Yes, I expose Home Assistant this way

I use nextdns as I can use that when mobile but if you want a local solution adguard home has DOH/DOT built in and a nicer interface than pihole IMHO

You will be behind CGNAT and a VPN will work yes but you will need to run a VPN client on each of your remote devices.

Adguard Home or pihole for starters.

Or run unbound and go straight to authoritative DNS servers.

Once you’ve chosen a VPN take a look at gluetun as a dockerised VPN gateway

I use Caddy and agree with your last point in the context of Crowdsec