Use vlans to create a dmz you can place a server only for public Internet facing stuff.

You contradict yourself on paragraphs 5 and 7. First you say it's reachable from the outside then it isn't.

DIY always better for an all around server which is a nas but also a application server.

I have an old i7-7700T with 32gb ram in a fractal node 304 case, running Ubuntu and 3x4tb drives in zfs raidz1. There's little it can't handle.