I’d be interested in that too; I’ve always avoided ZeroSSL so far because I have 80 (sub)domains. I manage 7 root domains as wildcards and 6 as individual certificates—that always sounded like it would be unaffordable for me.

Secure Boot is unfortunately always a bit of a hack on Arch.

I don’t really have a favorite; I offer a lot of software to the public for free use. Ansible and Proxmox are really helpful for me in doing that.

Ansible Scripts: https://git.rollenspiel.monster/ansible-playbooks