1: not very hard actually, the hardest part is gettin the cert onto your other devices x3
all you need to do is add each subdomain to the cert, add ssl_certificate and ssl_certificate_key to the http block, then enable ssl for each subdomain, like so:

http {
    # cert
    ssl_certificate /etc/nginx/public.crt;
    ssl_certificate_key /etc/nginx/private.key;
    server {
        listen       12345:443 ssl;
        server_name  pi.hole;

        location / {
                proxy_pass http://localhost:80;
        }
    }
    server {
        listen       12345:443 ssl;
        server_name  fox.hole;

        location / {
                proxy_pass http://localhost:621;
        }
    }
}

2: correct, all traffic goes through nginx.

Hey there,

I have somewhat of a similar setup. I use Nginx Proxy Manager and AdGuard Homes rewrites to do the same thing as you.

As for Question 1: Creating self-signed certs is pretty straightforward. I followed this tutorial by Christian Lempa: https://youtu.be/VH4gXcvkmOY He also has a good writeup on his GitHub: https://github.com/ChristianLempa/cheat-sheets/blob/main/misc/ssl-certs.md How to import the certs into Nginx, I don’t know, but I think that’s easy to lookup online.

Regarding Question 2: My understanding is that all traffic goes through the Reverse Proxy.

I hope I could help, let me know if you have any more questions.