If setting up official docker container looks hard, check out linuxserver.io’s docker container for Jellyfin. Even HWA is very easy.
The WireGuard encryptions stops when data reaches their servers and the data is re-encrypted to be sent to the client. So, theoretically, they can look at all the data being passed through.
Read more here about TLS termination and TLS passthrough. https://blog.aiquiral.me/bypass-cgnat
There’s a lot of reasons why I think Signal on an iPhone may not be as private as on a FOSS Android ROM.
First thing is that you are probably getting your notifications from an Apple server. While Apple cannot see the message content, it os possible that they are still collecting some metadata, as when is the user receiving messages, etc.
Second, the usage of keyboard. I cannot prove that Apple is keylogging your every keyboard stroke, but I don’t think anyone can disprove it either. On Android, we always ask users to use a FOSS keyboard, as some keyboard apps look at the screen and read messages to “provide better text prediction”.
Last is app usage metadata. Apple is still storing all the information about how many times you unlock the phone and how much you use Signal, how many times you open the app in a day, when and (maybe even) why you open the app. Which photos you are sharing through your photos app with Signal, such information is also valuable.
I would say most of your conversations are private, as Signal’s developers are very knowledgeable and they know what they are doing.
But if you have a skeptical mind like I do, or even like most people here do, I would not trust them a bit because of their proprietary code. You cannot be completely sure what they are doing. You just have to trust Apple, which most of here don’t.