I’ve been quite happy after recently switching to Hagezi

Alot of useful info in this guide if your new to OPNsense.

If your running behind OPN/PFsense I’ve found the easiest solution for internal only SSL is to use the router to create the certificate chains. Yes you’ll have to import 1 CA cert on each end user device but only the one then you can crank out internal certs without and https warnings or domain constraints/challenges.

Alpine packages services like Gitea and Nextcloud which Debian does not. This makes keeping up to date alot simpler for myself but that’s personal preference.