A reverse proxy can still be useful internally by allowing you to collect many different services under one name. It can greatly reduce your certificate management as well. I can’t think of much else you’d gain though.

But you don’t NEED one. I manage my home network without one, and I have two dozen machines, counting VMs. Gotta vpn to get to anything, except game servers and SMTP. Nothing wrong with that approach.

HAProxy is a reverse proxy.

In addition: NGINX is a webserver that can also work as a reverse proxy. That's how It'm using it most of the time. HAProxy and NGINX will do the job nicely and don't have too much overhead. Traefik on the other hand is an edge router and - IMHO - far more complex to configure. Especially for your usecase it's oversized, since it also does loadbalancing and a lot of other stuff, your setup already does sufficiently well.

I did avoid them for a long time. Once I started to figure out how to self certify for https NPM became very helpful. DNS challenge does not require you to open any ports. you need a domain that supports dns challenge, though. Pointing cname to local ip of reverse proxy. And some routers may require rebind protection entry for that domain. Afterward: https and nice names for all my local only services.