - the local DNS that you have configured.
The local DNS will check it’s static assignments and go “yeh, example.example.com is 10.10.3.3”.
If you ask you local DNS for google.com, it won’t have a static assignment for it, so it will ask it’s upstream DNS, and return that result.
And it means you aren’t putting private IP spaces on public NS records.

Then you can load in your wildcard cert to 10.10.3.3, and you will have a trusted HTTPS connection.

Here is a list of LE clients that will automate LE certs.
https://letsencrypt.org/docs/client-options/

Have a read through and pick your desired flavour.
Dig into the docs of that flavour, and start playing around.

If it’s all HTTPS, consider using something like Nginx Proxy Manager (https://nginxproxymanager.com/) as a reverse proxy in front of your services and for managing the LE cert.
It’s super easy to use, has a decent GUI, and then it’s only 1 IP to point all DNS records to.

DNS and domains are just human-friendly IP addresses.

You only have 1 public IP address.
So, to access different services you need to use different ports.
Or run a service on a single port in front of the other services that can understand the connections and forward the connections to the actual services - known as a reverse proxy. In the case of http/https, there are plenty of reverse proxies that can direct requests based on all sorts of parameters, subdomains being one of them.

If you are just starting out, I’d recommend a docker compose stack and Nginx Proxy Manager.
Learning containers & docker makes everything easier.
NPM is a very easy to use reverse proxy with a nice GUI, so you don’t have to configure CertBot/ACME or learn the specific config language of Nginx.

If you are unsure of domains and all that, you can try it out for free.
Your computer has a hosts file (/etc/hosts on Linux, I think it’s in system32 on windows). This allows you to tell the computer “for the domain example.com use the IP 10.0.0.200” or whatever you want. You need a hosts file entry for each subdomain.
What this means is that you can run up a docker compose stack on your computer and point a bunch of sub domains to 127.0.0.1, use self-signed certs, and play around with nginx proxy manager and docker.
No money spent, no records published, no traffic leaving your computer.
Zero risk.

There are loads of tutorials out there on NPM and docker compose stacks. Probably some close to your specific requirements.

Some do?

https://www.itv.com/news/2024-11-20/why-is-the-use-of-anti-personnel-mines-in-ukraine-so-controversial

Some mines are designed to have a time limit on them and become inactive after a set period of time.

However, other mines can remain active and dangerous for many years after the conflict has ended.

According my linked article:

US officials says the mines they send Ukraine will be “non-persistent”, meaning they have an internal mechanism to shorten the lifespan of the trigger.

The mines are designed to become inert after a set period of time ranging from as little as four hours to two weeks, officials said.

They say the mines use an electrical fuse that requires a battery, and the mine becomes inert when the battery runs out.

The US intends for Kyiv to use the anti-personnel mines in the eastern part of the country, US officials said, where Russian troops have made slow and steady progress against Ukrainian defensive lines.

Ukraine has also made assurances they will try to limit the risk to civilians.

I do that, until some container has permissions issues.
I tinker, try and fix it, give up and use a volume. Or I fix it, but it never seems to be the same fix

I consider myself technically apt.

I was expecting a parcel from abroad so was expecting to have to pay customs.
Received an SMS that looked fairly legit, from a named SMS number that didn’t set off an alarm bell, asking for additional information. The only red flag that got me were some unusually personal questions, like date of birth. I was close to giving away a bunch of personal details.

Another one was a “your parking permit is about to expire”. We recently had permitted parking introduced, and I figured I’d messed something up. But thankfully I looked into that via the councils parking permit page, and knew I was months away from an expiry.

My parents received a “help, I’ve flushed my phone down the toilet and need a new one for work tomorrow. Sorry for the strange number, I’ve borrowed a friend’s phone. Can you send me $$$ to [account details] so I can get a new phone?” from a scammer pretending to be my sister.
Apparently they made it up to a “this is a new account number, are you sure this isn’t a scam?” prompt in their banking app when they finally decided to try and contact her. She immediately picked up and said “stop, it’s a scam”.

It doesn’t take much to make you vulnerable to social engineering.
An expectation of events and something that would normally red flag suddenly doesn’t seem suspicious.
An emotional manipulation, time pressure, all that stuff, and it’s easy to ignore red flags.

I always say “if you ever feel pressure, take a moment and analyse the situation”. Time pressure, emotional pressure. And analyse looking for anything that seems odd, then pick at that thread.

It’s a server with integrated UPS and KVM console.