You’re actually in a better starting position than most newcomers because the Cloudflare Tunnel setup means nothing on your box is directly reachable from the internet — that alone removes the biggest attack surface (port scanning, brute forcing, CVE-driven mass exploitation of exposed services). A few gaps worth closing:

Monitoring, since you asked: before installing anything fancy, get the boring fundamentals working: apt list --upgradable or unattended-upgrades for patch status, a cron that emails you ss -tlnp and docker ps diffs so you know when something new is listening, and disk/smart alerts — in my experience drives dying and cert renewals failing silently are far more likely to bite you than an attacker. Uptime Kuma is a low-effort next step for service-level checks, and with a Pi you already have around, a second machine doing checks of the first is more useful than monitoring from inside the box you’re monitoring.

Duplicati-specific note: it has a history of bugs where restore jobs fail or repository checks go wrong and you only find out at restore time. Whatever your retention, do one actual restore of a few files each month — a backup you’ve never restored is a hypothesis, not a backup.

One thing to think about: E2EE in Nextcloud only protects files you’ve explicitly marked; the database, photos in Immich, etc. are plaintext on disk. That’s fine, but be honest with yourself about what an attacker with the disk would get. Full-disk encryption plus a reboot-dropbear setup covers that gap if the data is sensitive.

Biggest real-world risk for your setup isn’t hackers: it’s misconfiguration during the next “quick change.” Snapshot (even a LVM/zfs snapshot or a docker commit before major container updates) and you can roll back instead of rebuilding.