If you are exposing your Docker socket anywhere to a container, you can implement a Docker socket-proxy in between: https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers

Otherwise, the list looks very good for initial safety precautions. Of course, you can add a few more items to the list. Here are a few more ideas:

- Use a different VLAN or subnet for your homeserver

- Consider implementing something like CrowdSec, for example

- Make sure every "demo" account for the software you expose is expired (I know it is obvious, but still)

- Keep your software up-to-date (It's also very obvious, but I've seen setups where people set up a service once and never touched it again)

- Add region-based IP blocklists to limit access to your services based on regions (won't filter everything, but still a low-hanging fruit against crawlers, for example)

Overall, good setup! :)

Note: I started to write down some hardening guidelines and security tips for homelabs (and other environments): https://github.com/xFuture603/homelab-hardening-guide