Second post I’ve seen mentioning watchtower… it quit being developed about a year ago and is read-only now. I quit recommending it since it’s not being actively developed any longer.

Awesome work and a good write up. I have a similar setup (opnsense inside of proxmox on a mini pc) at two locations and it’s awesome to pair with PBS and backup my router, clone it for any test case I have, and know I can just blow the rest away and still have my stable opnsense right there. Congrats!