A DMZ is always recommended in such cases.
> Should I create a sub network and get a raspberry pi to host these apps?
Yes, it's always better. However, Pi may be overpriced now. Take a look at NUC-sized miniPCs, for roughly the same price you'll get much more computing power.
Well, I'm running my own CA/PKI just for the sake of it. Still very useful and more private and convenient for my homelab+.
As for apps themselves, some of them are really useful to me:
The others are useful, but I still haven't unleashed their true potential:
The third group helps me to run my homelab:
Tried these, but decided not to use, at least for now:
Probably not your case, but that's what I use for my homelab:
.home.arpasubdomains etc