In addition to that: I am pretty sure the script assumes an unconfigured system, “stealing” ports 443 and 80, and completely messing up container and volume names (if any volumes are actually used).

As far as I know I think the only not messy solution is setting up a VM and let Lemmy do whatever it wants there and expose only one port mapped to whatever inside-VM port is needed and use my reverse proxy to forward requests on the dedicated subdomain to that VM.