I agree with having the server run Proxmox like others have said. Check out these YouTube channels for helpful information/guides:

LearnLinuxTV

LawrenceSystems

CraftComputing

Makes sense. Trained on software engineers working that pattern for decades.

I just started playing with Dockhand and it looks like it has a built in update schedule mechanism. It’s fills a comparable role as Portainer, so maybe check that out.

I would make an FAQ. I think for getting tone it is important to know what things are hard facts, what things are more subjective preferences, and what’s things are “we had to make a choice between options with no clear ‘best’ option”.

Any reason you need to encrypt the host OS information? I would assume anything interesting would be in the VM and you could probably have the VM encrypt it’s own storage.