I think if you didn’t assign a tag on the Release Profile it applies to all series.

I do a lot of Architecting for my company and it’s often easier to have direct access to DNS to make quick changes rather than wait one or more days for an engineer to go change records. If this is just going to be a test environment perhaps you could delegate a subdomain of your current domain. E.g. Add NS records for test.example.com that point to the NS of the contractors hosted zone. This gives you control to tear it down (delete the NS records) but allows the contractor the ability to build the environment out.

I have never done RAID over USB, but have done various JBOD setups using SCSI. I think the general idea is that USB having such an easily disconnected connector plus the latency overhead on translating SATA to USB to SATA again means you have a higher chance of corruption. SCSI setups typically have connectors with locking mechanisms to prevent easy disconnection.

If eSATA is an option it might be better for the performance and it has a latching mechanism to prevent easy disconnection. You can get a 2-port eSATA PCI card for about 50 bucks.

Oh, and if you have a free PCI port, you could add internal SATA ports to mount the drives internally.

I know tailscale prefers being installed on every machine but not all of my machines are even capable of running custom code. I use a single tailscale router that published my internal network to tailscale and if the internet is down everything still works fine internally.

With TrueNas you can do it two ways: ISCSI disks that are mounted to the VMs or via NFS. With ISCSI you won’t have access to the data from the TrueNas side as the data will be stored as a volume file. With NFS you get the best of both worlds as you’ll be able to access the files via other TrueNas services like SMB/SFTP. I have my Jellyfin/Plex running via NFS and have few issues, though I’ve not tested it with large 4k/8k videos yet. I mostly run 1080p.