OPNsense is a gateway/firewall/DHCP/router my network looks like this
optical to Ethernet conversion (the isp’s things) -> opnsense box -> network switch -> all other device (including wifi APs)
all traffic gets routed thru the opnsense box as it is the gateway to my network, runs the ipv4 nat and DHCP server
router in their comment refers to the the one that actually touches the Internet
ram is really the limiting factor for most servers
if you’re gonna have less than 5 users on the services they’re probably not all going to be used at the same time so cpu usage will depend on which are being hit at the moment
none of the services you’ve listed are particularly heavy so you’ll be good for those and a bunch more no problem
no no internal: true mans the network is isolated from the outside and is irrelevant to needing port mapping or not, poet mapping is only needed to bring traffic into the docker virtual network
for my setup I have only one container with port mapping running traefik reverse proxying to my other sevices which use the external:true network because it is managed by the traefik docker compose file, in the traefik compose I do not say external: or internal:
so in socker compose external tetwork is a network created outside of that compose file, for example on setup I have traefik running in a container which defines the traefik network, in another compose file you can reference that network by name and mark it as external to connect containers to it
I’ve not set up a pixelfed instance before so I can’t help with the folder perms but I’d think they would work themselves out
lsof is a good tool would recommend it whenever something weird is happen, tho you gotta be root for it