Mount it in the VM, not as Proxmox host storage — that keeps a dead NAS from hanging Proxmox itself, and you can reboot or move the one VM without touching the host. FYI, use nofail with automount rather than a plain entry that blocks boot, so the VM still comes up if TrueNAS is offline when it starts.
Give each Docker service its own dataset/share instead of one big share for everything, so one service filling or locking a share doesn’t take the rest down. And keep anything that can’t tolerate a stall — database files especially — on local disk in the VM, with only bulk media/files on the NFS mount. Test it once by taking TrueNAS offline on purpose and watching what the containers do; that’s when you’ll find out if a hang occured rather than a clean error. Seperate shares also make permissions easier to fix per service, since you’re already dealing with the ownership issues tofu mentioned.
You don’t actually need Duplicati on her end at all, Duplicati can back up to a plain SFTP or WebDAV target, or S3, so her side just needs to recieve files. The simplest setup I’ve seen for a non-technical friend is SFTPGo in Docker over Tailscale, it has a web UI for managing a user and a folder, and nothing is exposed to the internet.
Keep the encryption on your side, Duplicati encrypts before upload, so she only ever sees encrypted blobs, and store the passphrase somewhere seperate from the backup itself. Set a quota if you can, agree on how much disk she is giving you, and test a restore to a spare folder once, a backup you haven’t restored is just a hope. FYI scheduled backups plus a monthly restore test is what actually saves you when a disk dies.