I’ve got your exact setup:

• running immich (and other services with valuable data) at home (on OMV!)
• backup server at family member’s house
• regular backups from here to there through Wireguard tunnel with Borgbakup

AMA!

I don’t want a compromised device on the family member’s network to compromise mine

If with “mine” you mean the pi Zero, I wouldn’t worry too much about that. Just configure the pi’s firewall to drop all traffic from the LAN (they have no business with this device anyway), except any incoming traffic from the router on the Wireguard port.

Ah! I use virt-manager + qemu on desktop Linux, mainly to try things and and contain dodgy software (Windows). I didn’t know it was commonly used on headless servers. Thanks for pointing that out!

This sounds a lot like my second option, except yours is a little more custom-made. What do you use to set up and run your VMs?

I’ve done my research on that, and apparently LXCs share the host kernel, meaning: if the LXC is compromised, so is the host system. So if I go with Proxmox, I’ll probably swallow the (somewhat) larger overhead of running a full VM.