Stuff like this is why I moved my docker from unraid to a VM where I can use docker compose. Docker compose is really the only way to get a clean setup with complex stuff like this. That being said I recommend beginners use unraid. You don’t need a full vpn for torrents, a socks5 proxy will be fine and doesn’t require and special docker settings.
My setup uses traefik reverse proxy. Internal HTTPS (let’s encrypte wild card) and external HTTPS depending on what I want.
It uses authentik for single sign on and in this case provides LDAP for jellyfin and also provides web authentication for arr services.
The glutun container can be configured with any VPN and all services can only access the internet via the VPN.
My NAS is unraid, my docker host is a VM on proxmox. Media files are stored on HDDs on unraid and everything else is on on the docker SSD. Volumes are connected to where they need to be via NFS shares.
There are limits for cpu and ram so one container can’t bring everything down.
The containers themselves all communicate via their own docker network and only the reverse proxy (traefik) allows access to the UI.