That question is a little bit out of the scope of a forum like this. A question like that would better be answered by the nginx documentation. Sometimes the project documentation might have a blurb about nginx configuration specific for that project. For example, Immich.
For the most part, you only have to reference the nginx documentation. I’ve never looked at the Immich config above until now, and my Immich server works great.
I’ve had a reverse proxy for years, but the config files are very foreign to me because I use Nginx-Proxy-Manager. NPM makes nginx usable for dummies like me, at the expense of gaining a deeper understanding of how it works. I’m ok with that, but you might feel differently.
To access things outside of your LAN (for example from your phone while at the grocery store), each service gets a DuckDNS entry. “service.myduckdns.com” or whatever.
Your phone will look for service.myduckdns.com on port 443, because you’ll have https:// certificates and that all happens on port 443.
When that request eventually gets to your router and is trying to penetrate your firewall, you’ll need 443 open and forwarded to your Debian machine.
So yes, you have it right.
Also forward port 80.