Create 2 virtual machines.

One Virtual Machine with OpnSense Firewall, where you setup the ProtonVPN WireGuard connection.

One Virtual Machine with your Docker-VM.

Connect both machines via a virtual network, and setup the OpnSense-Firewall so that only internet-traffic through the WireGuard-Gateway is allowed.

That’s the most bullet proofed solution, as any connection of your Docker-VM is secured, independent of the VM’s configuration.

Where are you reading such things?

You can do what ever you want, as long as you stay in the limits (e.g. bandwidth) of your service and are not uploading any illegal content.

And of course: If you are privacy focused, always encrypt your backups.

Obsidian with Calendar + Tasks + DayPlanner + DataView + Templater.

Maybe the Calendar-functionality is a little bit weaker, but otherwise Obsidian is really powerful (and sometimes a little bit overwhelming, with everything you customize with the Plugin ecosystem behind)

I’m not a fan of the Nextcloud Client, so I just snyc the User-Directory of Nextcloud via Syncthing to my PC/Smartphone/etc.