I have both a Hetzner root server (it’s nicely beefy) where I host all my public stuff (website, api’s, Lemmy instance etc) and my homelab which is more personal media (Plex, 'arrs, Gitlab, wireguard, dydns)
The Hetzner box is configured using NixOS (config).
Homelab is mostly configured with docker compose, though I have plans to switch over to nixos to nail down the config. I am using cloudflare for my dns and created a smol cli tool to update a record there with my public ip address (homemade dydns). This is used by Wireguard to give me access to everything hosted there. Even though everything is hidden away from the Internet I still have https on everything thanks to dns verification.
(hastially typed up over breakfast so it may be a tad disorganised, feel free to ask any question if ye have any)