I’d rather not mount the docker sock into my reverse proxy,

You don't have to if you use the dynamic file config. I've mentioned this before and debated to the ends of earth for even suggesting such a thing. But it all aspects is dynamic file configuration better.

Of you use IaC in your set up, it gets even easier because then you can just set up templates that automatically create file configs and add them to your reverse proxy seamlessly.

Right now with one Terraform apply, I create my docker container, traefik config and my homepage service.

Yeah, this experience with Traefik lines up pretty well with mine. It can be a steep learning, and the fact that half the search results out there are for Traefik v1 (with a completely different configuration syntax to v2) doesn't help. But once it's up and running, the dynamic configuration based on container labels is pretty darned nice.

Now I am even debating wether I should keep it at all, because I’d rather not mount the docker sock into my reverse proxy, the one software that ultimately connects to the web directly.

You could switch to Podman, in which case you'd give it a non-root, read-only socket that isn't the keys to the kingdom. Or maybe rootless Docker would be an easier switch and still give you some of those benefits.

I tried about 6 guides:

This is the definitive guide that always works even if you sub in cloudflare for let's encrypt.

https://www.smarthomebeginner.com/traefik-docker-compose-guide-2022/

I am just running the normal nginx image with /etc/letsencrypt:/etc/ssl/private as volume. certbot does the rest. If you need help with the exact config just search for relevant keywords, there are tons of good tutorials

Here's an overview of the Let's Encrypt DNS challenge type in case you haven't seen it: https://letsencrypt.org/docs/challenge-types/#dns-01-challenge

Basically, when Traefik goes to request or renew a certificate, Let's Encrypt tries to look up a special DNS record on your domain so you can prove that the request for the certificate is legit. To make that work, Traefik first hits your DNS provider via API and temporarily inserts that special record so it's there when Let's Encrypt performs the lookup for it. In my particular case, I'm using self-hosted PowerDNS and it's built-in API (configured to only respond via a Wireguard tunnel). But you don't have to self-host DNS for this to work.. Traefik has a long list of supported providers: https://doc.traefik.io/traefik/https/acme/#dnschallenge