What’s the exposure surface of this if I have remote access disabled?

I’d start with wkhtmltopdf/pdfkit

Surely you can figure out how to use existing libraries for this task, or is there something you’re stuck on?

There are a ton of options depending on your tech level.

How are you with basic Python scripts?

You want the big files to live on the NAS, but be navigable from your home dir for convenience and to discourage saving to the local disk.

And make symlinks for large collections, like ~/photos -> /mnt/nas/photos