I use traefik with a wildcard domain pointing to a Tailscale IP for services I don’t want to be public. For the services I want to be publicly available I use cloudflare tunnels.

I think you have a misunderstanding. Restic and Borg checks the integrity of the backup repository and not the files being backed up.

i call it “butter FS”

podman-generate-systemd is outdated. The currently supported way to run podman containers using systemd services would be Quadlet files.

https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html

Edit: I just saw that you use debian so idk if Quadlets are a thing with the podman version on debian.