Best practice for reverse proxy via Apache2?

I’m trying to configure Apache2 to reverse proxy basically all the services on my server to subdirectories. Ideally, I’d like to have the following:

https://host.domain.com/hass/ --> http://localhost:8123/ (Home Assistant)
https://host.domain.com/plex/ --> http://localhost:32400/ (Plex media server)
https://host.domain.com/nvr/ --> http://localhost:7080/ (UniFi NVR)

as well as having a simple web page at / and OwnCloud at /owncloud/.

I could do subdomains but I’d really prefer not to; I have an actual paid SSL cert rather than using Let’s Encrypt, and while they’re only $10 a pop it’s still ten bucks a pop for something I shouldn’t need in the first place. Plus my ISP has decided it’d be fun to block port 80, which makes the renewal process for LE a complete PITA.

This is what I’ve got so far. Will it work? What should I do differently?

<VirtualHost *:443>
  ServerAdmin ***@*******.com
  ServerName ****.*******.com
  DocumentRoot /srv/www/
  ErrorLog ${APACHE_LOG_DIR}/error.log
  CustomLog ${APACHE_LOG_DIR}/access.log combined
  SSLEngine on
  SSLCertificateFile      /etc/ssl/certs/****.*******.com_2019.cer
  SSLCertificateKeyFile /etc/ssl/certs/****.*******.com.key
  SSLCertificateChainFile /etc/ssl/certs/Intermediate1.cer
  SSLCipherSuite HIGH:!aNULL:!MD5
  
  # Home Assistant reverse proxy              
  ProxyPass             /hass/  http://localhost:8123/
  ProxyPassReverse      /hass/  http://localhost:8123/
                
  # Plex server reverse proxy
  ProxyPass             /plex/  http://localhost:32400/
  ProxyPassReverse      /plex/  http://localhost:32400/
                
  # UniFi NVR reverse proxy
  ProxyPass             /nvr/   http://localhost:7080/
  ProxyPassReverse      /nvr/   http://localhost:7080/
</VirtualHost>

LE also supports DNS-01 challenges - no port forwarding required. I switched to that earlier this year and it’s been a lot easier.

As for your original problem, I don’t think that’ll work. Various people have tried to do that with HA, and it looks like the nature of the UI doesn’t allow the proxy to re-write the paths.