

Correct but there are really only 2 parts (3 if you’re adding a front-facing proxy which it sounds like you know how to do). If you’re using something like truenas or proxmox there are prebuilt containers for both iCloudpd and immich/photoprosm/whatever and even if not both have generic Docker containers or can be run out of their own repo checkout. So you just need:
- iCloud <—> local folder via icloudpd
- local folder <—> local web front end with immich
- local web <—> public web with your proxy or cloudflare setup
Good luck!
The scenario you describe with ISPs is pretty US-centric, as are the various copyright laws and companies backing it, which is (one of the reasons) why many of the most successful VPN companies are either not based in the US (and most have server nodes that are not too).
Mullvad is from Sweden, for example, and Proton is from Switzerland, so if a content company can even figure out which endpoint nodes are hosting/routing the pirate content they then also have to figure out (a) who owns the node and (b) then send them an angrygram which will just immediately be torn up by the VPN provider as they’re not subject to US law.
Finally, an operating principle of these companies is to keep no logs, so even if a US-based VPN company got an angry letter, they’d probably be unable to do anything since they would have no record of the activity.