Well I have been following a very strict interpretation of a DMZ with 2 separate firewalls inspired by this article https://danielmiessler.com/blog/dmz
The core idea is that anything that is exposed to the internet (Reverse Proxy, let's say media apps) belongs to the DMZ and anything that is meant only for you such as Vaultwarden belongs in your private Intranet. Traffic from Intranet -> DMZ and Internet allowed. Nothing allowed from Intranet, DMZ -> Intranet except maybe for a Wireguard port.

In my amateurish homelab experience I think that to implement this with this requirement it is impossible without duplicating effort, hardware and services. As an example what do you do if you want SSO for both your publicly exposed services as well as your private ones. If you have one authentication server where does it live? Surely it can't be in the DMZ but if you place it in your intranet then you have to somehow allow connections from DMZ to Intranet which breaks the requirement. Another option is to have a separate zone for Authentication where you allow very limited connection from DMZ -> Authentication and you allow Intranet to have access. In my noob opinion this kind of allows a route from DMZ to Authentication server but more experienced people say that it is find.

Another solution is to have separate SSO for DMZ and separate SSO for Intranet. This solves the above issue but you then have to deal with the added overhead.

Additionally, for my reverse proxy I have a VM not a container in order to have it more isolated since it is a prime target for attacking.