I use this setup and don’t terminate SSL at the VPS and solely tunnel the encrypted traffic over a wire guard tunnel to the home lab where SSL is terminated.

The VPS solely serves to move the traffic from an external IP to an internal one.

It’s possible that someone could log into my server, change the nginx config to terminate SSL and then siphon data but it would take a few steps and can be somewhat mitigated by stapling the SSL certs that should be seen from the homelab.

Sovol sv08 is a voron-alike that seems to fit your criteria.

Got a source on the Bambu running marlin?