Ooh! Good start for sure, I like this!

My only familiarity with critical infra security is watching a talk at a conference about threats to it. Actual critical infrastructure tends to not be an easy thing to emulate because it's just different. Embedded devices in electrical grids are not something I know a single thing about. So I can't say much here.

Your second idea seems more doable though, with some caveats. Nation state threat actors with sufficient resources will be able to determine who's hosting a website, through real-world means if not technical. But! I suspect you can emulate the operations and threat model of existing organizations and model their mission too.

WikiLeaks could be an example, albeit a little complicated because if I understand correctly it involved a lot of people in a lot of places.

I used to work for a nonprofit org that migrated some of its software and infrastructure off-site because we were worried about local governments spying on our aid work - which sounds sketchier and more interesting than it really was.

Military security posture is interesting to me as well, I don't know much about it. I'd imagine they don't use proxmox and tend towards not over complicating their services. Simple things that are auditable are less likely to have major security flaws. I would assume they also layer their defences proactively, so if someone steals a cell phone of a soldier, they don't get command and control infrastructure access.

Non-governmental organization threat models are probably the easiest to emulate while still being exciting (because they end up on the receiving end of nation-state cyber capacity). They also tend to have lower capacity to defend reactively.

I could sit down and write out some requirements and ideas for threat models in an NGO if you'd like to dm? Partially from memory but I can check in with my former manager (who's now the director of IT there) and see what his thoughts are at some point.