I’ve set up something like that with Opus. Works well enough, and points out CVEs to fix on the regular.

Running NixOS helps.