The Capabilities API is a client side library so it runs in the context of the users browser, hence what webserver you pick is not important. It can be any webserver.
Qlik Sense Server / QAP still requires a windows machine but hosting web content can be done on any OS.
Ticket authentication is REST based with certificates to authenticate your requests inside your authentication module.
See the documentation for the QPS API for more information: Qlik Sense Proxy Service API ‒ Qlik Sense