The major think noobs tend to mess up with docker is not setting up volumes properly so when you get rid of the instance, you lose all of your data.

I also highly recommend docker-compose for ease of use.

Id recommend looking up security best practices for docker as well. Things like setting a user id & gid for the containers add an additional layer of security.

Oh and make sure you get your containers from trustworthy sources.

I have my 22 port opened on IPv6 only and I can only authenticate with my private keys, which are all added in .ssh/authorized_keys. Fail2ban is configured to keep the bots out but the ban log is empty because there are either no bots operating on IPv6 yet or my IP is so far out of reach it will take the bot a millenium to get to my address.

Some set up WireGuard or another VPN protocol but I like having everything within reach as long as the device I'm carrying has my key on it.

One thing you should avoid is opening your docker containers to the web. If your VPS isn't behind a NAT (they usually aren't) becareful when binding ports which usually bypasses whatever firewall configuration you may have because docker writes it's changes directly to nftables.

https://docs.docker.com/network/#published-ports

Other then that, remember that this is just a hobby (for now) and take a break when something doesn't work or you don't understand it. I personally did a lot of mistakes because I was just eager to finish something and I was rushing it.

I host in the way that you describe: "service.domain.com". I use Cloudflare, docker, and Caddy.

I don't remember any pit falls off the top of my head. Make sure to use HTTPS (port 443). Everything on http is basically open for everyone to see. Caddy should set that up for you automatically, tho. I recently moved to Caddy from Traefik, it's an awesome tool.

Oh, here's a pitfall. One time I opened a port, #22, for ssh access to my server. I installed fail2ban on my server. One weekend I looked at my logs and found I'd banned hundreds of IP addresses. Some bot found my open port and then begun attacking the login with some kinda rainbow table. I moved the port from the ssh default to something else and never had a problem since.

Also, and this isn't a requirement but just useful, I set up a VLAN for my selfhosted server. It's firewalled from my local network. That way, if someone access' my server they don't have access to my whole network.

So, tldr, have fun and midigate risk where you can.

some sort of dashboard with monitoring and statuses of all my services

See if Uptime Kuma suits your needs.

Are there any major no-no things a newbie might do with Docker/selfhosting that I should avoid?

Allow password based SSH authentication, you should look into key based authentication

I wanted to have it behind a domain, how would I achieve it?

Use a reverse proxy (like caddy) which serves different content based on domain name.

Don’t expose anything from your local network to the internet (unless you want multiple new sysadmins in your house). Try tailscale instead.