I think you need a much better understanding of surge protection and lightning protection.

The first thing to look at is the passive protection. If you have a grounded metal structure anything within a 35 degree angle from the highest point is protected. It is slightly better, Google “rolling sphere” model. You need at least 2 ground rods and stranded grounding cables running to the ground rods. Do NOT share with the electrical ground and stay at least 10 feet away. Run fiber, NOT copper between buildings. If you can’t there are special surge arresters using PIN diodes or GDTs but it’s not ideal. Put one at each end.

That takes care of protecting against direct strikes. The rest is dealing with indirect strikes Put surge arresters on ALL attached lines…power or network. Keep in mind you get about 20 V of rise per inch away from the surge arrester so they really offer very little protection more than a few feet away. Standards test equipment against surges at a peak voltage equal to twice the nominal (marked) voltage plus 1,000 V

This also protects against switching surges that are far more common compared to lightning strikes.

Why not use Macvlan and join your Dockers to that rather than a bridge to Tailscale or Cloudflared? Then they are broken out so you can apply monitoring.

There are some ARM chips that go down to microamps in low power mode and draw only 1 Watt at full power but might drive you nuts trying to run Linux on them.