I happened across this tool to help you create configs, it looks pretty good, easier than piecing together all the parameters separately: https://www.digitalocean.com/community/tools/nginx

Seems like it has directions for certbot and generating dhparams, etc. as well.

For something like that, you’d want a VPS with 2-4 cores, 4 GB RAM, 80 GB SSD. Any less and you’ll start to run into problems when adding bridges and stuff.

So, it’s really a matter of what deals you can find in that bracket, and if you care about the geographical region it’s hosted in. Usually https://lowendtalk.com/ is a good place to start looking at options.

I think what you have is fine, and wouldn’t worry about it too much.

That said, I run unbound with pi-hole, directing the dns queries through a wireguard tunnel. It’s a bit slower, but I do like having my own recursive DNS, especially with news that more and more services are implementing DNS level blocking.