Single hand-crafted artisan organic GMO-free compose file for services that egress through regional VPNs and are exposed internally through Tailscale; *arr, transmisson, piped, etc.
Plex, iSponsorBlock, ArchiveBox have their own compose files since I keep them close to upstream. This way when the inevitable breaks they're easier to troubleshoot.
Restic + rclone [1] is a good combination. Supports encryption, versioning, dedupe, snapshots etc. When I looked into offsite backups a couple years ago I was originally focused on the cost for storage but then realized data transfer costs can add up too.
After doing evals on S3, Wasabi, Backblaze and Hetzner with Restic I ended up going with Google Drive. Flat annual price and no data transfer fees. Since Restic does all encryption locally I'm not worried about what the Big G can see.