I have a couple Aoostar R7’s (4x in a hyper-converged ceph+cloud-hypervisor+k0s cluster, but that’s overkill for most). They have been rock solid. They also have an n100 version with less storage expansion if you don’t need it. My nodes probably idle at about 20w fully loaded with drives (2x nvme, 1x sata SSD, 1x sata HDD). Running ~15 containers and a VM or 2. You should be able to easily get 1 (plus memory and drives) for $1000. Throw proxmox and/or some NAS OS on it and you’re good to go.

Caddy can do both. If you’re using a wildcard already, stick with it. In fact, I’d say it’s more prudent to use wildcards (with DNS challenges) than http challenges.Then you aren’t listing all of your domains in letsencrypt’s public database for everyone to see. Nobody needs to know you’ve got a site called bulwarksdirtyunderpants.bulwark.ninja